Function at 0x1400ece20
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x70
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rbp, r9
mov r12, rdx
mov rdi, rcx
test rcx, rcx
jne 0x1400ece51
xor eax, eax
jmp 0x1400ed060
test r9, r9
jne 0x1400ece5d
xor eax, eax
jmp 0x1400ed060
xor esi, esi
mov rbx, rsi
mov qword [rsp + 0x30], rbx
lea rdx, [0x1401aa1a8]
lea rcx, [rsp + 0x38]
call fcn.1400ed270
mov dword [rsp + 0x90], esi
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x1400eceb7
mov edi, esi
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rbx
test edi, edi
jne 0x1400ecf1a
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400ecf04
cmp dword [rsp + 0x48], 4
je 0x1400ed01e
lea edi, [rax + 0xd]
test rbx, rbx
je 0x1400ecf1a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
mov qword [rsp + 0x30], rbx
test r12, r12
je 0x1400ecfe4
mov qword [rsp + 0x58], rsi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, r12
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ecfae
test rbx, rbx
je 0x1400ecf5f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rcx
test esi, esi
jne 0x1400ecfae
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400ecfe4
cmp dword [rsp + 0x4c], 4
jne 0x1400ecfe8
jmp 0x1400ed01e
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ecfd0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400ecfe0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400ed060
test edi, edi
je 0x1400ed01e
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ed00a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400ed01a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400ed060
mov eax, dword [rsp + 0x90]
mov dword [rbp], eax
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ed04b
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400ed05b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret