Function at 0x140001120
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x780
mov rax, qword [0x140013240]
xor rax, rsp
mov qword [rsp + 0x770], rax
test rdx, rdx
mov rbx, rdx
mov rdi, rcx
je 0x14000180f
cmp byte [rdx], 0
je 0x14000180f
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
movsxd rcx, eax
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov qword [rdi + 0x110], rax
jne 0x140001181
mov eax, 5
jmp 0x1400014d2
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x7a0], rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, qword [rdi + 0x118]
xor esi, esi
test rcx, rcx
je 0x1400011af
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rdi + 0x118], rsi
mov rbx, qword [section..data]
mov dword [rsp + 0x30], 0x200
test rbx, rbx
je 0x1400012a4
cmp byte [rbx], sil
je 0x1400012a4
mov r9, qword [str.Protid_0]
lea r8, str.SoftwareOracleOracleMTSRecoveryService_
lea rdx, str._s_s
lea rcx, [rsp + 0x370]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r11, [rsp + 0x38]
lea rdx, [rsp + 0x370]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400012a4
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400012a4
movsxd rbx, dword [rsp + 0x30]
test ebx, ebx
jle 0x1400012a4
cmp byte [rsp + 0x50], sil
je 0x1400012a4
lea eax, [rbx + 1]
movsxd rcx, eax
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov qword [rdi + 0x118], rax
je 0x1400014a7
lea rdx, [rsp + 0x50]
mov r8, rbx
mov rcx, rax
call sub.MSVCR80.dll_memcpy
mov r11, qword [rdi + 0x118]
mov byte [rbx + r11], sil
mov rcx, qword [rdi + 0x128]
test rcx, rcx
je 0x1400012bc
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rdi + 0x128], rsi
mov rbx, qword [str.Name]
mov dword [rsp + 0x30], 0x200
test rbx, rbx
je 0x1400013b1
cmp byte [rbx], sil
je 0x1400013b1
mov r9, qword [str.Protid_0]
lea r8, str.SoftwareOracleOracleMTSRecoveryService_
lea rdx, str._s_s
lea rcx, [rsp + 0x370]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r11, [rsp + 0x38]
lea rdx, [rsp + 0x370]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400013b1
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400013b1
movsxd rbx, dword [rsp + 0x30]
test ebx, ebx
jle 0x1400013b1
cmp byte [rsp + 0x50], sil
je 0x1400013b1
lea eax, [rbx + 1]
movsxd rcx, eax
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov qword [rdi + 0x128], rax
je 0x1400014a7
lea rdx, [rsp + 0x50]
mov r8, rbx
mov rcx, rax
call sub.MSVCR80.dll_memcpy
mov r11, qword [rdi + 0x128]
mov byte [rbx + r11], sil
mov rcx, qword [rdi + 0x120]
test rcx, rcx
je 0x1400013c9
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rdi + 0x120], rsi
mov rbx, qword [str.Port]
mov dword [rsp + 0x30], 0x200
test rbx, rbx
je 0x14000150e
cmp byte [rbx], sil
je 0x14000150e
mov r9, qword [str.Protid_0]
lea r8, str.SoftwareOracleOracleMTSRecoveryService_
lea rdx, str._s_s
lea rcx, [rsp + 0x370]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r11, [rsp + 0x38]
lea rdx, [rsp + 0x370]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000150e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14000150e
movsxd rbx, dword [rsp + 0x30]
test ebx, ebx
jle 0x14000150e
cmp byte [rsp + 0x50], sil
je 0x14000150e
lea eax, [rbx + 1]
movsxd rcx, eax
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov qword [rdi + 0x120], rax
jne 0x1400014f3
mov rcx, qword [0x140013298]
test rcx, rcx
je 0x1400014c5
xor r9d, r9d
mov r8w, 1
mov edx, 0xc0000004
call fcn.140003280
mov eax, 5
mov rsi, qword [rsp + 0x7a0]
mov rcx, qword [rsp + 0x770]
xor rcx, rsp
call fcn.14000be00
mov rbx, qword [rsp + 0x7a8]
add rsp, 0x780
pop rdi
ret
lea rdx, [rsp + 0x50]
mov r8, rbx
mov rcx, rax
call sub.MSVCR80.dll_memcpy
mov r11, qword [rdi + 0x120]
mov byte [rbx + r11], sil
mov rbx, qword [str.OMTSRECO_TRACEFILE]
mov dword [rsp + 0x30], 0x200
test rbx, rbx
je 0x140001638
cmp byte [rbx], sil
je 0x140001638
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareOracleOracleMTSRecoveryService_
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001638
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140001638
movsxd rax, dword [rsp + 0x30]
test eax, eax
jle 0x140001638
cmp byte [rsp + 0x50], sil
je 0x140001638
mov byte [rsp + rax + 0x50], sil
cmp byte [rsp + 0x51], 0x3a
mov rbx, rax
je 0x140001622
lea rcx, [rsp + 0x50]
mov edx, 0x5c
call qword [sym.imp.MSVCR80.dll_strchr]
test rax, rax
jne 0x140001622
lea rdx, [rsp + 0x260]
mov r8d, 0x104
mov rcx, rdi
call fcn.140001030
test eax, eax
jne 0x140001612
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x260]
lea rdx, str._s_trace_s
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x14000168e
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x14000168e
lea rdx, [rsp + 0x50]
mov r8, rbx
mov rcx, rdi
call sub.MSVCR80.dll_memcpy
mov byte [rbx + rdi], sil
jmp 0x14000168e
lea rdx, [rsp + 0x260]
mov r8d, 0x104
mov rcx, rdi
call fcn.140001030
test eax, eax
jne 0x140001675
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, [rsp + 0x260]
lea rdx, str._s_traceOracleMTSRecoveryService__ld_.trc
mov r9d, eax
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x14000168e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.OracleMTSRecoveryService__ld_.trc
mov rcx, rdi
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
mov dword [rdi + 0x104], 0xa
mov rbx, qword [str.OMTSRECO_TRACELEVEL]
mov dword [rsp + 0x30], 0x200
test rbx, rbx
je 0x140001808
cmp byte [rbx], sil
je 0x140001808
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareOracleOracleMTSRecoveryService_
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001808
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140001808
cmp dword [rsp + 0x30], esi
jle 0x140001808
cmp byte [rsp + 0x50], sil
je 0x140001808
lea r8d, [rbx + 6]
lea rdx, str.LEVEL1
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCR80.dll_strncmp]
test eax, eax
jne 0x140001765
mov dword [rdi + 0x104], 0xa
jmp 0x1400014ca
lea rdx, str.LEVEL2
lea rcx, [rsp + 0x50]
mov r8d, 6
call qword [sym.imp.MSVCR80.dll_strncmp]
test eax, eax
jne 0x140001790
mov dword [rdi + 0x104], reloc.WS2_32.dll_inet_addr
jmp 0x1400014ca
lea rdx, str.LEVEL3
lea rcx, [rsp + 0x50]
mov r8d, 6
call qword [sym.imp.MSVCR80.dll_strncmp]
test eax, eax
jne 0x1400017bb
mov dword [rdi + 0x104], reloc.WS2_32.dll_inet_ntoa
jmp 0x1400014ca
lea rdx, str.LEVEL4
lea rcx, [rsp + 0x50]
mov r8d, 6
call qword [sym.imp.MSVCR80.dll_strncmp]
test eax, eax
jne 0x1400017e6
mov dword [rdi + 0x104], reloc.WS2_32.dll_listen
jmp 0x1400014ca
lea rdx, str.NOTRACE
lea rcx, [rsp + 0x50]
mov r8d, 7
call qword [sym.imp.MSVCR80.dll_strncmp]
test eax, eax
jne 0x140001808
mov dword [rdi + 0x104], esi
xor eax, eax
jmp 0x1400014ca
mov eax, 0xa
jmp 0x1400014d2