Function at 0x140028230
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x3c8]
sub rsp, 0x4b0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14007c668]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov dword [0x14008a0f4], 0x34
xor r14d, r14d
mov dword [0x14008a134], 0x340036
mov word [0x14008a138], r14w
lea edx, [r14 + 0x52]
lea rcx, [0x14008ea20]
call fcn.14000a780
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140002940
nop
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov esi, r14d
mov ecx, 0x20000
call fcn.140009a50
mov rdi, rax
test rax, rax
je 0x1400282db
xor edx, edx
mov r8d, 0x20000
mov rcx, rax
call fcn.14003fab0
jmp 0x1400282de
mov rdi, r14
mov edx, 0x12
lea rcx, [0x140089778]
call fcn.14000a780
mov rcx, rax
call fcn.14000fe30
mov rbx, rax
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140087b98], rax
mov r15d, 1
test rax, rax
je 0x14002839b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x52534d42
call rax
mov ebx, eax
cmp eax, 0x16
jbe 0x14002835d
mov r10, qword [0x140087b98]
mov r9d, eax
mov r8, rdi
xor edx, edx
mov ecx, 0x52534d42
call r10
cmp eax, 0x16
jbe 0x14002835d
cmp eax, ebx
cmove esi, r15d
mov rax, qword [0x140087b98]
mov r9d, ebx
xor r8d, r8d
mov edx, 0x324d5054
mov ecx, 0x41435049
call rax
test eax, eax
je 0x140028397
mov edx, 0x53
lea rcx, [0x14008ea20]
call fcn.14000a780
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.14000a730
test esi, esi
jne 0x1400283b1
call fcn.14001f580
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.14001fd90
test eax, eax
je 0x1400283bd
lea rcx, [rdi + 8]
mov edx, dword [rdi + 4]
call fcn.140017af0
mov rcx, rdi
call fcn.14003deb4
lea rcx, [rsp + 0x60]
call fcn.14000a6c0
nop
mov edx, 0x13
lea rcx, [0x140089778]
call fcn.14000a780
mov rcx, rax
call fcn.14000fe30
mov rbx, rax
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140087ba0], rax
call fcn.1400175c0
call fcn.14002b950
test eax, eax
jne 0x140028441
xor r9d, r9d
xor r8d, r8d
lea rdx, str.00000000_0000_0000_0000_000000000000
lea rcx, [0x140055950]
call qword [0x140087ba0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e6
jmp 0x140028444
cmp eax, 2
jne 0x1400285d1
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x60]
call fcn.14003fab0
mov dword [rsp + 0x58], 0x100
mov edx, 0x200
lea rcx, [rbp - 0x60]
call fcn.1400156b0
mov rbx, qword [0x140087ba0]
test rbx, rbx
je 0x14002859f
mov edx, 0x4c
lea rcx, [0x140089720]
call fcn.14000a780
mov rcx, rax
call fcn.140009de0
mov r9d, dword [rsp + 0x58]
lea r8, [rbp - 0x60]
lea rdx, str.8BE4DF61_93CA_11D2_AA0D_00E098032B8C
mov rcx, rax
call rbx
test eax, eax
jne 0x14002859f
mov qword [rsp + 0x38], r14
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x1a0]
call fcn.14003fab0
mov edx, 0x5e
lea rcx, [0x140089720]
call fcn.14000a780
mov rcx, rax
call fcn.140009de0
mov qword [rsp + 0x20], rax
lea r9, [0x14008a8b4]
lea r8, [0x1400573a0]
mov edx, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.14000e2d0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x1a0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002859f
mov dword [rsp + 0x5c], r14d
mov dword [rsp + 0x58], 8
lea edx, [rax + 0x4a]
lea rcx, [0x140089720]
call fcn.14000a780
mov rcx, rax
call fcn.140009de0
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x5c]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140028594
cmp dword [rsp + 0x5c], 1
jne 0x140028594
mov word [rbp - 0x60], r15w
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x14008ea20]
cmp word [rbp - 0x60], 0
je 0x1400285ca
mov edx, 0x4a
call fcn.14000a780
mov rdx, rax
lea r8, [rbp - 0x80]
lea rcx, [rsp + 0x38]
call fcn.14000a200
jmp 0x1400285e6
mov edx, 0x4b
jmp 0x1400285b2
lea r8, [rbp - 0x80]
lea rdx, str.Legacy
lea rcx, [rsp + 0x38]
call fcn.1400158e0
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14000a6e0
lea rcx, [rsp + 0x38]
call fcn.140002990
lea rcx, [rsp + 0x60]
call fcn.140009de0
mov rdx, rax
mov r8, 0xffffffffffffffff
lea rcx, [0x140089df4]
call fcn.140016720
nop
lea rcx, [rsp + 0x60]
call fcn.140002990
nop
lea rcx, [rbp - 0x80]
call fcn.140002990
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.14003e040
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret