Function at 0x7ff74b01cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
lea rcx, [0x7ff74b593e0]
call qword [sym.imp.ntdll.dll_RtlInitializeCriticalSection]
xor esi, esi
cmp eax, esi
jl 0x7ff74b0246a
mov rcx, qword [0x7ff74b584e0]
lea r12d, [rsi + 0x18]
mov ebx, esi
xor edx, edx
mov r8, r12
mov dword [rsp + 0x80], ebx
call qword [0x7ff74b58358]
lea r14, [0x7ff74b58350]
lea r13d, [rsi + 0xe]
mov rdi, rax
cmp rax, rsi
je 0x7ff74b0f379
mov qword [rax], rsi
mov qword [rax + 8], rsi
cmp dword [0x7ff74b582c8], esi
je 0x7ff74b01d33
mov rcx, qword [0x7ff74b58350]
cmp rcx, r14
je 0x7ff74b01d33
test byte [rcx + 0x1c], 0x20
jne 0x7ff74b0f355
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
lea r8d, [rdx + 0x48]
call qword [0x7ff74b58358]
cmp rax, rsi
je 0x7ff74b0f371
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.7ff74af6214
mov ebx, dword [rsp + 0x80]
jmp 0x7ff74b01d68
cmp rax, rsi
mov qword [rdi + 0x10], rax
mov qword [0x7ff74b58380], rdi
cmove ebx, r13d
mov dword [rsp + 0x80], ebx
jmp 0x7ff74b01d83
cmp ebx, esi
jne 0x7ff74b0f79e
cmp rdi, rsi
je 0x7ff74b0f81d
call fcn.7ff74aff890
mov rcx, qword [0x7ff74b584e0]
mov r8, r12
xor edx, edx
call qword [0x7ff74b58358]
mov r15d, 0x10
cmp rax, rsi
je 0x7ff74b0f388
lea rdx, [rsp + 0x80]
mov r8d, r15d
mov rcx, rax
call fcn.7ff74b02490
mov ebx, dword [rsp + 0x80]
mov rdi, rax
mov qword [0x7ff74b58438], rax
jmp 0x7ff74b01de0
cmp ebx, esi
jne 0x7ff74b0f397
mov rcx, qword [0x7ff74b584e0]
mov r8, r12
xor edx, edx
call qword [0x7ff74b58358]
cmp rax, rsi
je 0x7ff74b0f3c2
lea rdx, [rsp + 0x80]
mov r8d, 0xb0
mov rcx, rax
call fcn.7ff74b02490
mov ebx, dword [rsp + 0x80]
mov rdi, rax
mov qword [0x7ff74b58450], rax
jmp 0x7ff74b01e2c
cmp ebx, esi
jne 0x7ff74b0f3d1
mov rcx, qword [0x7ff74b584e0]
mov r8, r12
xor edx, edx
call qword [0x7ff74b58358]
cmp rax, rsi
je 0x7ff74b0f3fc
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.7ff74afead0
mov ebx, dword [rsp + 0x80]
jmp 0x7ff74b01e68
mov qword [0x7ff74b58470], rax
cmp ebx, esi
jne 0x7ff74b0f404
mov rcx, qword [0x7ff74b584e0]
mov r8, r12
xor edx, edx
call qword [0x7ff74b58358]
cmp rax, rsi
je 0x7ff74b0f422
lea rdx, [rsp + 0x80]
mov r8d, r15d
mov rcx, rax
call fcn.7ff74b02490
mov ebx, dword [rsp + 0x80]
mov rdi, rax
mov qword [0x7ff74b58440], rax
jmp 0x7ff74b01eb8
cmp ebx, esi
jne 0x7ff74b0f431
mov rcx, qword [0x7ff74b584e0]
mov r8, r12
xor edx, edx
call qword [0x7ff74b58358]
mov ebp, 0x40
cmp rax, rsi
je 0x7ff74b0f45c
lea rdx, [rsp + 0x80]
mov r8d, ebp
mov rcx, rax
call fcn.7ff74b02490
mov ebx, dword [rsp + 0x80]
mov rdi, rax
mov qword [0x7ff74b58468], rax
jmp 0x7ff74b01f06
cmp ebx, esi
jne 0x7ff74b0f46b
mov rcx, qword [0x7ff74b584e0]
mov r8, r12
xor edx, edx
call qword [0x7ff74b58358]
cmp rax, rsi
je 0x7ff74b0f496
lea rdx, [rsp + 0x80]
mov r8d, r15d
mov rcx, rax
call fcn.7ff74b02490
mov ebx, dword [rsp + 0x80]
mov rdi, rax
mov qword [0x7ff74b58478], rax
jmp 0x7ff74b01f4f
cmp ebx, esi
jne 0x7ff74b0f4a5
mov rcx, qword [0x7ff74b584e0]
mov r8, r12
xor edx, edx
call qword [0x7ff74b58358]
cmp rax, rsi
je 0x7ff74b0f4d0
lea rdx, [rsp + 0x80]
mov r8d, r15d
mov rcx, rax
call fcn.7ff74b02490
mov ebx, dword [rsp + 0x80]
mov rdi, rax
mov qword [0x7ff74b58490], rax
jmp 0x7ff74b01f98
cmp ebx, esi
jne 0x7ff74b0f4df
mov rcx, qword [0x7ff74b584e0]
mov r8, rbp
xor edx, edx
call qword [0x7ff74b58358]
cmp rax, rsi
je 0x7ff74b0f50a
movzx r8d, word [0x7ff74b58370]
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.7ff74afea18
mov ebx, dword [rsp + 0x80]
mov rdi, rax
mov qword [0x7ff74b58448], rax
jmp 0x7ff74b01fe6
cmp ebx, esi
jne 0x7ff74b0f519
mov rcx, qword [0x7ff74b584e0]
mov r8, rbp
xor edx, edx
call qword [0x7ff74b58358]
mov rdi, rax
cmp rax, rsi
je 0x7ff74b0f544
movzx r8d, word [0x7ff74b58600]
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.7ff74afea18
mov ebx, dword [rsp + 0x80]
mov qword [0x7ff74b58458], rdi
jmp 0x7ff74b02034
cmp ebx, esi
jne 0x7ff74b0f553
mov rcx, qword [0x7ff74b584e0]
mov r8, rbp
xor edx, edx
call qword [0x7ff74b58358]
cmp rax, rsi
je 0x7ff74b0f57e
movzx r8d, word [0x7ff74b58370]
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.7ff74afea18
mov ebx, dword [rsp + 0x80]
mov rdi, rax
mov qword [0x7ff74b58480], rax
jmp 0x7ff74b02082
cmp ebx, esi
jne 0x7ff74b0f58d
mov rcx, qword [0x7ff74b584e0]
mov r8, rbp
xor edx, edx
call qword [0x7ff74b58358]
cmp rax, rsi
je 0x7ff74b0f5b8
movzx r8d, word [0x7ff74b58370]
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.7ff74afea18
mov ebx, dword [rsp + 0x80]
mov rdi, rax
mov qword [0x7ff74b58488], rax
jmp 0x7ff74b020d0
cmp ebx, esi
jne 0x7ff74b0f5c7
mov rcx, qword [0x7ff74b584e0]
mov r8, r15
xor edx, edx
call qword [0x7ff74b58358]
mov rdi, rax
cmp rax, rsi
je 0x7ff74b0f610
cmp dword [0x7ff74b582c8], esi
je 0x7ff74b02114
mov rcx, qword [0x7ff74b58350]
cmp rcx, r14
je 0x7ff74b02114
test byte [rcx + 0x1c], 0x20
jne 0x7ff74b0f5f2
mov dword [rdi], ebp
mov dword [rdi + 4], esi
mov qword [rdi + 8], rsi
mov qword [0x7ff74b584b0], rdi
jmp 0x7ff74b02126
mov rcx, qword [0x7ff74b584e0]
mov r8, r15
xor edx, edx
call qword [0x7ff74b58358]
mov rdi, rax
cmp rax, rsi
je 0x7ff74b0f63a
mov qword [rax], rsi
mov qword [rax + 8], rsi
cmp dword [0x7ff74b582c8], esi
je 0x7ff74b02169
mov rcx, qword [0x7ff74b58350]
cmp rcx, r14
je 0x7ff74b02169
test byte [rcx + 0x1c], 0x20
jne 0x7ff74b0f61c
mov qword [0x7ff74b58460], rdi
jmp 0x7ff74b02172
mov rcx, qword [0x7ff74b584e0]
mov r8, r12
xor edx, edx
call qword [0x7ff74b58358]
mov rdi, rax
