Function at 0x140013950
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14005b0e8]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov r14, r8
mov r15, rdx
mov dword [rbp - 0x10], ebx
lea rdx, str.Drive
lea r8d, [rbx + 4]
call fcn.1400117b0
mov rcx, r14
mov rsi, rax
call fcn.140004890
lea r9, str._s:_
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Local_Name
mov rcx, rsi
call fcn.140011be0
lea rax, [rbp - 0x18]
mov qword [rbp - 0x18], rbx
lea r9d, [rbx + 1]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x20], ebx
mov rdx, r14
mov rcx, r15
mov edi, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140013a76
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.RemotePath
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140013a76
mov eax, dword [rbp - 0x20]
test eax, eax
je 0x140013a76
mov ecx, eax
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140013a76
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.RemotePath
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140013a76
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.140004890
mov r8, rax
lea rdx, str.Remote_Name
xor r9d, r9d
mov rcx, rsi
call fcn.1400118b0
jmp 0x140013a8a
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140013a85
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rdi, rdi
je 0x140013a93
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
lea rax, [rbp - 0x18]
mov qword [rbp - 0x18], rbx
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x20], ebx
mov rdx, r14
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140013b54
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.ProviderName
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140013b54
mov eax, dword [rbp - 0x20]
test eax, eax
je 0x140013b54
mov ecx, eax
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140013b54
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.ProviderName
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140013b54
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.140004890
mov r8, rax
lea rdx, str.Provider
xor r9d, r9d
mov rcx, rsi
call fcn.1400118b0
jmp 0x140013b68
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140013b63
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x140013b71
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140029990
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret