Function at 0x7ff74195410
Capabilities:
Query or enumerate registry value

Disassembly:
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
lea rdx, [0x7ff741d8858]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x7ff741953ed
mov rdx, qword [rsp + 0x30]
lea r8, str.XPath
mov r9, rsi
mov rcx, rdi
call fcn.7ff741963bc
mov ebx, eax
test eax, eax
js 0x7ff741953ed
movzx eax, word [rsp + 0x38]
mov word [r13], ax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
test ebx, ebx
jns 0x7ff741955b3
jmp 0x7ff741954e2
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x2e8
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
and qword [r8], 0
mov rdi, rcx
mov rcx, qword [rcx + 0x60]
mov r13, r9
mov rsi, r8
mov rbp, rdx
test rcx, rcx
je 0x7ff741a6a6e
call qword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x7ff741a6a6e
xor ebx, ebx
jmp 0x7ff74195461
test ebx, ebx
js 0x7ff741955b3
cmp qword [rdi + 0x48], 0
mov ebx, 0x80004005
je 0x7ff741954e2
lea rdx, [rsp + 0x70]
mov r8d, 0x27
mov rcx, rbp
call sym.SHLWAPI.dll_Ordinal_24
test eax, eax
js 0x7ff741954e2
mov eax, dword [rbp + 0x10]
lea r9, [rsp + 0x70]
lea r8, str._s_d
lea rcx, [rsp + 0xc0]
mov edx, 0x104
mov dword [rsp + 0x20], eax
call fcn.7ff74192518
test eax, eax
js 0x7ff741954e2
mov rcx, qword [rdi + 0x48]
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0xc0]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x7ff7419538e
and qword [rsp + 0x38], 0
mov eax, 1
lea r8, [rsp + 0x38]
lea rdx, [0x7ff741d8ad0]
mov rcx, rbp
mov word [r13], ax
call qword [sym.imp.PROPSYS.dll_PSGetPropertyDescription]
test eax, eax
js 0x7ff7419559b
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x7ff7419559b
mov rcx, qword [rdi + 0x88]
test rcx, rcx
je 0x7ff741a6a7d
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov r12d, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9, rsi
mov edx, 0x40
lea ecx, [rax + r12 + 1]
movsxd r12, ecx
xor ecx, ecx
mov r8, r12
call fcn.7ff7419edac
test eax, eax
js 0x7ff74195590
mov r9, qword [rsp + 0x30]
mov r8, qword [rdi + 0x88]
mov rcx, qword [rsi]
mov rdx, r12
call fcn.7ff74192518
mov ebx, eax
test eax, eax
js 0x7ff74195590
mov rcx, qword [rsp + 0x38]
mov rdx, r13
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test ebx, ebx
js 0x7ff741a6a85
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x7ff741955b3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.7ff741947a0
add rsp, 0x2e8
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, rdi
call fcn.7ff74196154
mov ebx, eax
jmp 0x7ff74195461
xor r12d, r12d
jmp 0x7ff7419553c
lea rdx, [rsp + 0x70]
mov r8d, 0x27
mov rcx, rbp
call sym.SHLWAPI.dll_Ordinal_24
test eax, eax
js 0x7ff741a6b0d
mov r9d, dword [rbp + 0x10]
lea r8, [0x7ff741df8ac]
lea rcx, [rsp + 0x48]
mov edx, 0xf
call fcn.7ff74192518
test eax, eax
js 0x7ff741a6b0d
mov rcx, qword [rdi + 0x70]
test rcx, rcx
jne 0x7ff741a6ac7
xor eax, eax
jmp 0x7ff741a6acd
call qword [sym.imp.OLEAUT32.dll_VariantInit]
add eax, 0x37
mov r9, rsi
mov edx, 0x40
movsxd rbp, eax
xor ecx, ecx
mov r8, rbp
call fcn.7ff7419edac
mov ebx, eax
test eax, eax
js 0x7ff741a6b1a
mov r8, qword [rdi + 0x70]
mov rcx, qword [rsi]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x70]
mov rdx, rbp
mov qword [rsp + 0x20], rax
call fcn.7ff74192518
mov ebx, eax
jmp 0x7ff741a6b12
mov ebx, 0x80004005
test ebx, ebx
jns 0x7ff741955a3
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [rsi], 0
jmp 0x7ff741955a3