Function at 0x14009235c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xc0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r15, r8
mov rbx, rdx
mov r13, rcx
lea rsi, [0x1400d0018]
mov rcx, qword [0x1400d0018]
cmp rcx, rsi
je 0x1400923ca
test byte [rcx + 0x1c], 1
je 0x1400923ca
cmp byte [rcx + 0x19], 5
jb 0x1400923ca
mov rax, qword [r8 + 0x10]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.14008fd1c
and qword [rbp - 0x71], 0
and dword [rbp - 0x69], 0
and dword [rbp - 0x65], 0
lea rdx, [rbp - 0x71]
mov rcx, r13
call fcn.140090050
mov edi, eax
mov r10, qword [0x1400d0018]
cmp r10, rsi
je 0x14009241e
test byte [r10 + 0x1c], 2
je 0x14009241e
cmp byte [r10 + 0x19], 4
jb 0x14009241e
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400ba8e8]
mov rcx, qword [r10 + 0x10]
call fcn.1400035c4
mov r10, qword [0x1400d0018]
and qword [rbp - 0x51], 0
and dword [rbp - 0x49], 0
and dword [rbp - 0x45], 0
lea rcx, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0Server_Settings
lea r8, [0x14000a980]
test edi, edi
jne 0x14009253d
xor ebx, ebx
mov qword [rbp - 9], rbx
and qword [rbp - 1], rbx
and qword [rbp + 7], rbx
and qword [rbp - 0x39], rbx
mov rax, qword [r13]
lea rdx, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0MAC_Access_Control
cmp qword [rax + 0x58], r8
cmovne rdx, rcx
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140092499
mov rbx, qword [rbp - 0x39]
mov qword [rbp - 9], rbx
mov r10, qword [0x1400d0018]
cmp r10, rsi
je 0x1400924d2
test byte [r10 + 0x1c], 2
je 0x1400924d2
cmp byte [r10 + 0x19], 4
jb 0x1400924d2
mov edx, SysStringByteLen
mov r9d, edi
lea r8, [0x1400ba8e8]
mov rcx, qword [r10 + 0x10]
call fcn.1400035c4
mov r10, qword [0x1400d0018]
test edi, edi
jne 0x14009251e
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 9]
call fcn.14008ba14
mov edi, eax
mov r10, qword [0x1400d0018]
cmp r10, rsi
je 0x14009251e
test byte [r10 + 0x1c], 2
je 0x14009251e
cmp byte [r10 + 0x19], 4
jb 0x14009251e
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400ba8e8]
mov rcx, qword [r10 + 0x10]
call fcn.1400035c4
mov r10, qword [0x1400d0018]
test rbx, rbx
je 0x140092539
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov r10, qword [0x1400d0018]
mov rbx, qword [rbp + 0x67]
xor r14d, r14d
cmp dword [rbp - 0x69], r14d
jle 0x140092b4d
xor r12d, r12d
and dword [rbp + 0x77], 0
test r14d, r14d
js 0x140092bc3
cmp r14d, dword [rbp - 0x69]
jge 0x140092bc3
mov rax, qword [rbp - 0x71]
lea r8, [rbp + 0x77]
mov rdx, qword [rax + r12*8]
mov rcx, r13
call fcn.14009124c
mov edi, eax
mov r10, qword [0x1400d0018]
cmp r10, rsi
je 0x1400925b3
test byte [r10 + 0x1c], 2
je 0x1400925b3
cmp byte [r10 + 0x19], 4
jb 0x1400925b3
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400ba8e8]
mov rcx, qword [r10 + 0x10]
call fcn.1400035c4
mov r10, qword [0x1400d0018]
test edi, edi
jne 0x14009260f
cmp dword [rbp + 0x77], 1
jne 0x14009260f
cmp r10, rsi
je 0x140092aa1
test byte [r10 + 0x1c], 2
je 0x140092aa1
cmp byte [r10 + 0x19], 4
jb 0x140092aa1
cmp r14d, dword [rbp - 0x69]
jge 0x140092bce
mov edx, reloc.OLEAUT32.dll_SysStringByteLen
mov rax, qword [rbp - 0x71]
mov r9, qword [rax + r12*8]
lea r8, [0x1400ba8e8]
mov rcx, qword [r10 + 0x10]
call fcn.14000351c
mov r10, qword [0x1400d0018]
jmp 0x140092aa1
and dword [rbp - 0x61], 0
cmp r14d, dword [rbp - 0x69]
jge 0x140092c52
mov rax, qword [rbp - 0x71]
lea r9, [rbp - 0x61]
lea r8, str.DefaultAuthorization
mov rdx, qword [rax + r12*8]
mov rcx, r13
call fcn.1400914f0
test eax, eax
jne 0x14009267c
cmp dword [rbp - 0x61], 1
jne 0x14009267c
mov r10, qword [0x1400d0018]
cmp r10, rsi
je 0x140092aa1
test byte [r10 + 0x1c], 2
je 0x140092aa1
cmp byte [r10 + 0x19], 4
jb 0x140092aa1
cmp r14d, dword [rbp - 0x69]
jge 0x140092bd9
mov edx, 0x95
jmp 0x1400925eb
cmp r14d, dword [rbp - 0x69]
jge 0x140092c47
mov rsi, qword [rbp - 0x71]
xor ecx, ecx
xor r11d, r11d
cmp dword [rbx + 8], ecx
jle 0x1400926dd
movsxd rbx, dword [rbx + 8]
mov r10, qword [rbp + 0x67]
mov r10, qword [r10]
cmp qword [rsi + r12*8], 0
je 0x140092be4
mov rax, qword [r10]
mov r9, qword [rsi + r12*8]
sub r9, rax
movzx r8d, word [rax]
movzx edx, word [rax + r9]
sub r8d, edx
jne 0x1400926ca
add rax, 2
test edx, edx
jne 0x1400926b4
test r8d, r8d
je 0x1400926e0
inc ecx
inc r11
add r10, 8
cmp r11, rbx
jl 0x14009269f
or ecx, 0xffffffff
cmp ecx, 0xffffffff
je 0x140092730
mov r10, qword [0x1400d0018]
lea rax, [0x1400d0018]
cmp r10, rax
je 0x140092a9a
test byte [r10 + 0x1c], 2
je 0x140092a9a
cmp byte [r10 + 0x19], 4
jb 0x140092a9a
mov edx, 0x96
mov r9, qword [rsi + r12*8]
lea r8, [0x1400ba8e8]
mov rcx, qword [r10 + 0x10]
call fcn.14000351c
jmp 0x140092a93
cmp qword [r15 + 0x10], 0
je 0x140092863
mov rax, qword [0x1400d2e50]
lea rcx, [0x1400d2e50]
mov rax, qword [rax + 0x18]
call qword [case.0x1400688bc.0]
add rax, 0x18
mov qword [rbp - 0x31], rax
cmp r14d, dword [rbp - 0x69]
jge 0x140092bfa
mov rax, qword [rbp - 0x71]
lea r9, [rbp - 0x31]
lea r8, str.NetworkInterface
mov rdx, qword [rax + r12*8]
mov rcx, r13
call fcn.1400916d4
mov rbx, qword [rbp - 0x31]
test eax, eax
jne 0x140092842
cmp dword [rbx - 0x10], eax
je 0x140092842
mov rax, qword [r15]
jmp 0x1400927c2
mov rcx, qword [rax + 0x10]
mov r9, rbx
sub r9, rcx
movzx r8d, word [rcx]
movzx edx, word [rcx + r9]
sub r8d, edx
jne 0x1400927ba
add rcx, 2
test edx, edx
jne 0x1400927a4
test r8d, r8d
je 0x1400927c7
mov rax, qword [rax]
test rax, rax
jne 0x14009279a
test rax, rax
jne 0x140092842
mov rcx, qword [0x1400d0018]
lea rsi, [0x1400d0018]
cmp rcx, rsi
je 0x140092818
test byte [rcx + 0x1c], 2
je 0x140092818
cmp byte [rcx + 0x19], 4
jb 0x140092818
cmp r14d, dword [rbp - 0x69]
jge 0x140092bef
mov rax, qword [rbp - 0x71]
mov edx, 0x97
mov qword [rsp + 0x20], rbx
mov r9, qword [rax + r12*8]
lea r8, [0x1400ba8e8]
mov rcx, qword [rcx + 0x10]
call fcn.14000aa4c
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140092603
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400688bc.0]
jmp 0x140092603
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140092863
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400688bc.0]
xor esi, esi
xor r15d, r15d
cmp dword [rbp - 0x49], esi
jle 0x140092a57
xor ebx, ebx
mov qword [rbp - 0x21], rbx
and qword [rbp - 0x19], rbx
and qword [rbp - 0x11], rbx
mov rax, qword [r13]
lea rdx, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0MAC_Access_Control
lea rcx, [0x14000a980]
cmp qword [rax + 0x58], rcx
lea rax, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0Server_Settings
cmovne rdx, rax
lea rcx, [rbp - 0x59]
call fcn.140004b44
nop
lea r8d, [rbx + 1]
lea rdx, [0x1400af210]
lea rcx, [rbp - 0x59]
call fcn.140004550
test r15, r15
js 0x140092c26
cmp esi, dword [rbp - 0x49]
jge 0x140092c26
mov rax, qword [rbp - 0x51]
mov rdx, qword [rax + r15*8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x59]
call fcn.140004550
and qword [rbp - 0x29], rbx
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, qword [rbp - 0x59]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140092920
mov rbx, qword [rbp - 0x29]
mov qword [rbp - 0x21], rbx
mov rcx, qword [0x1400d0018]
lea rax, [0x1400d0018]
cmp rcx, rax
je 0x140092957
test byte [rcx + 0x1c], 2
je 0x140092957
cmp byte [rcx + 0x19], 4
jb 0x140092957
mov edx, 0x98
mov r9d, edi
lea r8, [0x1400ba8e8]
mov rcx, qword [rcx + 0x10]
call fcn.1400035c4
test edi, edi
jne 0x140092a0e
and dword [rbp - 0x5d], edi
test r12, r12
js 0x140092c1b
cmp r14d, dword [rbp - 0x69]
jge 0x140092c1b
mov rax, qword [rbp - 0x71]
mov dword [rbp - 0x41], 4
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x5d]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x3d]
xor r8d, r8d
mov rdx, qword [rax + r12*8]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x1400929bf
mov eax, dword [rbp - 0x3d]
sub eax, 4
neg eax
sbb edi, edi
and edi, 0xd
mov rcx, qword [0x1400d0018]
lea rax, [0x1400d0018]
cmp rcx, rax
je 0x140092a04
test byte [rcx + 0x1c], 2
je 0x140092a04
cmp byte [rcx + 0x19], 4
jb 0x140092a04
mov edx, 0x99
mov r9d, edi
lea r8, [0x1400ba8e8]
mov rcx, qword [rcx + 0x10]
call fcn.1400035c4
mov rcx, qword [0x1400d0018]
lea rax, [0x1400d0018]
cmp dword [rbp - 0x5d], 0
jne 0x140092aba
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140092a34
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400688bc.0]
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140092a49
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
inc esi
inc r15
cmp esi, dword [rbp - 0x49]
jl 0x140092871
cmp r14d, dword [rbp - 0x69]
jge 0x140092c3c
mov rdx, qword [rbp - 0x71]
mov rdx, qword [rdx + r12*8]
mov rcx, r13
call fcn.140090458
cmp r14d, dword [rbp - 0x69]
jge 0x140092c31
movsxd rcx, r14d
mov rax, qword [rbp - 0x71]
lea rdx, [rax + rcx*8]
mov rcx, qword [rbp + 0x7f]
call fcn.140014ed8
mov r15, qword [rbp + 0x6f]
mov r10, qword [0x1400d0018]
lea rsi, [0x1400d0018]
inc r14d
inc r12
cmp r14d, dword [rbp - 0x69]
jge 0x140092b4d
mov rbx, qword [rbp + 0x67]
jmp 0x14009254d
cmp rcx, rax
je 0x140092b09
test byte [rcx + 0x1c], 2
je 0x140092b09
cmp byte [rcx + 0x19], 4
jb 0x140092b09
cmp esi, dword [rbp - 0x49]
jge 0x140092c10
mov rax, qword [rbp - 0x51]
mov r8, qword [rax + r15*8]
cmp r14d, dword [rbp - 0x69]
jge 0x140092c05
mov rax, qword [rbp - 0x71]
mov edx, 0x9a
mov qword [rsp + 0x20], r8
mov r9, qword [rax + r12*8]
lea r8, [0x1400ba8e8]
mov rcx, qword [rcx + 0x10]
call fcn.14000aa4c
nop
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140092b2f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400688bc.0]
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140092a8f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x140092a8f
cmp r10, rsi
je 0x140092b92
test byte [r10 + 0x1c], 1
je 0x140092b92
movzx edx, byte [r10 + 0x19]
mov eax, edi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x140092b92
mov rax, qword [rbp + 0x7f]
mov eax, dword [rax + 8]
mov edx, 0x9b
mov dword [rsp + 0x20], eax
mov r9d, edi
lea r8, [0x1400ba8e8]
mov rcx, qword [r10 + 0x10]
call fcn.1400054e0
nop
lea rcx, [rbp - 0x51]
call fcn.140014e50
nop
lea rcx, [rbp - 0x71]
call fcn.140014e50
mov eax, edi
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0x80004005
call fcn.140005068
nop
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
nop
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
nop
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3