Function at 0x140095570
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x14011d8d0]
xor rax, rsp
mov qword [rbp + 0x180], rax
xor r13d, r13d
mov rbx, rcx
mov r12d, edx
lea rcx, [rsp + 0x58]
lea r8, str.AppID
mov r9d, 0x20019
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x60], r13d
mov qword [rsp + 0x68], r13
call fcn.140008440
mov edi, eax
test eax, eax
je 0x1400955f8
mov rcx, qword [rsp + 0x58]
mov dword [rbx + 0x27c], eax
test rcx, rcx
je 0x1400955f1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x140095791
mov rdi, qword [rsp + 0x58]
lea r8, str.9E6E16CC_84B2_4E7F_A839_26BD17D6E906
lea rcx, [rsp + 0x38]
mov r9d, 0x20019
mov rdx, rdi
mov qword [rsp + 0x2b8], rsi
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x48], r13
call fcn.140008440
mov esi, eax
test eax, eax
je 0x14009565f
mov rcx, qword [rsp + 0x38]
mov dword [rbx + 0x27c], eax
test rcx, rcx
je 0x14009564a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rdi, rdi
je 0x140095658
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x140095789
mov rsi, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea rdx, str.LocalService
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
test eax, eax
jne 0x1400956dd
mov eax, dword [rsp + 0x34]
cmp eax, 1
je 0x1400956b5
cmp eax, 2
je 0x1400956b5
mov r11d, Ordinal_17
jmp 0x1400956dd
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400956d4
test al, 1
jne 0x1400956cc
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], r13w
je 0x1400956da
mov r11d, Ordinal_17
jmp 0x1400956dd
mov word [rsp + 0x70], r13w
mov r11d, r13d
test r11d, r11d
mov eax, r13d
mov ecx, 1
cmove eax, ecx
mov dword [rbx + 0x28c], eax
cmp eax, r13d
je 0x140095756
lea rax, [rbx + 0x68]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x38], rax
lea rax, [0x140095450]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x40], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x140095730
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x27c], eax
mov ebx, dword [rbx + 0x27c]
test rsi, rsi
je 0x140095744
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rdi, rdi
je 0x140095752
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140095789
mov edx, r12d
mov rcx, rbx
call fcn.140094b40
mov r12d, eax
mov dword [rbx + 0x27c], eax
test rsi, rsi
je 0x140095778
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rdi, rdi
je 0x140095786
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r12d
mov rsi, qword [rsp + 0x2b8]
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1400cafa0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rbp
ret
push rbx
sub rsp, 0x30
cmp byte [0x14011df08], 0
mov ebx, r9d
je 0x140097b0b
or eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x20]
lea rcx, [0x14011df40]
mov rdx, rax
call fcn.140097720
cmp al, 1
jne 0x140097b44
lea rcx, [0x14011df40]
mov edx, ebx
add rsp, 0x30
pop rbx
jmp 0x140095570
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rbx
ret