Function at 0x1400e84c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push r12
push r13
push r15
mov rbp, rsp
sub rsp, 0x70
xor ebx, ebx
mov dword [rbp - 0x20], 0x10
lea rax, [rbp - 0x38]
mov dword [rbp - 0x1c], 0x10
mov qword [rsp + 0x28], rax
mov r13, r9
mov dword [rsp + 0x20], 0x20019
mov r15, rcx
mov r12d, ebx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rbx
call fcn.14000d810
test eax, eax
je 0x1400e88d0
mov ecx, dword [r15]
mov r9d, ebx
mov qword [rsp + 0xa0], rsi
mov edx, 0x6b6e
mov rsi, qword [rbp - 0x38]
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], r14
mov r14d, ebx
mov dword [rbp - 0x40], ebx
test ecx, ecx
je 0x1400e85d9
cmp ecx, 1
jne 0x1400e875f
mov ecx, ebx
test rsi, rsi
je 0x1400e855d
mov rax, rsi
jmp 0x1400e8565
mov rax, qword [r15 + 8]
mov rax, qword [rax + 0x18]
cmp word [rax + 4], dx
jne 0x1400e85bc
mov r10d, dword [rax + 0x28]
test r10d, r10d
je 0x1400e85bc
movsxd rdx, dword [rax + 0x2c]
cmp edx, 0xffffffff
je 0x1400e85bc
mov rax, qword [r15 + 8]
mov r8d, ebx
mov rdi, qword [rax + 0x10]
lea r11, [rdi + rdx]
test r10d, r10d
je 0x1400e85bc
test rcx, rcx
jne 0x1400e85bc
mov eax, r8d
movsxd rdx, dword [r11 + rax*4 + 4]
mov eax, 0x6b76
add rdx, rdi
cmp word [rdx + 4], ax
jne 0x1400e85b4
cmp word [rdx + 6], bx
cmove rcx, rdx
inc r8d
cmp r8d, r10d
jb 0x1400e8591
test rcx, rcx
mov edi, ebx
setne dil
test rcx, rcx
je 0x1400e860e
mov r9d, dword [rcx + 8]
btr r9d, 0x1f
mov dword [rbp - 0x40], r9d
jmp 0x1400e860e
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov edi, ebx
sete dil
test eax, eax
je 0x1400e860a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r9d, dword [rbp - 0x40]
test edi, edi
je 0x1400e875f
test r9d, r9d
je 0x1400e876b
mov edx, r9d
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400e876f
mov ecx, dword [r15]
test ecx, ecx
je 0x1400e8709
cmp ecx, 1
jne 0x1400e873a
mov rcx, rbx
test rsi, rsi
jne 0x1400e865d
mov rax, qword [r15 + 8]
mov rsi, qword [rax + 0x18]
mov eax, 0x6b6e
cmp word [rsi + 4], ax
jne 0x1400e86bb
mov r9d, dword [rsi + 0x28]
test r9d, r9d
je 0x1400e86bb
movsxd rdx, dword [rsi + 0x2c]
cmp edx, 0xffffffff
je 0x1400e86bb
mov rax, qword [r15 + 8]
mov r8d, ebx
mov r11, qword [rax + 0x10]
lea r10, [r11 + rdx]
test r9d, r9d
je 0x1400e86bb
nop
test rcx, rcx
jne 0x1400e86be
mov eax, r8d
movsxd rdx, dword [r10 + rax*4 + 4]
mov eax, 0x6b76
add rdx, r11
cmp word [rdx + 4], ax
jne 0x1400e86b3
cmp word [rdx + 6], bx
cmove rcx, rdx
inc r8d
cmp r8d, r9d
jb 0x1400e8690
test rcx, rcx
setne r14b
test rcx, rcx
je 0x1400e873a
mov r8d, dword [rcx + 8]
mov r14d, ebx
mov esi, r8d
btr esi, 0x1f
cmp dword [rbp - 0x40], esi
setae r14b
jb 0x1400e8704
lea rdx, [rcx + 0xc]
test r8d, r8d
js 0x1400e86f9
mov rax, qword [r15 + 8]
movsxd rdx, dword [rdx]
mov rax, qword [rax + 0x10]
add rax, 4
add rdx, rax
mov r8d, esi
mov rcx, rdi
call fcn.14011b4a0
mov dword [rbp - 0x40], esi
jmp 0x1400e873a
lea rax, [rbp - 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete r14b
test eax, eax
je 0x1400e873a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14d, r14d
je 0x1400e8745
mov r12d, dword [rbp - 0x40]
jmp 0x1400e876f
lea rcx, str.ERROR_kull_m_registry_QueryWithAlloc___kull_m_registry_RegQueryValueEx_KO_n
call fcn.14000afb0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, rax
jmp 0x1400e876f
lea rcx, str.ERROR_kull_m_registry_QueryWithAlloc___pre___kull_m_registry_RegQueryValueEx_KO_n
call fcn.14000afb0
mov rdi, qword [rbp - 0x38]
cmp dword [r15], ebx
jne 0x1400e878a
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1400e878a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14d, r14d
mov r14, qword [rsp + 0xb0]
je 0x1400e88b1
test r13, r13
je 0x1400e87f6
xor r9d, r9d
mov r8, r13
mov edx, r12d
mov rcx, rdi
call fcn.1400e8be0
test eax, eax
je 0x1400e88a8
mov edx, dword [rdi + 0x3c]
mov ecx, 0x40
mov rsi, qword [rbp + 0x60]
mov dword [rsi], edx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rbp + 0x58]
mov qword [rcx], rax
test rax, rax
je 0x1400e88a8
mov r8d, dword [rsi]
lea rdx, [rdi + 0x4c]
mov rcx, rax
mov ebx, 1
call fcn.14011b4a0
jmp 0x1400e88a8
mov rax, qword [rbp + 0x50]
test rax, rax
je 0x1400e88a8
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x30]
mov eax, dword [rdi]
lea rdx, [rbp - 0x20]
mov ecx, r12d
sub rcx, rax
mov dword [rbp - 0xc], eax
add rcx, rdi
mov dword [rbp - 0x10], eax
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_SystemFunction005]
cmp eax, 0xc0000023
jne 0x1400e88a8
mov edx, dword [rbp - 0x30]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x28], rax
test rax, rax
je 0x1400e88a8
mov eax, dword [rbp - 0x30]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x2c], eax
lea rcx, [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_SystemFunction005]
test eax, eax
js 0x1400e889e
mov eax, dword [rbp - 0x30]
mov ecx, 0x40
mov rsi, qword [rbp + 0x60]
mov edx, eax
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rbp + 0x58]
mov qword [rcx], rax
test rax, rax
je 0x1400e889e
mov r8d, dword [rsi]
mov rcx, rax
mov rdx, qword [rbp - 0x28]
mov ebx, 1
call fcn.14011b4a0
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0xa0]
mov eax, ebx
mov rdi, qword [rsp + 0xa8]
add rsp, 0x70
pop r15
pop r13
pop r12
pop rbx
pop rbp
ret
lea rcx, str.ERROR_kull_m_registry_OpenAndQueryWithAlloc___kull_m_registry_RegOpenKeyEx_KO_n
call fcn.14000afb0
mov eax, ebx
add rsp, 0x70
pop r15
pop r13
pop r12
pop rbx
pop rbp
ret