Function at 0x140067cac
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov rax, qword [0x14017a608]
xor rax, rsp
mov qword [rbp + 0x180], rax
xor r14d, r14d
lea r8, str.AppID
mov edi, 0x20019
mov qword [rsp + 0x58], r14
mov r9d, edi
mov qword [rsp + 0x60], r14
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x68], r14
lea rcx, [rsp + 0x58]
call fcn.1400044cc
mov ebx, eax
test eax, eax
je 0x140067d3a
mov rcx, qword [rsp + 0x58]
mov dword [0x14017b60c], eax
test rcx, rcx
je 0x140067d33
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
jmp 0x140067e6d
mov rbx, qword [rsp + 0x58]
lea r8, [0x14015b3b0]
mov rdx, rbx
mov qword [rsp + 0x38], r14
mov r9d, edi
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x48], r14
call fcn.1400044cc
mov edi, eax
test eax, eax
je 0x140067da2
mov rcx, qword [rsp + 0x38]
mov dword [0x14017b60c], eax
test rcx, rcx
je 0x140067d87
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test rbx, rbx
je 0x140067d9b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, edi
jmp 0x140067e6d
mov rdi, qword [rsp + 0x38]
test rdi, rdi
jne 0x140067dc4
lea r8, str.m_hKey___0
mov edx, 0x1625
lea rcx, str.onecoreexternal_sdkinc_atlmfc_atlbase.h
call fcn.14008ac24
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.LocalService
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140067e28
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
ja 0x140067e28
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140067e9a
test al, 1
jne 0x140067e28
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], r14w
je 0x140067ea0
lea rcx, [0x14017b390]
mov dword [0x14017b61c], r14d
call fcn.140066c2c
mov esi, eax
mov dword [0x14017b60c], eax
test rdi, rdi
je 0x140067e57
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test rbx, rbx
je 0x140067e6b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, esi
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140001d90
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov word [rsp + 0x70], r14w
lea rax, [0x14017b3f8]
mov dword [0x14017b61c], 1
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x38]
lea rax, [0x140068840]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], r14
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
nop dword [rax + rax]
test eax, eax
jne 0x140067efa
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
mov dword [0x14017b60c], eax
jmp 0x140067e43
mov esi, dword [0x14017b60c]
jmp 0x140067e43
sub rsp, 0x28
cmp byte [0x14017b2c1], 0
mov qword [0x14017b2c8], rcx
je 0x1400689e9
lea r8, [0x140157b84]
mov edx, 0xecf
lea rcx, str.onecoreexternal_sdkinc_atlmfc_atlbase.h
call fcn.14008ac24
or eax, 0xffffffff
jmp 0x140068a18
and dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
mov rdx, rax
lea r8, [rsp + 0x30]
call fcn.140065ec4
cmp al, 1
jne 0x140068a14
add rsp, 0x28
jmp 0x140067cac
mov eax, dword [rsp + 0x30]
add rsp, 0x28
ret