Function at 0x1400071e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov ebx, r9d
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
and dword [rsp + 0x34], 0
mov ecx, 8
call fcn.14000c2c4
test rax, rax
je 0x14000722a
lea rcx, [rsp + 0x38]
mov qword [rax], rcx
jmp 0x14000722c
xor eax, eax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140006fd4
mov r11, qword [rsp + 0x50]
test r11, r11
jne 0x14000725e
xor edx, edx
jmp 0x140007266
mov rdx, qword [rsp + 0x60]
sub rdx, r11
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.1400070e8
mov r11, qword [rsp + 0x58]
mov eax, r11d
mov rcx, qword [rsp + 0x50]
sub eax, ecx
mov dword [rsp + 0x30], eax
test rsi, rsi
je 0x1400072e8
lea rdx, str._Default_
mov rcx, rsi
call fcn.14000d8c4
test eax, eax
jne 0x1400072de
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
cmp rax, rcx
jne 0x1400072b7
call fcn.14000c518
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
jmp 0x14000731d
mov r11, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
cmp r11, rcx
jne 0x1400072f7
call fcn.14000c518
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
cmp ebx, 0xea
je 0x140007350
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
cmp rcx, r8
jne 0x140007343
call fcn.14000c518
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
test r8, r8
jne 0x1400073c0
test ebx, ebx
jne 0x140007415
mov edx, dword [rsp + 0x30]
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.1400070e8
mov rcx, qword [rsp + 0x58]
mov rdx, rcx
mov r8, qword [rsp + 0x50]
sub rdx, r8
mov eax, dword [rsp + 0x30]
cmp rdx, rax
jne 0x1400073bb
test rdx, rdx
jne 0x140007389
call fcn.14000c518
mov r8, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
jmp 0x1400073c0
mov ebx, 8
test ebx, ebx
jne 0x140007415
cmp rcx, r8
jne 0x1400073d3
call fcn.14000c518
mov r8, qword [rsp + 0x50]
mov r9d, dword [rsp + 0x30]
mov edx, dword [rsp + 0x34]
mov rcx, rdi
call fcn.140006bc4
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400073f4
call fcn.14000bf00
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x38]
call fcn.14000bf00
mov rax, rdi
jmp 0x14000748b
cmp byte [rsp + 0x100], 0
je 0x140007440
xor r8d, r8d
mov edx, ebx
lea rcx, [rsp + 0x70]
call fcn.14000b1bc
lea rdx, [0x14002b010]
lea rcx, [rsp + 0x70]
call fcn.14000cc8c
int3
cmp rcx, r8
jne 0x14000744f
call fcn.14000c518
mov r8, qword [rsp + 0x50]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
call fcn.140006bc4
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000746c
call fcn.14000bf00
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x38]
call fcn.14000bf00
mov rax, rdi
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret