Function at 0x1400ed1e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x70
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rbp, r9
mov r12, rdx
mov rdi, rcx
test rcx, rcx
jne 0x1400ed211
xor eax, eax
jmp 0x1400ed420
test r9, r9
jne 0x1400ed21d
xor eax, eax
jmp 0x1400ed420
xor esi, esi
mov rbx, rsi
mov qword [rsp + 0x30], rbx
lea rdx, [0x1401ab420]
lea rcx, [rsp + 0x38]
call fcn.1400ed630
mov dword [rsp + 0x90], esi
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x1400ed277
mov edi, esi
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rbx
test edi, edi
jne 0x1400ed2da
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400ed2c4
cmp dword [rsp + 0x48], 4
je 0x1400ed3de
lea edi, [rax + 0xd]
test rbx, rbx
je 0x1400ed2da
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
mov qword [rsp + 0x30], rbx
test r12, r12
je 0x1400ed3a4
mov qword [rsp + 0x58], rsi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, r12
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ed36e
test rbx, rbx
je 0x1400ed31f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rcx
test esi, esi
jne 0x1400ed36e
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400ed3a4
cmp dword [rsp + 0x4c], 4
jne 0x1400ed3a8
jmp 0x1400ed3de
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ed390
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400ed3a0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400ed420
test edi, edi
je 0x1400ed3de
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ed3ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400ed3da
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400ed420
mov eax, dword [rsp + 0x90]
mov dword [rbp], eax
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ed40b
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400ed41b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret