Function at 0x1400283b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x3c8]
sub rsp, 0x4b0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14007c668]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov dword [0x14008a0f4], 0x34
xor r14d, r14d
mov dword [0x14008a134], 0x340036
mov word [0x14008a138], r14w
lea edx, [r14 + 0x52]
lea rcx, [0x14008ea28]
call fcn.14000a850
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140002940
nop
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov esi, r14d
mov ecx, 0x20000
call fcn.140009b20
mov rdi, rax
test rax, rax
je 0x14002845b
xor edx, edx
mov r8d, 0x20000
mov rcx, rax
call fcn.14003fc80
jmp 0x14002845e
mov rdi, r14
mov edx, 0x12
lea rcx, [0x140089818]
call fcn.14000a850
mov rcx, rax
call fcn.14000ff30
mov rbx, rax
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140087b98], rax
mov r15d, 1
test rax, rax
je 0x14002851b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x52534d42
call rax
mov ebx, eax
cmp eax, 0x16
jbe 0x1400284dd
mov r10, qword [0x140087b98]
mov r9d, eax
mov r8, rdi
xor edx, edx
mov ecx, 0x52534d42
call r10
cmp eax, 0x16
jbe 0x1400284dd
cmp eax, ebx
cmove esi, r15d
mov rax, qword [0x140087b98]
mov r9d, ebx
xor r8d, r8d
mov edx, 0x324d5054
mov ecx, 0x41435049
call rax
test eax, eax
je 0x140028517
mov edx, 0x53
lea rcx, [0x14008ea28]
call fcn.14000a850
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.14000a800
test esi, esi
jne 0x140028531
call fcn.14001f700
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.14001ff10
test eax, eax
je 0x14002853d
lea rcx, [rdi + 8]
mov edx, dword [rdi + 4]
call fcn.140017cb0
mov rcx, rdi
call fcn.14003e084
lea rcx, [rsp + 0x60]
call fcn.14000a790
nop
mov edx, 0x13
lea rcx, [0x140089818]
call fcn.14000a850
mov rcx, rax
call fcn.14000ff30
mov rbx, rax
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140087ba0], rax
call fcn.140017780
call fcn.14002baf0
test eax, eax
jne 0x1400285c1
xor r9d, r9d
xor r8d, r8d
lea rdx, str.00000000_0000_0000_0000_000000000000
lea rcx, [0x140055950]
call qword [0x140087ba0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e6
jmp 0x1400285c4
cmp eax, 2
jne 0x140028751
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x60]
call fcn.14003fc80
mov dword [rsp + 0x58], 0x100
mov edx, 0x200
lea rcx, [rbp - 0x60]
call fcn.1400157b0
mov rbx, qword [0x140087ba0]
test rbx, rbx
je 0x14002871f
mov edx, 0x4c
lea rcx, [0x140089728]
call fcn.14000a850
mov rcx, rax
call fcn.140009eb0
mov r9d, dword [rsp + 0x58]
lea r8, [rbp - 0x60]
lea rdx, str.8BE4DF61_93CA_11D2_AA0D_00E098032B8C
mov rcx, rax
call rbx
test eax, eax
jne 0x14002871f
mov qword [rsp + 0x38], r14
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x1a0]
call fcn.14003fc80
mov edx, 0x5e
lea rcx, [0x140089728]
call fcn.14000a850
mov rcx, rax
call fcn.140009eb0
mov qword [rsp + 0x20], rax
lea r9, [0x14008a8b4]
lea r8, [0x1400573a0]
mov edx, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.14000e3d0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x1a0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002871f
mov dword [rsp + 0x5c], r14d
mov dword [rsp + 0x58], 8
lea edx, [rax + 0x4a]
lea rcx, [0x140089728]
call fcn.14000a850
mov rcx, rax
call fcn.140009eb0
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x5c]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140028714
cmp dword [rsp + 0x5c], 1
jne 0x140028714
mov word [rbp - 0x60], r15w
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x14008ea28]
cmp word [rbp - 0x60], 0
je 0x14002874a
mov edx, 0x4a
call fcn.14000a850
mov rdx, rax
lea r8, [rbp - 0x80]
lea rcx, [rsp + 0x38]
call fcn.14000a2d0
jmp 0x140028766
mov edx, 0x4b
jmp 0x140028732
lea r8, [rbp - 0x80]
lea rdx, str.Legacy
lea rcx, [rsp + 0x38]
call fcn.1400159e0
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14000a7b0
lea rcx, [rsp + 0x38]
call fcn.140002990
lea rcx, [rsp + 0x60]
call fcn.140009eb0
mov rdx, rax
mov r8, 0xffffffffffffffff
lea rcx, [0x140089df4]
call fcn.140016820
nop
lea rcx, [rsp + 0x60]
call fcn.140002990
nop
lea rcx, [rbp - 0x80]
call fcn.140002990
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.14003e210
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret