Function at 0x1400920ac
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xc0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r15, r8
mov rbx, rdx
mov r13, rcx
lea rsi, [0x1400cf018]
mov rcx, qword [0x1400cf018]
cmp rcx, rsi
je 0x14009211a
test byte [rcx + 0x1c], 1
je 0x14009211a
cmp byte [rcx + 0x19], 5
jb 0x14009211a
mov rax, qword [r8 + 0x10]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.14008fa6c
and qword [rbp - 0x71], 0
and dword [rbp - 0x69], 0
and dword [rbp - 0x65], 0
lea rdx, [rbp - 0x71]
mov rcx, r13
call fcn.14008fda0
mov edi, eax
mov r10, qword [0x1400cf018]
cmp r10, rsi
je 0x14009216e
test byte [r10 + 0x1c], 2
je 0x14009216e
cmp byte [r10 + 0x19], 4
jb 0x14009216e
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400b9968]
mov rcx, qword [r10 + 0x10]
call fcn.1400035c4
mov r10, qword [0x1400cf018]
and qword [rbp - 0x51], 0
and dword [rbp - 0x49], 0
and dword [rbp - 0x45], 0
lea rcx, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0Server_Settings
lea r8, [0x14000a980]
test edi, edi
jne 0x14009228d
xor ebx, ebx
mov qword [rbp - 9], rbx
and qword [rbp - 1], rbx
and qword [rbp + 7], rbx
and qword [rbp - 0x39], rbx
mov rax, qword [r13]
lea rdx, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0MAC_Access_Control
cmp qword [rax + 0x58], r8
cmovne rdx, rcx
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x1400921e9
mov rbx, qword [rbp - 0x39]
mov qword [rbp - 9], rbx
mov r10, qword [0x1400cf018]
cmp r10, rsi
je 0x140092222
test byte [r10 + 0x1c], 2
je 0x140092222
cmp byte [r10 + 0x19], 4
jb 0x140092222
mov edx, SysStringByteLen
mov r9d, edi
lea r8, [0x1400b9968]
mov rcx, qword [r10 + 0x10]
call fcn.1400035c4
mov r10, qword [0x1400cf018]
test edi, edi
jne 0x14009226e
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 9]
call fcn.14008b904
mov edi, eax
mov r10, qword [0x1400cf018]
cmp r10, rsi
je 0x14009226e
test byte [r10 + 0x1c], 2
je 0x14009226e
cmp byte [r10 + 0x19], 4
jb 0x14009226e
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400b9968]
mov rcx, qword [r10 + 0x10]
call fcn.1400035c4
mov r10, qword [0x1400cf018]
test rbx, rbx
je 0x140092289
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov r10, qword [0x1400cf018]
mov rbx, qword [rbp + 0x67]
xor r14d, r14d
cmp dword [rbp - 0x69], r14d
jle 0x14009289d
xor r12d, r12d
and dword [rbp + 0x77], 0
test r14d, r14d
js 0x140092913
cmp r14d, dword [rbp - 0x69]
jge 0x140092913
mov rax, qword [rbp - 0x71]
lea r8, [rbp + 0x77]
mov rdx, qword [rax + r12*8]
mov rcx, r13
call fcn.140090f9c
mov edi, eax
mov r10, qword [0x1400cf018]
cmp r10, rsi
je 0x140092303
test byte [r10 + 0x1c], 2
je 0x140092303
cmp byte [r10 + 0x19], 4
jb 0x140092303
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400b9968]
mov rcx, qword [r10 + 0x10]
call fcn.1400035c4
mov r10, qword [0x1400cf018]
test edi, edi
jne 0x14009235f
cmp dword [rbp + 0x77], 1
jne 0x14009235f
cmp r10, rsi
je 0x1400927f1
test byte [r10 + 0x1c], 2
je 0x1400927f1
cmp byte [r10 + 0x19], 4
jb 0x1400927f1
cmp r14d, dword [rbp - 0x69]
jge 0x14009291e
mov edx, reloc.OLEAUT32.dll_SysStringByteLen
mov rax, qword [rbp - 0x71]
mov r9, qword [rax + r12*8]
lea r8, [0x1400b9968]
mov rcx, qword [r10 + 0x10]
call fcn.14000351c
mov r10, qword [0x1400cf018]
jmp 0x1400927f1
and dword [rbp - 0x61], 0
cmp r14d, dword [rbp - 0x69]
jge 0x1400929a2
mov rax, qword [rbp - 0x71]
lea r9, [rbp - 0x61]
lea r8, str.DefaultAuthorization
mov rdx, qword [rax + r12*8]
mov rcx, r13
call fcn.140091240
test eax, eax
jne 0x1400923cc
cmp dword [rbp - 0x61], 1
jne 0x1400923cc
mov r10, qword [0x1400cf018]
cmp r10, rsi
je 0x1400927f1
test byte [r10 + 0x1c], 2
je 0x1400927f1
cmp byte [r10 + 0x19], 4
jb 0x1400927f1
cmp r14d, dword [rbp - 0x69]
jge 0x140092929
mov edx, 0x95
jmp 0x14009233b
cmp r14d, dword [rbp - 0x69]
jge 0x140092997
mov rsi, qword [rbp - 0x71]
xor ecx, ecx
xor r11d, r11d
cmp dword [rbx + 8], ecx
jle 0x14009242d
movsxd rbx, dword [rbx + 8]
mov r10, qword [rbp + 0x67]
mov r10, qword [r10]
cmp qword [rsi + r12*8], 0
je 0x140092934
mov rax, qword [r10]
mov r9, qword [rsi + r12*8]
sub r9, rax
movzx r8d, word [rax]
movzx edx, word [rax + r9]
sub r8d, edx
jne 0x14009241a
add rax, 2
test edx, edx
jne 0x140092404
test r8d, r8d
je 0x140092430
inc ecx
inc r11
add r10, 8
cmp r11, rbx
jl 0x1400923ef
or ecx, 0xffffffff
cmp ecx, 0xffffffff
je 0x140092480
mov r10, qword [0x1400cf018]
lea rax, [0x1400cf018]
cmp r10, rax
je 0x1400927ea
test byte [r10 + 0x1c], 2
je 0x1400927ea
cmp byte [r10 + 0x19], 4
jb 0x1400927ea
mov edx, 0x96
mov r9, qword [rsi + r12*8]
lea r8, [0x1400b9968]
mov rcx, qword [r10 + 0x10]
call fcn.14000351c
jmp 0x1400927e3
cmp qword [r15 + 0x10], 0
je 0x1400925b3
mov rax, qword [0x1400d1e50]
lea rcx, [0x1400d1e50]
mov rax, qword [rax + 0x18]
call qword [case.0x1400688bc.0]
add rax, 0x18
mov qword [rbp - 0x31], rax
cmp r14d, dword [rbp - 0x69]
jge 0x14009294a
mov rax, qword [rbp - 0x71]
lea r9, [rbp - 0x31]
lea r8, str.NetworkInterface
mov rdx, qword [rax + r12*8]
mov rcx, r13
call fcn.140091424
mov rbx, qword [rbp - 0x31]
test eax, eax
jne 0x140092592
cmp dword [rbx - 0x10], eax
je 0x140092592
mov rax, qword [r15]
jmp 0x140092512
mov rcx, qword [rax + 0x10]
mov r9, rbx
sub r9, rcx
movzx r8d, word [rcx]
movzx edx, word [rcx + r9]
sub r8d, edx
jne 0x14009250a
add rcx, 2
test edx, edx
jne 0x1400924f4
test r8d, r8d
je 0x140092517
mov rax, qword [rax]
test rax, rax
jne 0x1400924ea
test rax, rax
jne 0x140092592
mov rcx, qword [0x1400cf018]
lea rsi, [0x1400cf018]
cmp rcx, rsi
je 0x140092568
test byte [rcx + 0x1c], 2
je 0x140092568
cmp byte [rcx + 0x19], 4
jb 0x140092568
cmp r14d, dword [rbp - 0x69]
jge 0x14009293f
mov rax, qword [rbp - 0x71]
mov edx, 0x97
mov qword [rsp + 0x20], rbx
mov r9, qword [rax + r12*8]
lea r8, [0x1400b9968]
mov rcx, qword [rcx + 0x10]
call fcn.14000aa4c
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140092353
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400688bc.0]
jmp 0x140092353
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400925b3
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400688bc.0]
xor esi, esi
xor r15d, r15d
cmp dword [rbp - 0x49], esi
jle 0x1400927a7
xor ebx, ebx
mov qword [rbp - 0x21], rbx
and qword [rbp - 0x19], rbx
and qword [rbp - 0x11], rbx
mov rax, qword [r13]
lea rdx, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0MAC_Access_Control
lea rcx, [0x14000a980]
cmp qword [rax + 0x58], rcx
lea rax, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0Server_Settings
cmovne rdx, rax
lea rcx, [rbp - 0x59]
call fcn.140004b44
nop
lea r8d, [rbx + 1]
lea rdx, [0x1400ae210]
lea rcx, [rbp - 0x59]
call fcn.140004550
test r15, r15
js 0x140092976
cmp esi, dword [rbp - 0x49]
jge 0x140092976
mov rax, qword [rbp - 0x51]
mov rdx, qword [rax + r15*8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x59]
call fcn.140004550
and qword [rbp - 0x29], rbx
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, qword [rbp - 0x59]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140092670
mov rbx, qword [rbp - 0x29]
mov qword [rbp - 0x21], rbx
mov rcx, qword [0x1400cf018]
lea rax, [0x1400cf018]
cmp rcx, rax
je 0x1400926a7
test byte [rcx + 0x1c], 2
je 0x1400926a7
cmp byte [rcx + 0x19], 4
jb 0x1400926a7
mov edx, 0x98
mov r9d, edi
lea r8, [0x1400b9968]
mov rcx, qword [rcx + 0x10]
call fcn.1400035c4
test edi, edi
jne 0x14009275e
and dword [rbp - 0x5d], edi
test r12, r12
js 0x14009296b
cmp r14d, dword [rbp - 0x69]
jge 0x14009296b
mov rax, qword [rbp - 0x71]
mov dword [rbp - 0x41], 4
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x5d]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x3d]
xor r8d, r8d
mov rdx, qword [rax + r12*8]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14009270f
mov eax, dword [rbp - 0x3d]
sub eax, 4
neg eax
sbb edi, edi
and edi, 0xd
mov rcx, qword [0x1400cf018]
lea rax, [0x1400cf018]
cmp rcx, rax
je 0x140092754
test byte [rcx + 0x1c], 2
je 0x140092754
cmp byte [rcx + 0x19], 4
jb 0x140092754
mov edx, 0x99
mov r9d, edi
lea r8, [0x1400b9968]
mov rcx, qword [rcx + 0x10]
call fcn.1400035c4
mov rcx, qword [0x1400cf018]
lea rax, [0x1400cf018]
cmp dword [rbp - 0x5d], 0
jne 0x14009280a
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140092784
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400688bc.0]
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140092799
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
inc esi
inc r15
cmp esi, dword [rbp - 0x49]
jl 0x1400925c1
cmp r14d, dword [rbp - 0x69]
jge 0x14009298c
mov rdx, qword [rbp - 0x71]
mov rdx, qword [rdx + r12*8]
mov rcx, r13
call fcn.1400901a8
cmp r14d, dword [rbp - 0x69]
jge 0x140092981
movsxd rcx, r14d
mov rax, qword [rbp - 0x71]
lea rdx, [rax + rcx*8]
mov rcx, qword [rbp + 0x7f]
call fcn.140014ed8
mov r15, qword [rbp + 0x6f]
mov r10, qword [0x1400cf018]
lea rsi, [0x1400cf018]
inc r14d
inc r12
cmp r14d, dword [rbp - 0x69]
jge 0x14009289d
mov rbx, qword [rbp + 0x67]
jmp 0x14009229d
cmp rcx, rax
je 0x140092859
test byte [rcx + 0x1c], 2
je 0x140092859
cmp byte [rcx + 0x19], 4
jb 0x140092859
cmp esi, dword [rbp - 0x49]
jge 0x140092960
mov rax, qword [rbp - 0x51]
mov r8, qword [rax + r15*8]
cmp r14d, dword [rbp - 0x69]
jge 0x140092955
mov rax, qword [rbp - 0x71]
mov edx, 0x9a
mov qword [rsp + 0x20], r8
mov r9, qword [rax + r12*8]
lea r8, [0x1400b9968]
mov rcx, qword [rcx + 0x10]
call fcn.14000aa4c
nop
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14009287f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400688bc.0]
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x1400927df
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x1400927df
cmp r10, rsi
je 0x1400928e2
test byte [r10 + 0x1c], 1
je 0x1400928e2
movzx edx, byte [r10 + 0x19]
mov eax, edi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x1400928e2
mov rax, qword [rbp + 0x7f]
mov eax, dword [rax + 8]
mov edx, 0x9b
mov dword [rsp + 0x20], eax
mov r9d, edi
lea r8, [0x1400b9968]
mov rcx, qword [r10 + 0x10]
call fcn.1400054e0
nop
lea rcx, [rbp - 0x51]
call fcn.140014e50
nop
lea rcx, [rbp - 0x71]
call fcn.140014e50
mov eax, edi
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0x80004005
call fcn.140005068
nop
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
nop
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
nop
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3