Function at 0x1014f10
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov qword [rsp + 0x188], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
movzx r12d, r9b
mov r13, r8
mov rbp, rdx
mov rsi, rcx
lea rax, [r11 - 0xc0]
mov qword [r11 - 0x48], rax
lea r15, [0x01002f50]
mov qword [r11 - 0xc0], r15
lea rbx, [0x01002f40]
mov qword [r11 - 0xb8], rbx
mov dword [rsp + 0x118], 0x202
mov dword [rsp + 0x11c], 0x4000
xor r14d, r14d
mov dword [r11 - 0xa8], r14d
mov word [r11 - 0x50], r14w
mov byte [r11 - 0x4e], r14b
mov byte [r11 - 0x4d], 1
mov qword [r11 - 0xa0], r14
mov qword [r11 - 0x98], r14
mov qword [r11 - 0x90], r14
mov qword [r11 - 0x88], r14
mov qword [r11 - 0x80], r14
mov qword [r11 - 0x78], r14
mov qword [r11 - 0x70], r14
mov qword [r11 - 0x68], r14
mov qword [r11 - 0x60], r14
mov qword [r11 - 0x58], r14
lea rax, [r11 - 0xc0]
mov qword [r11 - 0xd0], rax
mov dword [r11 - 0x100], r14d
lea rcx, [0x010032a0]
mov qword [r11 - 0xf8], rcx
mov rax, qword [r11 - 0xb8]
mov qword [r11 - 0xf0], rax
mov r8d, dword [r11 - 0xb0]
mov dword [r11 - 0xe8], r8d
mov eax, dword [rsp + 0x11c]
mov dword [rsp + 0xe4], eax
mov r9d, dword [r11 - 0xa8]
mov dword [r11 - 0xe0], r9d
cmp dword [0x010217a0], r14d
je 0x1015083
cmp dword [0x010217c0], r14d
je 0x1015083
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov rdx, qword [r11 - 0xc0]
lea rcx, [0x010217a0]
call fcn.0100d730
lea rdx, [0x01004cd8]
lea rcx, [0x010217a0]
call fcn.0100d4b0
mov edx, dword [rsp + 0xe8]
lea rcx, [0x010217a0]
call fcn.0100d990
nop
cmp byte [rsp + 0x17b], 0
je 0x10150c2
lea rbx, [rsp + 0x128]
mov edi, 0xa
nop
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x10150b1
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbx], r14
add rbx, 8
sub rdi, 1
jne 0x10150a0
lea rbx, [0x01002f40]
mov dword [r13], r14d
mov dword [rsp + 0x1d0], r14d
mov dword [rsp + 0x1e0], r14d
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x1d0]
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsi + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r8d, eax
cmp eax, 2
jne 0x101539b
test r12b, r12b
je 0x1015296
lea rax, [rsp + 0x50]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], 0x218
mov dword [rsp + 0x64], 0x4000
mov dword [rsp + 0x68], r14d
mov word [rsp + 0xc0], 0
mov byte [rsp + 0xc2], 0
mov byte [rsp + 0xc3], 1
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], r14
mov eax, dword [rsp + 0x1e0]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x1d0]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rbp
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x20], rax
mov r9, qword [rsi + 8]
lea r8, [0x01003170]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xc8]
call fcn.0100ecb0
lea r11, [rsp + 0x50]
mov qword [rsp + 0xf8], r11
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], 0x21b
mov dword [rsp + 0x64], 0x4000
mov dword [rsp + 0x68], r14d
mov word [rsp + 0xc0], 0
mov byte [rsp + 0xc2], 0
mov byte [rsp + 0xc3], 1
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], r14
lea r9, [0x01003140]
mov r8d, 0x80070057
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xc8]
call fcn.01007184
int3
cmp dword [0x010217a0], 0
je 0x1015319
cmp dword [0x010217c0], 0
je 0x1015319
mov dword [rsp + 0x30], r14d
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xe8]
xor r8d, r8d
lea rdx, [0x01004cd8]
lea rcx, [0x010217a0]
call fcn.0100d730
lea r9, [0x01002f20]
mov r8, qword [rsp + 0xd0]
lea rdx, [0x01002ef0]
lea rcx, [0x010217a0]
call fcn.0100d240
mov edx, dword [rsp + 0xe8]
lea rcx, [0x010217a0]
call fcn.0100d990
nop
cmp dword [0x010217a0], 0
je 0x1015394
cmp dword [0x010217c0], 0
je 0x1015394
mov dword [rsp + 0x30], r14d
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xe8]
xor r8d, r8d
lea rdx, [0x01004cd8]
lea rcx, [0x010217a0]
call fcn.0100d730
mov r8d, dword [rsp + 0xc8]
lea rdx, [0x010047f0]
lea rcx, [0x010217a0]
call fcn.0100d4b0
mov edx, dword [rsp + 0xe8]
lea rcx, [0x010217a0]
call fcn.0100d990
xor al, al
jmp 0x10157c0
test eax, eax
je 0x1015494
cmp eax, 0xea
je 0x1015494
lea rax, [rsp + 0x50]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], 0x221
mov dword [rsp + 0x64], 0x4000
mov dword [rsp + 0x68], r14d
mov word [rsp + 0xc0], 0
mov byte [rsp + 0xc2], 0
mov byte [rsp + 0xc3], 1
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], r14
test r8d, r8d
jle 0x101544e
movzx r8d, r8w
or r8d, 0x80070000
mov eax, dword [rsp + 0x1e0]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x1d0]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbp
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsi + 8]
mov qword [rsp + 0x20], rax
lea r9, [0x010030e0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xc8]
call fcn.0100e930
cmp dword [rsp + 0x1d0], 4
je 0x1015574
lea rax, [rsp + 0x50]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], 0x227
mov dword [rsp + 0x64], 0x4000
mov dword [rsp + 0x68], r14d
mov word [rsp + 0xc0], 0
mov byte [rsp + 0xc2], 0
mov byte [rsp + 0xc3], 1
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0x38], rbp
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x30], rax
mov rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x1d0]
mov dword [rsp + 0x20], eax
lea r9, [0x01003230]
mov r8d, 0x8000ffff
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xc8]
call fcn.01007184
int3
mov dword [rsp + 0x104], r14d
mov eax, dword [rsp + 0x1e0]
mov dword [rsp + 0xf0], eax
mov dword [rsp + 0x100], r14d
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x104]
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsi + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r8d, eax
test eax, eax
je 0x10156b5
lea rax, [rsp + 0x50]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], 0x23b
mov dword [rsp + 0x64], 0x4000
mov dword [rsp + 0x68], r14d
mov word [rsp + 0xc0], 0
mov byte [rsp + 0xc2], 0
mov byte [rsp + 0xc3], 1
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], r14
test r8d, r8d
jle 0x101566f
movzx r8d, r8w
or r8d, 0x80070000
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x104]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbp
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsi + 8]
mov qword [rsp + 0x20], rax
lea r9, [0x010030e0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xc8]
call fcn.0100e930
mov eax, dword [rsp + 0x100]
mov dword [r13], eax
cmp dword [0x010217a0], 0
je 0x1015743
cmp dword [0x010217c0], 0
je 0x1015743
mov dword [rsp + 0x30], r14d
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xe8]
xor r8d, r8d
lea rdx, [0x01004cd8]
lea rcx, [0x010217a0]
call fcn.0100d730
lea r9, [0x01002f30]
mov r8, qword [rsp + 0xd0]
lea rdx, [0x01002ef0]
lea rcx, [0x010217a0]
call fcn.0100d240
mov edx, dword [rsp + 0xe8]
lea rcx, [0x010217a0]
call fcn.0100d990
nop
cmp dword [0x010217a0], 0
je 0x10157be
cmp dword [0x010217c0], 0
je 0x10157be
mov dword [rsp + 0x30], r14d
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xe8]
xor r8d, r8d
lea rdx, [0x01004cd8]
lea rcx, [0x010217a0]
call fcn.0100d730
mov r8d, dword [rsp + 0xc8]
lea rdx, [0x010047f0]
lea rcx, [0x010217a0]
call fcn.0100d4b0
mov edx, dword [rsp + 0xe8]
lea rcx, [0x010217a0]
call fcn.0100d990
mov al, 1
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret