Function at 0x140016240
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov qword [rbp + 0x2f], 0xfffffffffffffffe
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
cmp eax, dword [0x14003f274]
jbe 0x1400164ab
lea rcx, [rbp + 7]
call fcn.140015b00
nop
xor r14d, r14d
mov ebx, r14d
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x140016448
mov dword [rbp + 0x67], r14d
mov dword [rbp - 0x25], 4
lea rax, [rbp - 0x25]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x21]
xor r8d, r8d
lea rdx, str.TraceToFile
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400162ca
cmp dword [rbp - 0x21], 4
mov eax, dword [rbp + 0x67]
je 0x1400162cf
mov eax, 1
mov edi, 4
cmp eax, 1
cmovne edi, r14d
mov dword [rbp + 0x6f], r14d
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x14001632f
mov dword [rbp - 0x1d], 4
lea rax, [rbp - 0x1d]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x19]
xor r8d, r8d
lea rdx, str.NewFileAlways
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001632b
cmp dword [rbp - 0x19], 4
jne 0x14001632b
cmp dword [rbp + 0x6f], ebx
seta al
mov rcx, qword [rbp + 7]
jmp 0x140016331
mov rcx, qword [rbp + 7]
mov al, 1
mov ebx, edi
or ebx, 8
test al, al
cmove ebx, edi
mov dword [rbp + 0x77], r14d
test rcx, rcx
je 0x14001638c
mov dword [rbp - 0x15], 4
lea rax, [rbp - 0x15]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x11]
xor r8d, r8d
lea rdx, str.DoTrace
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016388
cmp dword [rbp - 0x11], 4
jne 0x140016388
cmp dword [rbp + 0x77], r14d
seta al
mov rcx, qword [rbp + 7]
jmp 0x14001638e
mov rcx, qword [rbp + 7]
xor al, al
mov edi, ebx
or edi, 0x20
test al, al
cmove edi, ebx
mov dword [rbp + 0x7f], r14d
test rcx, rcx
je 0x1400163e9
mov dword [rbp - 0xd], 4
lea rax, [rbp - 0xd]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 9]
xor r8d, r8d
lea rdx, str.DoLog
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400163e5
cmp dword [rbp - 9], 4
jne 0x1400163e5
cmp dword [rbp + 0x7f], r14d
seta al
mov rcx, qword [rbp + 7]
jmp 0x1400163eb
mov rcx, qword [rbp + 7]
xor al, al
mov ebx, edi
bts ebx, 7
test al, al
cmove ebx, edi
mov dword [rbp - 0x29], r14d
test rcx, rcx
je 0x14001643f
mov dword [rbp - 5], 4
lea rax, [rbp - 5]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 1]
xor r8d, r8d
lea rdx, str.DoProfiling
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001643f
cmp dword [rbp - 1], 4
jne 0x14001643f
cmp dword [rbp - 0x29], r14d
seta al
jmp 0x140016441
xor al, al
test al, al
je 0x140016448
or ebx, 0x40
cmp ebx, dword [0x14003d910]
je 0x140016488
lea rdi, [0x14003f4c8]
mov qword [rbp + 0x1f], rdi
mov byte [rbp + 0x27], r14b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rbp + 0x27], 1
mov dword [0x14003f274], r14d
mov ecx, ebx
call fcn.1400164c0
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rbp + 0x27], 0
lea eax, [rsi + 0x7530]
xchg dword [0x14003f274], eax
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x1400164a7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 7], r14
mov dword [rbp + 0xf], r14d
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret