Function at 0x140069879
Capabilities:
Query or enumerate registry value

Disassembly:
push rax
pushf
mov eax, 0x6d51e0f
pushf
not eax
add eax, 0x736ee91a
xor eax, 0x53c14dd7
rol eax, 0xa3
popf
pushf
not eax
add eax, 0xa58209b
xor eax, 0x381e5f08
rol eax, 0x1d
popf
pushf
not eax
add eax, 0x569aefed
xor eax, 0x2fa93915
rol eax, 0x44
popf
cmp eax, 2
jne 0x1400698c9
popf
pop rax
jmp 0x140069aa1
cmp eax, 8
jne 0x1400698d8
popf
pop rax
jmp 0x140069f35
cmp eax, 4
jne 0x1400698e7
popf
pop rax
jmp 0x140069c4b
cmp eax, 3
jne 0x1400698f6
popf
pop rax
jmp 0x140069b5b
cmp eax, 7
jne 0x140069905
popf
pop rax
jmp 0x140069ee2
cmp eax, 0xa
jne 0x140069914
popf
pop rax
jmp 0x14006a024
cmp eax, 0
jne 0x140069923
popf
pop rax
jmp 0x14006997d
cmp eax, 0xc
jne 0x140069932
popf
pop rax
jmp 0x14006a108
cmp eax, 0xb
jne 0x140069941
popf
pop rax
jmp 0x14006a091
cmp eax, 9
jne 0x140069950
popf
pop rax
jmp 0x140069fc2
cmp eax, 1
jne 0x14006995f
popf
pop rax
jmp 0x140069a37
cmp eax, 6
jne 0x14006996e
popf
pop rax
jmp 0x140069dfc
cmp eax, 5
jne 0x14006997d
popf
pop rax
jmp 0x140069d6b
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15, qword [rsp + 0x90]
mov r14, r9
and dword [rax + 0x20], 0
mov ebp, r8d
and qword [r9], 0
mov r12, rcx
mov rsi, qword [rsp + 0x98]
and dword [r15], 0
test rsi, rsi
jne 0x1400699f1
push rax
pushf
mov eax, 0x16496c11
pushf
not eax
add eax, 0x4cab7568
xor eax, 0x45df127b
rol eax, 0x10
popf
pushf
not eax
add eax, 0x7d7030e9
xor eax, 0x6240bd2b
rol eax, 0x6f
popf
jmp 0x1400698ba
push rax
pushf
mov eax, 0x6036ef9a
pushf
not eax
add eax, 0xd6d2ae5
xor eax, 0x48b246d0
rol eax, 0x10
popf
pushf
not eax
add eax, 0x3d216aa3
xor eax, 0x4278ca49
rol eax, 0x34
popf
pushf
not eax
add eax, 0x5f18c3f
xor eax, 0x1073ac5a
rol eax, 0x70
popf
jmp 0x1400698ba
mov rax, qword gs:[0x30]
mov r9, qword [rax + 0x60]
mov rsi, qword [r9 + 0x30]
push rax
pushf
mov eax, 0xc79a3f37
pushf
not eax
add eax, 0x51a2d9c1
xor eax, 0x728df0b4
rol eax, 0x79
popf
pushf
not eax
add eax, 0x4e4da2fb
xor eax, 0x3c7f1a00
rol eax, 0x26
popf
pushf
not eax
add eax, 0x40c8fae0
xor eax, 0x462a8b4c
rol eax, 0x4b
popf
pushf
not eax
add eax, 0x1d077951
xor eax, 0x53431c0
rol eax, 0x60
popf
jmp 0x1400698ba
lea rcx, [rsp + 0x30]
jmp 0x140069aa7
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor r9d, r9d
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
and dword [rsp + 0x20], 0
mov rcx, r12
lea r8d, [r9 + 2]
jmp 0x140069acf
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, eax
cmp eax, 0xc0000023
jne 0x140069b28
push rax
pushf
mov eax, 0xa08143bf
pushf
not eax
add eax, 0x3b7e95a8
xor eax, 0x678efc30
rol eax, 0x5c
popf
pushf
not eax
add eax, 0x20b399fd
xor eax, 0x688fa46e
rol eax, 0xdc
popf
pushf
not eax
add eax, 0x3ffc7b93
xor eax, 0x21f73bdb
rol eax, 0x89
popf
jmp 0x1400698ba
push rax
pushf
mov eax, 0xa8433fcb
pushf
not eax
add eax, 0x651b75a1
xor eax, 0x6f8f4664
rol eax, 0x32
popf
pushf
not eax
add eax, 0x485c2a50
xor eax, 0x7994d0f2
rol eax, 0xb8
popf
jmp 0x1400698ba
mov r8d, dword [rsp + 0x88]
mov edx, 0x745bb952
pushf
not edx
add edx, 0x2b9b8874
xor edx, 0x2a3071a
rol edx, 0x93
popf
pushf
not edx
add edx, 0x1db72b4e
xor edx, 0x6027a0b4
rol edx, 0x31
popf
pushf
not edx
add edx, 0x41d5137f
xor edx, 0x15ab2c7c
rol edx, 0xf7
popf
pushf
not edx
add edx, 0x5a3d11e4
xor edx, 0x5b544e88
rol edx, 0x4e
popf
mov rcx, rsi
jmp 0x140069bc0
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x140069c05
push rax
pushf
mov eax, 0x1f411689
pushf
not eax
add eax, 0x7e3e4ecc
xor eax, 0x367bb523
rol eax, 5
popf
pushf
not eax
add eax, 0x7b4237d9
xor eax, 0x6a708aab
rol eax, 0x3a
popf
jmp 0x1400698ba
push rax
pushf
mov eax, 0xcb4ce20b
pushf
not eax
add eax, 0x281d62fd
xor eax, 0x11b28d17
rol eax, 0x63
popf
pushf
not eax
add eax, 0x4c06de8f
xor eax, 0x46ea1373
rol eax, 0x47
popf
pushf
not eax
add eax, 0x7277b1cd
xor eax, 0x723999f9
rol eax, 0xe7
popf
jmp 0x1400698ba
mov ecx, dword [rsp + 0x88]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], ecx
mov r9, rdi
mov rcx, r12
mov r8d, 0x7a7057d8
pushf
not r8d
add r8d, 0x5dc340bf
xor r8d, 0x2e50ca74
rol r8d, 0x1e
popf
pushf
not r8d
add r8d, 0x6671571b
xor r8d, 0x3d50f8e8
rol r8d, 0x71
popf
pushf
not r8d
add r8d, 0x60ad0854
xor r8d, 0x736feb93
rol r8d, 0xc2
popf
jmp 0x140069cc0
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, eax
test eax, eax
js 0x140069d25
push rax
pushf
mov eax, 0x417a3f96
pushf
not eax
add eax, 0x4e9178f4
xor eax, 0x637e0f26
rol eax, 4
popf
pushf
not eax
add eax, 0x1873eb0b
xor eax, 0x64bc3cb5
rol eax, 0x25
popf
pushf
not eax
add eax, 0x72b52e7a
xor eax, 0x3f7abc57
rol eax, 0xa6
popf
pushf
not eax
add eax, 0x32d25b4b
xor eax, 0x18ee850c
rol eax, 0x74
popf
jmp 0x1400698ba
push rax
pushf
mov eax, 0x6d9a5a04
pushf
not eax
add eax, 0x556e52b2
xor eax, 0x48772ea1
rol eax, 0xe5
popf
pushf
not eax
add eax, 0x30244b2c
xor eax, 0x3926139a
rol eax, 0x59
popf
pushf
not eax
add eax, 0x6e60d86f
xor eax, 0x5659f93a
rol eax, 0xd2
popf
jmp 0x1400698ba
cmp dword [rdi + 4], ebp
jne 0x140069dc9
push rax
pushf
mov eax, 0x7243f435
pushf
not eax
add eax, 0x757dbebc
xor eax, 0x6a09be18
rol eax, 0xc2
popf
pushf
not eax
add eax, 0x4193adde
xor eax, 0x3058d42
rol eax, 0x6f
popf
pushf
not eax
add eax, 0x11429191
xor eax, 0x26f753e1
rol eax, 0x30
popf
pushf
not eax
add eax, 0x6a2a4ae8
xor eax, 0x57e18a0f
rol eax, 0x11
popf
jmp 0x1400698ba
push rax
pushf
mov eax, 0x8f247bb5
pushf
not eax
add eax, 0x47b2c73b
xor eax, 0x5607804b
rol eax, 0xd6
popf
pushf
not eax
add eax, 0x1f966e2
xor eax, 0xf1dc46f
rol eax, 0x4b
popf
jmp 0x1400698ba
mov r8d, dword [rdi + 8]
mov edx, 0x103f7f0a
pushf
not edx
add edx, 0x69eb0eb4
xor edx, 0x432e4f50
rol edx, 0xdc
popf
pushf
not edx
add edx, 0x2556f1bd
xor edx, 0x3c0ec733
rol edx, 0xfb
popf
pushf
not edx
add edx, 0x6de3e389
xor edx, 0x78e6e0f4
rol edx, 0xc
popf
mov rcx, rsi
jmp 0x140069e48
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x140069e9c
push rax
pushf
mov eax, 0x83b855af
pushf
not eax
add eax, 0x63e60634
xor eax, 0x3665cd3d
rol eax, 0x78
popf
pushf
not eax
add eax, 0x293ae576
xor eax, 0x4b3bb264
rol eax, 0x64
popf
pushf
not eax
add eax, 0x5535ca12
xor eax, 0xe82e04f
rol eax, 0x2a
popf
jmp 0x1400698ba
push rax
pushf
mov eax, 0x4752969f
pushf
not eax
add eax, 0x413e36b5
xor eax, 0x275ffad2
rol eax, 0xfe
popf
pushf
not eax
add eax, 0x26cabe28
xor eax, 0x2cf4db44
rol eax, 0xe8
popf
pushf
not eax
add eax, 0x229d0a7c
xor eax, 0x3820d878
rol eax, 0xab
popf
jmp 0x1400698ba
mov r8d, dword [rdi + 8]
lea rdx, [rdi + 0xc]
mov rcx, rax
call fcn.14001ab70
mov qword [r14], rbx
xor ebx, ebx
mov eax, dword [rdi + 8]
mov dword [r15], eax
jmp 0x14006a024
mov ebx, 0x670088a9
pushf
not ebx
add ebx, 0x54f3f71
xor ebx, 0x1df9592f
rol ebx, 0xd9
popf
pushf
not ebx
add ebx, 0x757136c7
xor ebx, 0x5469c6e2
rol ebx, 0xc2
popf
jmp 0x14006a024
mov ebx, 0x3f24c221
pushf
not ebx
add ebx, 0x41f6be90
xor ebx, 0x66597f38
rol ebx, 0x2d
popf
pushf
not ebx
add ebx, 0x10f6365c
xor ebx, 0x41369ca
rol ebx, 0x6b
popf
push rax
pushf
mov eax, 0x2d2cf103
pushf
not eax
add eax, 0x4224a001
xor eax, 0x63664354
rol eax, 0xf4
popf
pushf
not eax
add eax, 0x26c20e5
xor eax, 0x27d4a686
rol eax, 0xfb
popf
jmp 0x1400698ba
mov r8, rdi
xor edx, edx
mov rcx, rsi
jmp 0x14006a02d
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14006a108
mov ebx, 0x1cebef1c
pushf
not ebx
add ebx, 0x71573250
xor ebx, 0x231b5083
rol ebx, 0x45
popf
pushf
not ebx
add ebx, 0x6db0deae
xor ebx, 0x5453353d
rol ebx, 0x5c
popf
pushf
not ebx
add ebx, 0x39c34416
xor ebx, 0x15fb6e3b
rol ebx, 0x8b
popf
push rax
pushf
mov eax, 0xa3467150
pushf
not eax
add eax, 0x64e4b665
xor eax, 0x6770c62
rol eax, 0x52
popf
pushf
not eax
add eax, 0x71eff563
xor eax, 0x4cd4d5bd
rol eax, 0xac
popf
jmp 0x1400698ba
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret