Function at 0x1400e1d50
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
xor r15d, r15d
mov qword [rsp + 0x60], rdi
mov qword [rcx], r15
xor sil, sil
mov qword [rcx + 8], r15
mov r14d, r15d
mov rbx, rcx
mov r12d, 0x200
nop
test sil, sil
jne 0x1400e1fb4
mov r9d, 0x100
mov qword [rbp + 0x50], r15
lea rax, [rbp + 0x50]
test r14d, r14d
lea rdx, str.SoftwareMicrosoftCryptography
mov qword [rsp + 0x20], rax
cmove r9d, r12d
mov rcx, 0xffffffff80000002
or r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400e1fa7
mov rcx, qword [rbp + 0x50]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], r15
lea rdx, str.MachineGuid
mov dword [rbp + 0x38], r15d
mov dword [rbp + 0x40], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e1f9d
mov ecx, dword [rbp + 0x38]
test ecx, ecx
je 0x1400e1f9d
mov eax, dword [rbp + 0x40]
sub eax, 1
je 0x1400e1f4c
sub eax, 1
je 0x1400e1f4c
sub eax, 2
je 0x1400e1ebe
sub eax, 3
je 0x1400e1f4c
cmp eax, 4
jne 0x1400e1f9d
mov rcx, qword [rbp + 0x50]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.MachineGuid
lea rax, [rbp - 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e1f9d
mov r8, qword [rbp - 0x38]
lea rdx, str._lld
lea rcx, [rbp - 0x30]
call fcn.1400268a0
lea rax, [rbp - 0x30]
cmp rbx, rax
je 0x1400e1eb8
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400e1e95
call fcn.1400556b0
mov rax, qword [rbp - 0x30]
mov sil, 1
mov qword [rbx], rax
mov eax, dword [rbp - 0x28]
mov dword [rbx + 8], eax
mov eax, dword [rbp - 0x24]
mov dword [rbx + 0xc], eax
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x30], r15
jmp 0x1400e1f9d
mov rcx, qword [rbp - 0x30]
jmp 0x1400e1f3d
mov rcx, qword [rbp + 0x50]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.MachineGuid
lea rax, [rbp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e1f9d
mov r8d, dword [rbp + 0x48]
lea rdx, [0x140281b38]
lea rcx, [rbp - 0x20]
call fcn.1400268a0
lea rax, [rbp - 0x20]
cmp rbx, rax
je 0x1400e1f39
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400e1f19
call fcn.1400556b0
mov rax, qword [rbp - 0x20]
mov sil, 1
mov qword [rbx], rax
mov eax, dword [rbp - 0x18]
mov dword [rbx + 8], eax
mov eax, dword [rbp - 0x14]
mov dword [rbx + 0xc], eax
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x20], r15
jmp 0x1400e1f9d
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400e1f47
call fcn.1400556b0
mov sil, 1
jmp 0x1400e1f9d
call fcn.14001c7e0
mov rcx, qword [rbp + 0x50]
lea rdx, str.MachineGuid
mov rdi, rax
xor r9d, r9d
lea rax, [rbp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e1f95
mov r8d, dword [rbp + 0x38]
mov rdx, rdi
shr r8d, 1
mov rcx, rbx
dec r8d
call fcn.1400246e0
mov sil, 1
mov rcx, rdi
call fcn.14001c880
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r14d
cmp r14d, 2
jl 0x1400e1d80
mov rdi, qword [rsp + 0x60]
mov rax, rbx
add rsp, 0x68
pop r15
pop r14
pop r12
pop rsi
pop rbx
pop rbp
ret