Function at 0x140073b00
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x140173040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r14, r9
mov r15, r8
mov r13, rdx
mov r12, rcx
lea rcx, [rsp + 0x60]
call fcn.14003f460
lea rax, [r12 + 0x48]
mov qword [rsp + 0x50], rax
mov rbp, qword [rax]
mov r8, qword [rbp + 8]
mov rdi, rbp
xor esi, esi
mov rax, qword [rsp + 0x60]
cmp byte [r8 + 0x19], sil
jne 0x140073ba5
test rax, rax
je 0x140073e1f
mov rcx, qword [r8 + 0x20]
mov r9, rax
sub r9, rcx
movzx edx, word [rcx]
cmp dx, word [rcx + r9]
jne 0x140073b87
add rcx, 2
test dx, dx
jne 0x140073b70
mov ecx, esi
jmp 0x140073b8c
sbb ecx, ecx
or ecx, 1
shr ecx, 0x1f
test cl, cl
je 0x140073b99
mov r8, qword [r8 + 0x10]
jmp 0x140073b9f
mov rdi, r8
mov r8, qword [r8]
cmp byte [r8 + 0x19], sil
je 0x140073b66
cmp byte [rdi + 0x19], sil
jne 0x140073be3
mov r8, qword [rdi + 0x20]
test r8, r8
je 0x140073e1f
mov rcx, rax
sub r8, rax
nop
movzx edx, word [rcx]
cmp dx, word [rcx + r8]
jne 0x140073bd7
add rcx, 2
test dx, dx
jne 0x140073bc0
mov ecx, esi
jmp 0x140073bdc
sbb ecx, ecx
or ecx, 1
shr ecx, 0x1f
test cl, cl
je 0x140073be6
mov rdi, rbp
lea rdx, [rax - 0x18]
mov rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140073c06
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp rdi, rbp
jne 0x140073db1
xor bpl, bpl
mov dword [rsp + 0x7c], esi
mov rcx, r15
call fcn.1400056e0
mov eax, dword [r12 + 8]
or eax, 1
lea rcx, [rsp + 0x7c]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [r12 + 0x10]
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140073d8e
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x78], 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140073d32
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x140073d32
lea ecx, [rax + 1]
mov eax, 2
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.1400ff0c4
mov rdi, rax
mov r8d, dword [rsp + 0x68]
inc r8d
add r8, r8
xor edx, edx
mov rcx, rax
call fcn.14012ce40
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140073d25
mov bpl, 1
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rdi + r8*2], si
jne 0x140073d10
mov rdx, rdi
mov rcx, r15
call fcn.140005a90
mov edx, 2
mov rcx, rdi
call fcn.1400ff054
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bpl, bpl
je 0x140073d8e
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.14003f460
nop
lea rdx, [rsp + 0x58]
lea rdi, [r12 + 0x48]
mov rcx, rdi
call fcn.140074540
mov rcx, rax
mov rdx, r15
call fcn.14003f3d0
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140073db6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140073db6
test r14, r14
je 0x140073d9f
inc rbx
cmp word [r14 + rbx*2], si
jne 0x140073d93
mov esi, ebx
mov r8d, esi
mov rdx, r14
mov rcx, r15
call fcn.140005a90
xor al, al
jmp 0x140073dfb
mov rdi, qword [rsp + 0x50]
mov rdx, r13
lea rcx, [rsp + 0x50]
call fcn.14003f460
nop
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140074540
mov rdx, rax
mov rcx, r15
call fcn.14003f3d0
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140073df9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400ff350
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.140002b00
int3