Function at 0x14001d7bc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x100
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x140078790]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rsi, r9
mov r15, r8
mov r14, rdx
mov rdi, rcx
mov r8d, 0xa
lea rdx, str.CDPDBRegSet::ReadAnyField
lea rcx, [rsp + 0x80]
call fcn.14002de00
nop
xor ebx, ebx
and qword [rsp + 0x58], rbx
and dword [rsp + 0x60], ebx
and qword [rsp + 0x68], rbx
mov r9d, dword [rdi + 0x50]
or r9d, 0x20019
mov r8, r14
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x58]
call fcn.14000bad4
test eax, eax
je 0x14001d896
cmp eax, 2
jne 0x14001d86e
lea r8, str.key_not_found
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.140030824
mov ebx, 1
mov dword [rsp + 0x30], ebx
mov rdi, qword [rsp + 0x58]
jmp 0x14001da5d
test eax, 0x1fff0000
je 0x14001d883
cmp eax, 0x80000000
jb 0x14001d864
mov ecx, eax
call fcn.140032390
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
and dword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, r15
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d8dc
cmp dword [rsp + 0x34], 3
je 0x14001d8d6
mov eax, 0xd
jmp 0x14001d90c
xor eax, eax
test eax, eax
je 0x14001d940
cmp eax, 0xea
je 0x14001d940
cmp eax, 2
jne 0x14001d90c
lea r8, str.field_not_found
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.140030824
mov ebx, 1
mov dword [rsp + 0x30], ebx
jmp 0x14001da5d
test eax, 0x1fff0000
je 0x14001d925
cmp eax, 0x80000000
jb 0x14001da5d
mov ecx, eax
call fcn.140032390
test eax, eax
je 0x14001da5d
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
lea r14, vtable.CCryptBlob_struct__CRYPTOAPI_BLOB__class__heap_allocator_.0
mov qword [rsp + 0x40], r14
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x48], eax
mov ecx, eax
call fcn.1400331f0
test rax, rax
jne 0x14001d96a
mov ecx, 0x8007000e
call fcn.140032390
mov qword [rsp + 0x50], rax
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov rcx, rax
call fcn.140034b00
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, eax
test eax, eax
jne 0x14001d9bb
mov eax, dword [rsp + 0x34]
sub eax, 3
neg eax
sbb edx, edx
and edx, 0xd
test edx, 0x1fff0000
je 0x14001d9d2
cmp edx, 0x80000000
jb 0x14001d9e9
mov ecx, edx
call fcn.140032390
test edx, edx
je 0x14001d9e9
movzx ecx, dx
or ecx, 0x80070000
test edx, edx
cmovle ecx, edx
call fcn.140032390
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14001d9f7
call fcn.140009660
and qword [rsi + 0x10], 0
lea rcx, [rsi + 8]
and dword [rcx], 0
test rcx, rcx
je 0x14001da27
mov eax, dword [rsp + 0x48]
mov dword [rcx], eax
mov rax, qword [rsp + 0x50]
mov qword [rcx + 8], rax
xor edx, edx
lea r8d, [rdx + 0x10]
lea rcx, [rsp + 0x48]
call fcn.140034b00
lea r8, str.field_read_ok
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.140030824
nop
mov qword [rsp + 0x40], r14
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14001da52
call fcn.140009660
and qword [rsp + 0x50], 0
and dword [rsp + 0x48], 0
test rdi, rdi
je 0x14001da71
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x58], 0
and dword [rsp + 0x60], 0
jmp 0x14001da7c
lea rcx, [rsp + 0x80]
call fcn.14002e7a8
mov eax, ebx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140033cb0
add rsp, 0x100
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret