Function at 0x14001eb30
Capabilities:
Query or enumerate registry value

Disassembly:
test rcx, rcx
je 0x14001ef10
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x98
mov qword [rbp + 7], 0xfffffffffffffffe
mov r13, rcx
call fcn.14001e8b0
xor r15d, r15d
lea rsi, [r15 - 1]
test eax, eax
jle 0x14001ec21
call fcn.14001e9f0
test eax, eax
jle 0x14001ec21
mov r14d, 1
mov dword [rbp + 0x67], r14d
mov edi, r14d
lea rbx, str.Skype.exe
lea r12, [0x1402823b0]
mov rcx, qword [rbx]
call fcn.14001ef50
test al, al
jne 0x14001ecd1
inc edi
add rbx, 8
cmp rbx, r12
jl 0x14001eb98
lea rax, [rbp - 0x41]
mov qword [rbp + 0x67], rax
call fcn.14004adf0
mov rcx, rax
test rax, rax
je 0x14001ef17
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x41], rax
lea rbx, str.ED600AF1_6C0E_48d8_A015_BAD55D680E0C_Session_Enable
mov rdx, rbx
lea rcx, [rbp - 0x41]
call fcn.1400050a0
test al, al
jne 0x14001ec0e
mov rax, rsi
inc rax
cmp word [rbx + rax*2], 0
jne 0x14001ebf4
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x41]
call fcn.1400054e0
nop
xor r8d, r8d
lea rdx, [rbp - 0x41]
lea rcx, str.SOFTWARERealtekRealtekEffects
call fcn.140012b20
mov dword [rbp + 0x67], r15d
mov r14d, r15d
mov dword [rbp + 0x77], r15d
lea rax, [rbp - 0x49]
mov qword [rbp + 0x6f], rax
call fcn.14004adf0
mov rcx, rax
test rax, rax
je 0x14001ef22
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x49], rax
lea rbx, str.ED600AF1_6C0E_48d8_A015_BAD55D680E0C_Lync_Enable
mov rdx, rbx
lea rcx, [rbp - 0x49]
call fcn.1400050a0
test al, al
jne 0x14001ec8a
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14001ec70
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x49]
call fcn.1400054e0
nop
mov qword [rbp - 0x11], r15
mov dword [rbp - 9], r15d
mov qword [rbp - 1], r15
mov dword [rbp + 0x6f], r15d
mov r9d, 1
lea r8, str.SOFTWARERealtekRealtekEffects
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x11]
call fcn.14000e2b0
test eax, eax
je 0x14001ed44
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x14001ed93
jmp 0x14001ed8d
lea rax, [rbp - 0x39]
mov qword [rbp + 0x6f], rax
call fcn.14004adf0
mov rcx, rax
test rax, rax
je 0x14001ef2d
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rbx, str.ED600AF1_6C0E_48d8_A015_BAD55D680E0C_Session_Enable
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.1400050a0
test al, al
jne 0x14001ed2c
mov rax, rsi
inc rax
cmp word [rbx + rax*2], 0
jne 0x14001ed12
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.1400054e0
nop
mov r8d, edi
lea rdx, [rbp - 0x39]
lea rcx, str.SOFTWARERealtekRealtekEffects
call fcn.140012b20
jmp 0x14001ec28
mov dword [rbp + 0x7f], 4
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x29]
xor r8d, r8d
mov rdx, qword [rbp - 0x49]
mov rbx, qword [rbp - 0x11]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001ed85
cmp dword [rbp - 0x29], 4
jne 0x14001ed85
mov eax, dword [rbp + 0x6f]
mov dword [rbp + 0x77], eax
test rbx, rbx
je 0x14001ed93
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001edb0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [rbp + 0x77], r14d
je 0x14001eefd
mov r14, r15
lea rcx, [r13 + 0x1a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r12, qword [r13 + 0x138]
mov edi, r15d
test r12d, r12d
je 0x14001ee2f
nop dword [rax]
cmp edi, dword [r13 + 0x138]
jae 0x14001ee28
mov edx, edi
lea rcx, [r13 + 0x120]
call fcn.14004c12c
test rax, rax
je 0x14001ef11
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x14001ee28
mov rcx, rbx
call fcn.14000bab0
test eax, eax
je 0x14001ee1a
mov r15, rbx
jmp 0x14001ee28
mov rcx, rbx
call fcn.14000bb90
test eax, eax
cmovne r14, rbx
inc edi
cmp edi, r12d
jb 0x14001ede0
lea rcx, [r13 + 0x190]
mov rax, qword [rcx]
call qword [rax + 0x28]
test r15, r15
je 0x14001eefd
test r14, r14
je 0x14001eefd
lea rax, [rbp - 0x21]
mov qword [rbp + 0x6f], rax
mov rcx, qword [r14]
sub rcx, 0x18
call fcn.140004c20
add rax, 0x18
mov qword [rbp - 0x21], rax
mov rcx, qword [r15]
sub rcx, 0x18
call fcn.140004c20
add rax, 0x18
mov qword [rbp - 0x19], rax
lea r8, [rbp - 0x21]
lea rdx, [rbp - 0x19]
mov ebx, dword [rbp + 0x67]
mov ecx, ebx
call fcn.140021690
lea rax, [rbp - 0x31]
mov qword [rbp + 0x67], rax
call fcn.14004adf0
mov rcx, rax
test rax, rax
je 0x14001ef38
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x31], rax
lea rdi, str.ED600AF1_6C0E_48d8_A015_BAD55D680E0C_Lync_Enable
mov rdx, rdi
lea rcx, [rbp - 0x31]
call fcn.1400050a0
test al, al
jne 0x14001eeea
nop
inc rsi
cmp word [rdi + rsi*2], 0
jne 0x14001eed0
mov r8d, esi
mov rdx, rdi
lea rcx, [rbp - 0x31]
call fcn.1400054e0
nop
mov r8d, ebx
lea rdx, [rbp - 0x31]
lea rcx, str.SOFTWARERealtekRealtekEffects
call fcn.140012b20
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14004ba44
int3
mov ecx, 0x80004005
call fcn.140005680
int3
mov ecx, 0x80004005
call fcn.140005680
int3
mov ecx, 0x80004005
call fcn.140005680
int3
mov ecx, 0x80004005
call fcn.140005680
int3