cmp rax, rsi
je 0x7ff74b0f66c
mov qword [rax], rsi
mov qword [rax + 8], rsi
cmp dword [0x7ff74b582c8], esi
je 0x7ff74b021b5
mov rcx, qword [0x7ff74b58350]
cmp rcx, r14
je 0x7ff74b021b5
test byte [rcx + 0x1c], 0x20
jne 0x7ff74b0f646
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
lea r8d, [rdx + 0x48]
call qword [0x7ff74b58358]
cmp rax, rsi
je 0x7ff74b0f664
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.7ff74af6214
mov ebx, dword [rsp + 0x80]
jmp 0x7ff74b021ea
cmp rax, rsi
mov qword [rdi + 0x10], rax
mov qword [0x7ff74b58388], rdi
cmove ebx, r13d
jmp 0x7ff74b021fe
cmp ebx, esi
jne 0x7ff74b0f67b
cmp qword [0x7ff74b58418], rsi
je 0x7ff74b0f824
cmp qword [0x7ff74b58420], rsi
je 0x7ff74b0f824
cmp qword [0x7ff74b58438], rsi
je 0x7ff74b0f824
cmp qword [0x7ff74b58440], rsi
je 0x7ff74b0f824
cmp qword [0x7ff74b58448], rsi
je 0x7ff74b0f824
cmp qword [0x7ff74b58450], rsi
je 0x7ff74b0f824
cmp qword [0x7ff74b58458], rsi
je 0x7ff74b0f824
cmp qword [0x7ff74b58468], rsi
je 0x7ff74b0f824
cmp qword [0x7ff74b58490], rsi
je 0x7ff74b0f824
cmp qword [0x7ff74b58470], rsi
je 0x7ff74b0f824
cmp qword [0x7ff74b58478], rsi
je 0x7ff74b0f824
cmp qword [0x7ff74b58480], rsi
je 0x7ff74b0f824
cmp qword [0x7ff74b58488], rsi
je 0x7ff74b0f824
cmp qword [0x7ff74b58498], rsi
je 0x7ff74b0f824
cmp qword [0x7ff74b584b0], rsi
je 0x7ff74b0f824
cmp qword [0x7ff74b58460], rsi
je 0x7ff74b0f824
cmp rdi, rsi
je 0x7ff74b0f824
lea rax, [rsp + 0x98]
lea rdx, str.SoftwareMicrosoftRpc
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x88], 0x76
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov dil, 1
mov ebx, eax
lea rbp, [0x7ff74b50000]
cmp eax, esi
jne 0x7ff74b0f6ce
mov r8, qword [0x7ff74b58408]
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov ecx, dword [rsp + 0x88]
mov eax, 2
inc ecx
shr rcx, 1
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
mov r8, rax
call qword [0x7ff74b58358]
mov qword [0x7ff74b58408], rax
cmp rax, rsi
je 0x7ff74b0f824
lea rcx, [rsp + 0x88]
lea r9, [rsp + 0x90]
lea rdx, str.DCOM_Protocols
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x98]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 0xea
je 0x7ff74b02328
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp ebx, esi
jne 0x7ff74b0f6ce
cmp dword [rsp + 0x90], 7
jne 0x7ff74b0f6ce
mov ecx, r15d
call fcn.7ff74b01340
cmp eax, esi
jne 0x7ff74b0246a
mov dword [0x7ff74b582dc], esi
call fcn.7ff74af0590
call fcn.7ff74af082c
cmp eax, esi
jne 0x7ff74b0246a
lea rax, [0x7ff74ae4c64]
lea rcx, [0x7ff74b49320]
mov ebx, 0x4d2
mov qword [rsp + 0x28], rax
mov r9d, 0x20
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
cmp eax, esi
jne 0x7ff74b0f71e
lea rax, [0x7ff74b0b4a4]
lea rcx, [0x7ff74b49880]
mov r9d, r15d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
mov ebx, eax
cmp eax, esi
jne 0x7ff74b0f75e
mov eax, ebx
jmp 0x7ff74b0246a
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0xd]
lea r8, [0x7ff74b51ce0]
mov r9, rax
call fcn.7ff74b263d0
nop
jmp 0x7ff74b01d33
mov rax, rsi
jmp 0x7ff74b01d68
mov rdi, rsi
mov qword [0x7ff74b58380], rsi
jmp 0x7ff74b01d83
mov rdi, rsi
mov qword [0x7ff74b58438], rsi
jmp 0x7ff74b01de0
cmp rdi, rsi
je 0x7ff74b0f3b6
mov rcx, rdi
call fcn.7ff74b294bc
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov qword [0x7ff74b58438], rsi
jmp 0x7ff74b01de8
mov rdi, rsi
mov qword [0x7ff74b58450], rsi
jmp 0x7ff74b01e2c
cmp rdi, rsi
je 0x7ff74b0f3f0
mov rcx, rdi
call fcn.7ff74b294bc
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov qword [0x7ff74b58450], rsi
jmp 0x7ff74b01e34
mov rax, rsi
jmp 0x7ff74b01e68
mov rcx, qword [0x7ff74b584e0]
mov r8, rax
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov qword [0x7ff74b58470], rsi
jmp 0x7ff74b01e77
mov rdi, rsi
mov qword [0x7ff74b58440], rsi
jmp 0x7ff74b01eb8
cmp rdi, rsi
je 0x7ff74b0f450
mov rcx, rdi
call fcn.7ff74b294bc
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov qword [0x7ff74b58440], rsi
jmp 0x7ff74b01ec0
mov rdi, rsi
mov qword [0x7ff74b58468], rsi
jmp 0x7ff74b01f06
cmp rdi, rsi
je 0x7ff74b0f48a
mov rcx, rdi
call fcn.7ff74b294bc
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov qword [0x7ff74b58468], rsi
jmp 0x7ff74b01f0e
mov rdi, rsi
mov qword [0x7ff74b58478], rsi
jmp 0x7ff74b01f4f
cmp rdi, rsi
je 0x7ff74b0f4c4
mov rcx, rdi
call fcn.7ff74b294bc
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov qword [0x7ff74b58478], rsi
jmp 0x7ff74b01f57
mov rdi, rsi
mov qword [0x7ff74b58490], rsi
jmp 0x7ff74b01f98
cmp rdi, rsi
je 0x7ff74b0f4fe
mov rcx, rdi
call fcn.7ff74b294bc
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov qword [0x7ff74b58490], rsi
jmp 0x7ff74b01fa0
mov rdi, rsi
mov qword [0x7ff74b58448], rsi
jmp 0x7ff74b01fe6
cmp rdi, rsi
je 0x7ff74b0f538
mov rcx, rdi
call fcn.7ff74b2633c
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov qword [0x7ff74b58448], rsi
jmp 0x7ff74b01fee
mov rdi, rsi
mov qword [0x7ff74b58458], rsi
jmp 0x7ff74b02034
cmp rdi, rsi
je 0x7ff74b0f572
mov rcx, rdi
call fcn.7ff74b2633c
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov qword [0x7ff74b58458], rsi
jmp 0x7ff74b0203c
mov rdi, rsi
mov qword [0x7ff74b58480], rsi
jmp 0x7ff74b02082
cmp rdi, rsi
je 0x7ff74b0f5ac
mov rcx, rdi
call fcn.7ff74b2633c
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov qword [0x7ff74b58480], rsi
jmp 0x7ff74b0208a
mov rdi, rsi
mov qword [0x7ff74b58488], rsi
jmp 0x7ff74b020d0
cmp rdi, rsi
je 0x7ff74b0f5e6
mov rcx, rdi
call fcn.7ff74b2633c
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov qword [0x7ff74b58488], rsi
jmp 0x7ff74b020d8
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b51cf0]
mov edx, 0xa
mov r9, rax
call fcn.7ff74b263d0
nop
jmp 0x7ff74b02114
mov qword [0x7ff74b584b0], rsi
jmp 0x7ff74b02126
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b51ce0]
mov edx, 0xd
mov r9, rax
call fcn.7ff74b263d0
nop
jmp 0x7ff74b02169
mov qword [0x7ff74b58460], rsi
jmp 0x7ff74b02172
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b51ce0]
mov edx, 0xd
mov r9, rax
call fcn.7ff74b263d0
nop
jmp 0x7ff74b021b5
mov rax, rsi
jmp 0x7ff74b021ea
mov rdi, rsi
mov qword [0x7ff74b58388], rsi
jmp 0x7ff74b021fe
cmp rdi, rsi
je 0x7ff74b0f6c2
cmp dword [0x7ff74b582c8], esi
je 0x7ff74b0f6b0
mov rcx, qword [0x7ff74b58350]
cmp rcx, r14
je 0x7ff74b0f6b0
test byte [rcx + 0x1c], 0x20
je 0x7ff74b0f6b0
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b51ce0]
mov edx, r13d
mov r9, rdi
call fcn.7ff74b263d0
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov qword [0x7ff74b58388], rsi
jmp 0x7ff74b0f824
mov r8, qword [0x7ff74b58408]
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
cmp dword [0x7ff74b582c8], esi
je 0x7ff74b0f712
mov rcx, qword [0x7ff74b58350]
cmp rcx, r14
je 0x7ff74b0f712
test byte [rcx + 0x1c], dil
je 0x7ff74b0f712
mov rcx, qword [rcx + 0x10]
mov edx, 0x22
mov r9d, ebx
mov r8, rbp
call fcn.7ff74b25ec4
mov qword [0x7ff74b58408], rsi
jmp 0x7ff74b023e2
cmp dword [0x7ff74b582c8], esi
je 0x7ff74b02437
mov rcx, qword [0x7ff74b58350]
cmp rcx, r14
je 0x7ff74b02437
test byte [rcx + 0x1c], dil
je 0x7ff74b02437
mov rcx, qword [rcx + 0x10]
mov edx, 0x23
mov r9d, eax
mov r8, rbp
call fcn.7ff74b25ec4
nop
jmp 0x7ff74b02437
cmp dword [0x7ff74b582c8], esi
je 0x7ff74b02466
mov rcx, qword [0x7ff74b58350]
cmp rcx, r14
je 0x7ff74b02466
test byte [rcx + 0x1c], dil
je 0x7ff74b02466
mov rcx, qword [rcx + 0x10]
mov edx, 0x24
mov r9d, eax
mov r8, rbp
call fcn.7ff74b25ec4
nop
jmp 0x7ff74b02466
cmp rdi, rsi
je 0x7ff74b0f81d
mov rbx, qword [rdi + 0x10]
cmp rbx, rsi
je 0x7ff74b0f7db
cmp dword [rbx + 0x28], esi
je 0x7ff74b0f7ba
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlDeleteCriticalSection]
mov rcx, qword [rbx + 0x30]
cmp rcx, rsi
je 0x7ff74b0f7c9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x7ff74b584e0]
mov r8, rbx
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
cmp dword [0x7ff74b582c8], esi
je 0x7ff74b0f80b
mov rcx, qword [0x7ff74b58350]
cmp rcx, r14
je 0x7ff74b0f80b
test byte [rcx + 0x1c], 0x20
je 0x7ff74b0f80b
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b51ce0]
mov edx, r13d
mov r9, rdi
call fcn.7ff74b263d0
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov qword [0x7ff74b58380], rsi
mov eax, r13d
jmp 0x7ff74b0246a