Function at 0x1400dac00
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x70
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rbp, r9
mov r12, rdx
mov rdi, rcx
test rcx, rcx
jne 0x1400dac31
xor eax, eax
jmp 0x1400dae40
test r9, r9
jne 0x1400dac3d
xor eax, eax
jmp 0x1400dae40
xor esi, esi
mov rbx, rsi
mov qword [rsp + 0x30], rbx
lea rdx, [0x14018d638]
lea rcx, [rsp + 0x38]
call fcn.1400db050
mov dword [rsp + 0x90], esi
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x1400dac97
mov edi, esi
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rbx
test edi, edi
jne 0x1400dacfa
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400dace4
cmp dword [rsp + 0x48], 4
je 0x1400dadfe
lea edi, [rax + 0xd]
test rbx, rbx
je 0x1400dacfa
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
mov qword [rsp + 0x30], rbx
test r12, r12
je 0x1400dadc4
mov qword [rsp + 0x58], rsi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, r12
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400dad8e
test rbx, rbx
je 0x1400dad3f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rcx
test esi, esi
jne 0x1400dad8e
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400dadc4
cmp dword [rsp + 0x4c], 4
jne 0x1400dadc8
jmp 0x1400dadfe
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400dadb0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400dadc0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400dae40
test edi, edi
je 0x1400dadfe
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400dadea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400dadfa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400dae40
mov eax, dword [rsp + 0x90]
mov dword [rbp], eax
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400dae2b
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400dae3b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret