Function at 0x14001ed70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov rdi, rcx
call fcn.14002d140
mov rcx, rax
xor edx, edx
test rax, rax
setne dl
test edx, edx
jne 0x14001edaf
mov ecx, 0x80004005
call fcn.140001910
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x40], rbx
mov ecx, 0x92
call fcn.14003e9c8
test rax, rax
je 0x14001ede2
mov r8d, 0x92
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140005050
mov rbx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.1401affac
mov r14d, eax
cmp eax, 1
sete cl
mov byte [rdi + 0x386], cl
mov ecx, 0x93
call fcn.14003e9c8
test rax, rax
je 0x14001ee1e
mov r8d, 0x93
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140005050
mov rbx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.1401affac
mov r15d, eax
cmp eax, 1
sete cl
mov byte [rdi + 0x387], cl
mov ecx, 0x94
call fcn.14003e9c8
test rax, rax
je 0x14001ee5a
mov r8d, 0x94
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140005050
mov rbx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.1401affac
mov r12d, eax
cmp eax, 1
sete cl
mov byte [rdi + 0x388], cl
mov ecx, 0x86
call fcn.14003e9c8
test rax, rax
je 0x14001ee96
mov r8d, 0x86
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140005050
mov rbx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.1401affac
mov dword [rdi + 0x38c], eax
mov eax, dword [rdi + 0x298]
cmp eax, 0x3e8
jle 0x14001eeb7
mov dword [rdi + 0x38c], eax
mov rcx, qword [rdi + 0x2b8]
sub rcx, 0x18
call fcn.140001860
lea rbx, [rax + 0x18]
mov qword [rbp - 8], rbx
cmp dword [rbx - 0x10], 0
je 0x14001f0a3
mov rdx, rbx
mov rcx, 0xffffffff80000002
call fcn.140024a40
mov rsi, rax
test rax, rax
je 0x14001ef3d
mov dword [rbp + 0x48], 4
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x24]
mov qword [rsp + 0x20], rax
mov r9d, 0xffff
lea r8, str.EnableRequiredSend
xor edx, edx
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x14001ef34
mov r14d, dword [rbp + 0x50]
jmp 0x14001ef3d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp r14d, 1
sete al
mov byte [rdi + 0x386], al
mov rdx, rbx
mov rcx, 0xffffffff80000002
call fcn.140024a40
mov rsi, rax
test rax, rax
je 0x14001efae
mov dword [rbp + 0x58], 4
lea rax, [rbp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0xffff
lea r8, str.EnableSendPCName
xor edx, edx
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x14001efa5
mov r15d, dword [rbp - 0x28]
jmp 0x14001efae
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp r15d, 1
sete al
mov byte [rdi + 0x387], al
mov rdx, rbx
mov rcx, 0xffffffff80000002
call fcn.140024a40
mov rsi, rax
test rax, rax
je 0x14001f01f
mov dword [rbp - 0x2c], 4
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x20], rax
mov r9d, 0xffff
lea r8, str.EnableRoundTrip
xor edx, edx
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x14001f016
mov r12d, dword [rbp - 0x38]
jmp 0x14001f01f
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp r12d, 1
sete al
mov byte [rdi + 0x388], al
mov esi, dword [rdi + 0x38c]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call fcn.140024a40
mov r14, rax
test rax, rax
je 0x14001f095
mov dword [rbp - 0x34], 4
lea rax, [rbp - 0x34]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 0xffff
lea r8, str.WaitDuration
xor edx, edx
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x14001f08c
mov esi, dword [rbp - 0x30]
jmp 0x14001f095
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x3e8
jle 0x14001f0a3
mov dword [rdi + 0x38c], esi
movzx eax, byte [rdi + 0x2a5]
test al, al
je 0x14001f0b4
mov byte [rdi + 0x386], al
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001f0c9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001f0e1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret