Function at 0x30006970
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
mov rax, rsp
sub rsp, 0x48
xor r12d, r12d
mov rbp, rdx
mov rbx, rcx
cmp rcx, r12
mov rsi, r12
mov dword [rax + 0x38], r12d
mov qword [rax + 0x50], r12
mov qword [rax - 0x18], r12
mov dword [rax + 0x48], r12d
mov r13d, 0x80070000
je 0x30006c0d
cmp word [rcx], r12w
je 0x30006c0d
cmp rdx, r12
je 0x30006c0d
mov qword [rdx], r12
mov rdx, qword [str.XEV.GenericApp]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
cmp eax, r12d
je 0x30006b66
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, rbx
call fcn.300066cc
cmp eax, r12d
jl 0x30006a2b
mov edx, dword [rsp + 0x80]
xor ecx, ecx
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, r12
mov rsi, rax
je 0x30006a2b
lea r8, [rsp + 0x80]
mov rdx, rax
mov rcx, rbx
call fcn.300066cc
cmp eax, r12d
jge 0x30006a2b
mov rcx, rsi
call fcn.300034e4
mov rsi, r12
lea rax, [rsp + 0x98]
cmp rsi, r12
mov edi, 0x20019
cmovne rbx, rsi
mov r9d, edi
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r13d
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x30006c12
mov rdx, qword [str.XML_HandlerIcon]
mov rcx, qword [rsp + 0x98]
lea rax, [rsp + 0x30]
mov r9d, edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r13d
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x30006c12
mov rdx, qword [str..xml]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x80], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, r13d
cmp eax, r12d
cmovle ebx, eax
mov eax, r12d
cmp ebx, r12d
cmovge eax, dword [rsp + 0x80]
cmp ebx, r12d
jl 0x30006c12
cmp eax, 1
je 0x30006b17
cmp eax, 2
je 0x30006b17
mov ebx, 0x80004005
jmp 0x30006c12
mov edx, dword [rsp + 0x90]
xor ecx, ecx
add rdx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, r12
mov rdi, rax
je 0x30006b80
mov rdx, qword [str..xml]
mov rcx, qword [rsp + 0x30]
lea r9, [rax + 2]
lea rax, [rsp + 0x90]
lea r8, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call fcn.30003bd4
mov ebx, eax
cmp eax, r12d
jmp 0x30006c00
mov edx, dword [0x3000c1e0]
xor ecx, ecx
add rdx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, r12
mov rdi, rax
jne 0x30006b8a
mov ebx, 0x8007000e
jmp 0x30006c12
mov ecx, dword [0x3000c1e0]
lea rdx, [rax + 2]
mov ebx, r12d
shr rcx, 1
je 0x30006ba5
cmp rcx, 0x7fffffff
jbe 0x30006baa
mov ebx, 0x80070057
cmp ebx, r12d
jl 0x30006c12
cmp rcx, r12
mov r8, qword [str..xevgenxml]
mov ebx, r12d
je 0x30006bf0
mov r9d, 0x7ffffffe
sub r9, rcx
lea rax, [r9 + rcx]
cmp rax, r12
je 0x30006beb
movzx eax, word [r8]
cmp ax, r12w
je 0x30006beb
mov word [rdx], ax
add r8, 2
add rdx, 2
sub rcx, 1
jne 0x30006bc7
cmp rcx, r12
jne 0x30006bf9
sub rdx, 2
mov ebx, 0x8007007a
mov word [rdx], r12w
cmp ebx, r12d
jl 0x30006c12
mov word [rdi], 0x2a
mov qword [rbp], rdi
jmp 0x30006c12
mov ebx, 0x80070057
mov rcx, rsi
call fcn.300034e4
mov rcx, qword [rsp + 0x98]
cmp rcx, r12
je 0x30006c50
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, r13d
cmp eax, r12d
cmovle ecx, eax
mov rax, qword [rsp + 0x98]
cmp ecx, r12d
cmovge rax, r12
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0x30]
cmp rcx, r12
je 0x30006c60
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret