Function at 0x7ff74af4920
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
xor r12d, r12d
lea rax, [r11 + 0x18]
mov rsi, r9
mov qword [r8], r12
mov dword [r9], r12d
mov rbp, r8
mov qword [r11 - 0x40], rax
lea r13, str.LaunchPermission
lea r9, [r11 + 0x20]
xor r8d, r8d
mov rdx, r13
mov rdi, rcx
mov dword [r11 + 0x18], r12d
mov dword [r11 + 0x20], r12d
mov qword [r11 - 0x48], r12
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
lea r14d, [r12 + 2]
mov r11d, eax
cmp eax, r14d
je 0x7ff74af4cf8
mov r8d, dword [rsp + 0x80]
mov r9d, dword [rsp + 0x88]
cmp eax, r12d
jne 0x7ff74b19eb7
cmp r9d, 3
jne 0x7ff74b1a0d3
cmp r8d, r14d
jb 0x7ff74b1a0d3
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
call qword [0x7ff74b58358]
mov rbx, rax
cmp rax, r12
je 0x7ff74b19ec7
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r13
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r12d
jne 0x7ff74b19ed1
cmp dword [rsp + 0x88], 3
jne 0x7ff74b19f42
cmp word [rbx], 1
jne 0x7ff74b1a080
cmp dword [rsp + 0x80], 0x14
jb 0x7ff74b1a094
cmp dword [rbx + 8], r12d
je 0x7ff74b1a035
cmp dword [rbx + 4], r12d
je 0x7ff74b1a035
mov rcx, rbx
call qword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_IsValidSecurityDescriptor]
cmp eax, r12d
je 0x7ff74b19f83
xor edx, edx
mov rcx, rbx
call fcn.7ff74af4aa4
cmp eax, r12d
je 0x7ff74b19fed
mov qword [rbp], rbx
xor eax, eax
jmp 0x7ff74af4a67
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, 0x80040152
jmp 0x7ff74af4a67
cmp eax, 0xea
je 0x7ff74af499e
jmp 0x7ff74b1a0d3
mov eax, 0x8007000e
jmp 0x7ff74af4a67
mov rcx, qword [0x7ff74b584e0]
mov r8, rbx
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b19f38
mov r10, qword [0x7ff74b58350]
lea rcx, [0x7ff74b58350]
cmp r10, rcx
je 0x7ff74b19f38
test byte [r10 + 0x1c], 1
je 0x7ff74b19f38
mov edx, 0x1d
mov dword [rsp + 0x30], edi
mov eax, dword [rsp + 0x80]
mov rcx, qword [r10 + 0x10]
lea r8, [0x7ff74b518d8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x88]
mov r9, r13
mov dword [rsp + 0x20], eax
call fcn.7ff74b2ef74
mov eax, 0x80040150
jmp 0x7ff74af4a67
mov rcx, qword [0x7ff74b584e0]
mov r8, rbx
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b19f38
mov r10, qword [0x7ff74b58350]
lea rcx, [0x7ff74b58350]
cmp r10, rcx
je 0x7ff74b19f38
test byte [r10 + 0x1c], 1
je 0x7ff74b19f38
mov edx, 0x1e
mov dword [rsp + 0x30], r12d
jmp 0x7ff74b19f0f
mov rcx, qword [0x7ff74b584e0]
mov r8, rbx
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b1a11c
mov r10, qword [0x7ff74b58350]
lea rcx, [0x7ff74b58350]
cmp r10, rcx
je 0x7ff74b1a11c
test byte [r10 + 0x1c], 1
je 0x7ff74b1a11c
mov edx, 0x20
mov eax, dword [rsp + 0x80]
mov rcx, qword [r10 + 0x10]
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x20], eax
jmp 0x7ff74b1a10d
mov rcx, qword [0x7ff74b584e0]
mov r8, rbx
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b1a11c
mov r10, qword [0x7ff74b58350]
lea rcx, [0x7ff74b58350]
cmp r10, rcx
je 0x7ff74b1a11c
test byte [r10 + 0x1c], 1
je 0x7ff74b1a11c
mov edx, 0x21
jmp 0x7ff74b19fc9
mov rcx, qword [0x7ff74b584e0]
mov r8, rbx
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b1a11c
mov r10, qword [0x7ff74b58350]
lea rcx, [0x7ff74b58350]
cmp r10, rcx
je 0x7ff74b1a11c
test byte [r10 + 0x1c], 1
je 0x7ff74b1a11c
mov edx, 0x1f
jmp 0x7ff74b19fc9
cmp word [rbx], r14w
jne 0x7ff74b1a094
mov eax, dword [rsp + 0x80]
mov dword [rsi], eax
jmp 0x7ff74af4a5f
mov rcx, qword [0x7ff74b584e0]
mov r8, rbx
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b1a11c
mov r10, qword [0x7ff74b58350]
lea rcx, [0x7ff74b58350]
cmp r10, rcx
je 0x7ff74b1a11c
test byte [r10 + 0x1c], 1
je 0x7ff74b1a11c
mov edx, 0x22
jmp 0x7ff74b19fc9
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b1a11c
mov rax, qword [0x7ff74b58350]
lea rcx, [0x7ff74b58350]
cmp rax, rcx
je 0x7ff74b1a11c
test byte [rax + 0x1c], 1
je 0x7ff74b1a11c
mov rcx, qword [rax + 0x10]
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r9d
mov edx, 0x1c
lea r8, [0x7ff74b518d8]
mov r9, r13
call fcn.7ff74b2ef74
mov eax, 0x80040153
jmp 0x7ff74af4a67