Function at 0x7ff74198418
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x34], ebx
cmp rdi, rbx
je 0x7ff741a6fcc
mov eax, dword [rdi]
mov dword [rsp + 0x30], eax
jmp 0x7ff741983c3
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
mov esi, eax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp esi, ebx
je 0x7ff741a6fd5
cmp esi, 0xea
jne 0x7ff74198548
jmp 0x7ff741a6fd5
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x288
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x2f8]
mov rbp, qword [rsp + 0x2f0]
movsxd rsi, ecx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x300]
mov rdi, r9
mov r14, r8
mov r13, rdx
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x58], rax
call fcn.7ff74198388
xor ebx, ebx
cmp r14, rbx
je 0x7ff74198485
cmp rdi, rbx
je 0x7ff741a6fb6
lea rcx, [rsi + rsi*4]
mov r15d, ebx
mov r12, rbx
mov qword [rsp + 0x48], rcx
lea r9, [0x7ff74180000]
mov esi, 1
cmp r12, rsi
jg 0x7ff741984f1
mov r9, qword [rsp + 0x50]
lea r8, str.SoftwarePolicies_s
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.7ff74192518
cmp eax, ebx
jl 0x7ff741984ea
mov edx, ebx
cmp r15d, ebx
lea r9, [rsp + 0x30]
setne dl
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x30], ebx
call fcn.7ff741982c0
cmp eax, ebx
jge 0x7ff741a6fc0
lea r9, [0x7ff74180000]
mov ecx, dword [r9 + r12*4 + 0x68000]
mov rax, qword [rsp + 0x48]
mov eax, dword [r9 + rax*8 + 0x58e44]
and eax, ecx
cmp eax, ecx
jne 0x7ff7419854f
mov rcx, qword [r9 + r12*8 + 0x67df0]
cmp rcx, rbx
je 0x7ff7419854f
cmp esi, ebx
je 0x7ff7419854f
mov rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x7ff741983ae
lea r9, [0x7ff74180000]
inc r12
inc r15d
cmp r12, 4
jl 0x7ff7419849b
mov eax, dword [rsp + 0x38]
lea rsi, [rax + rax*4]
mov eax, dword [r9 + rsi*8 + 0x58e44]
test dword [0x7ff741e8010], eax
je 0x7ff74198611
cmp r13, rbx
je 0x7ff7419858c
mov eax, dword [r9 + rsi*8 + 0x58e30]
mov dword [r13], eax
cmp rbp, rbx
je 0x7ff74198598
mov dword [rbp], 4
cmp r14, rbx
je 0x7ff741985da
mov eax, dword [r9 + rsi*8 + 0x58e40]
cmp dword [rdi], eax
jb 0x7ff741a7038
cmp dword [r9 + rsi*8 + 0x58e30], 4
mov r8, rax
mov rcx, r14
lea rdx, [r9 + rsi*8 + 0x58e38]
je 0x7ff741985ce
mov rdx, qword [r9 + rsi*8 + 0x58e38]
call sub.ntdll.dll_memcpy
lea r9, [0x7ff74180000]
cmp rdi, rbx
je 0x7ff741985e9
mov eax, dword [r9 + rsi*8 + 0x58e40]
mov dword [rdi], eax
xor eax, eax
jmp 0x7ff741985ed
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.7ff741947a0
add rsp, 0x288
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp rbp, rbx
je 0x7ff7419861d
mov dword [rbp], 5
mov eax, 0x80040700
jmp 0x7ff741985ed
mov eax, 0x80040702
jmp 0x7ff741985ed
cmp dword [rsp + 0x30], ebx
cmove esi, ebx
jmp 0x7ff741984ea
mov dword [rsp + 0x30], ebx
jmp 0x7ff741983c3
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x34]
lea r9, [0x7ff74180000]
cmp dword [r9 + rax*8 + 0x58e30], ecx
jne 0x7ff7419854f
mov edx, dword [rsp + 0x30]
cmp edx, ebx
jbe 0x7ff7419854f
cmp r13, rbx
je 0x7ff741a7018
mov eax, dword [rsp + 0x38]
lea rcx, [rax + rax*4]
mov eax, dword [r9 + rcx*8 + 0x58e30]
mov dword [r13], eax
cmp rbp, rbx
je 0x7ff741a7021
mov dword [rbp], r15d
cmp rdi, rbx
je 0x7ff741a7028
mov dword [rdi], edx
sub ebx, esi
neg ebx
sbb eax, eax
and eax, 0x80040702
jmp 0x7ff741985ed
mov dword [rdi], eax
jmp 0x7ff741a6fb6