Function at 0x14001e920
Capabilities:
Query or enumerate registry value

Disassembly:
test rcx, rcx
je 0x14001ed00
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x98
mov qword [rbp + 7], 0xfffffffffffffffe
mov r13, rcx
call fcn.14001e6a0
xor r15d, r15d
lea rsi, [r15 - 1]
test eax, eax
jle 0x14001ea11
call fcn.14001e7e0
test eax, eax
jle 0x14001ea11
mov r14d, 1
mov dword [rbp + 0x67], r14d
mov edi, r14d
lea rbx, str.Skype.exe
lea r12, [0x1402821e0]
mov rcx, qword [rbx]
call fcn.14001ed40
test al, al
jne 0x14001eac1
inc edi
add rbx, 8
cmp rbx, r12
jl 0x14001e988
lea rax, [rbp - 0x41]
mov qword [rbp + 0x67], rax
call fcn.14004aa80
mov rcx, rax
test rax, rax
je 0x14001ed07
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x41], rax
lea rbx, str.ED600AF1_6C0E_48d8_A015_BAD55D680E0C_Session_Enable
mov rdx, rbx
lea rcx, [rbp - 0x41]
call fcn.1400050a0
test al, al
jne 0x14001e9fe
mov rax, rsi
inc rax
cmp word [rbx + rax*2], 0
jne 0x14001e9e4
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x41]
call fcn.1400054e0
nop
xor r8d, r8d
lea rdx, [rbp - 0x41]
lea rcx, str.SOFTWARERealtekRealtekEffects
call fcn.140012660
mov dword [rbp + 0x67], r15d
mov r14d, r15d
mov dword [rbp + 0x77], r15d
lea rax, [rbp - 0x49]
mov qword [rbp + 0x6f], rax
call fcn.14004aa80
mov rcx, rax
test rax, rax
je 0x14001ed12
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x49], rax
lea rbx, str.ED600AF1_6C0E_48d8_A015_BAD55D680E0C_Lync_Enable
mov rdx, rbx
lea rcx, [rbp - 0x49]
call fcn.1400050a0
test al, al
jne 0x14001ea7a
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14001ea60
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x49]
call fcn.1400054e0
nop
mov qword [rbp - 0x11], r15
mov dword [rbp - 9], r15d
mov qword [rbp - 1], r15
mov dword [rbp + 0x6f], r15d
mov r9d, 1
lea r8, str.SOFTWARERealtekRealtekEffects
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x11]
call fcn.14000ddf0
test eax, eax
je 0x14001eb34
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x14001eb83
jmp 0x14001eb7d
lea rax, [rbp - 0x39]
mov qword [rbp + 0x6f], rax
call fcn.14004aa80
mov rcx, rax
test rax, rax
je 0x14001ed1d
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rbx, str.ED600AF1_6C0E_48d8_A015_BAD55D680E0C_Session_Enable
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.1400050a0
test al, al
jne 0x14001eb1c
mov rax, rsi
inc rax
cmp word [rbx + rax*2], 0
jne 0x14001eb02
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.1400054e0
nop
mov r8d, edi
lea rdx, [rbp - 0x39]
lea rcx, str.SOFTWARERealtekRealtekEffects
call fcn.140012660
jmp 0x14001ea18
mov dword [rbp + 0x7f], 4
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x29]
xor r8d, r8d
mov rdx, qword [rbp - 0x49]
mov rbx, qword [rbp - 0x11]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001eb75
cmp dword [rbp - 0x29], 4
jne 0x14001eb75
mov eax, dword [rbp + 0x6f]
mov dword [rbp + 0x77], eax
test rbx, rbx
je 0x14001eb83
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001eba0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [rbp + 0x77], r14d
je 0x14001eced
mov r14, r15
lea rcx, [r13 + 0x1a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r12, qword [r13 + 0x138]
mov edi, r15d
test r12d, r12d
je 0x14001ec1f
nop dword [rax]
cmp edi, dword [r13 + 0x138]
jae 0x14001ec18
mov edx, edi
lea rcx, [r13 + 0x120]
call fcn.14004bdbc
test rax, rax
je 0x14001ed01
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x14001ec18
mov rcx, rbx
call fcn.14000b8a0
test eax, eax
je 0x14001ec0a
mov r15, rbx
jmp 0x14001ec18
mov rcx, rbx
call fcn.14000b980
test eax, eax
cmovne r14, rbx
inc edi
cmp edi, r12d
jb 0x14001ebd0
lea rcx, [r13 + 0x190]
mov rax, qword [rcx]
call qword [rax + 0x28]
test r15, r15
je 0x14001eced
test r14, r14
je 0x14001eced
lea rax, [rbp - 0x21]
mov qword [rbp + 0x6f], rax
mov rcx, qword [r14]
sub rcx, 0x18
call fcn.140004c20
add rax, 0x18
mov qword [rbp - 0x21], rax
mov rcx, qword [r15]
sub rcx, 0x18
call fcn.140004c20
add rax, 0x18
mov qword [rbp - 0x19], rax
lea r8, [rbp - 0x21]
lea rdx, [rbp - 0x19]
mov ebx, dword [rbp + 0x67]
mov ecx, ebx
call fcn.140021480
lea rax, [rbp - 0x31]
mov qword [rbp + 0x67], rax
call fcn.14004aa80
mov rcx, rax
test rax, rax
je 0x14001ed28
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x31], rax
lea rdi, str.ED600AF1_6C0E_48d8_A015_BAD55D680E0C_Lync_Enable
mov rdx, rdi
lea rcx, [rbp - 0x31]
call fcn.1400050a0
test al, al
jne 0x14001ecda
nop
inc rsi
cmp word [rdi + rsi*2], 0
jne 0x14001ecc0
mov r8d, esi
mov rdx, rdi
lea rcx, [rbp - 0x31]
call fcn.1400054e0
nop
mov r8d, ebx
lea rdx, [rbp - 0x31]
lea rcx, str.SOFTWARERealtekRealtekEffects
call fcn.140012660
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14004b6d4
int3
mov ecx, 0x80004005
call fcn.140005680
int3
mov ecx, 0x80004005
call fcn.140005680
int3
mov ecx, 0x80004005
call fcn.140005680
int3
mov ecx, 0x80004005
call fcn.140005680
int3