Function at 0x1400dafa0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x70
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rbp, r9
mov r12, rdx
mov rdi, rcx
test rcx, rcx
jne 0x1400dafd1
xor eax, eax
jmp 0x1400db1e0
test r9, r9
jne 0x1400dafdd
xor eax, eax
jmp 0x1400db1e0
xor esi, esi
mov rbx, rsi
mov qword [rsp + 0x30], rbx
lea rdx, [0x14018d650]
lea rcx, [rsp + 0x38]
call fcn.1400db3f0
mov dword [rsp + 0x90], esi
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x1400db037
mov edi, esi
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rbx
test edi, edi
jne 0x1400db09a
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400db084
cmp dword [rsp + 0x48], 4
je 0x1400db19e
lea edi, [rax + 0xd]
test rbx, rbx
je 0x1400db09a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
mov qword [rsp + 0x30], rbx
test r12, r12
je 0x1400db164
mov qword [rsp + 0x58], rsi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, r12
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400db12e
test rbx, rbx
je 0x1400db0df
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rcx
test esi, esi
jne 0x1400db12e
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400db164
cmp dword [rsp + 0x4c], 4
jne 0x1400db168
jmp 0x1400db19e
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400db150
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400db160
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400db1e0
test edi, edi
je 0x1400db19e
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400db18a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400db19a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400db1e0
mov eax, dword [rsp + 0x90]
mov dword [rbp], eax
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400db1cb
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400db1db
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret