Function at 0x1400728e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rbp + 0x118], rax
mov qword [rbp + 0xd0], r9
mov r12, r8
mov r13, rdx
mov r15, qword [rbp + 0x180]
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0xc8], rax
mov r14, qword [rbp + 0x190]
xor ebx, ebx
mov qword [rbp + 0xf0], rbx
lea rax, [rsp + 0x50]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
xor r8d, r8d
lea rdx, [0x140412418]
lea rcx, [rsp + 0x50]
call fcn.140030be0
nop
lea rax, [rsp + 0x70]
mov qword [rbp + 0x18], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0xf0]
call fcn.1400e30e0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], rax
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd8], xmm1
mov qword [rbp + 0xe8], rbx
mov rbx, qword [rbp + 0xf0]
mov rax, qword [rbx]
mov rdi, qword [rax + 8]
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x28
lea rdx, [0x14041b170]
lea rcx, [rsp + 0x30]
call fcn.140030be0
nop
lea r8, [rbp + 0xd8]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call rdi
nop
lea rcx, [rsp + 0x30]
call fcn.1400166f0
mov rdi, qword [rbp + 0xd8]
mov rsi, qword [rbp + 0xe0]
cmp rdi, rsi
je 0x140072ad3
cmp r12, rdi
je 0x140072a42
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x140072a37
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, r12
call fcn.140030940
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 3
lea rdx, [0x140414a78]
lea rcx, [rsp + 0x30]
call fcn.140030be0
nop
lea r8, [rsp + 0x30]
mov rdx, r12
lea rcx, [rbp - 0x70]
call fcn.14009b580
nop
mov rdx, rax
mov rcx, qword [rbp + 0xd0]
call fcn.14002d920
nop
lea rcx, [rbp - 0x70]
call fcn.1400166f0
nop
lea rcx, [rsp + 0x30]
call fcn.1400166f0
mov rsi, qword [rbp + 0xe0]
mov rdi, qword [rbp + 0xd8]
cmp rdi, rsi
je 0x140072ad3
mov rcx, rdi
call fcn.1400166f0
add rdi, 0x20
cmp rdi, rsi
jne 0x140072ab4
mov rax, qword [rbp + 0xd8]
mov qword [rbp + 0xe0], rax
mov rax, qword [rbx]
mov rdi, qword [rax + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x26
lea rdx, str._PROGRAMDATA_MalwarebytesMBAMService
lea rcx, [rsp + 0x30]
call fcn.140030be0
nop
lea r8, [rbp + 0xd8]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call rdi
nop
lea rcx, [rsp + 0x30]
call fcn.1400166f0
mov rdx, qword [rbp + 0xd8]
cmp rdx, qword [rbp + 0xe0]
je 0x140072ba5
cmp r15, rdx
je 0x140072b4a
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140072b42
mov rdx, qword [rdx]
mov rcx, r15
call fcn.140030940
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 7
lea rdx, str.ctlrpkg
lea rcx, [rsp + 0x30]
call fcn.140030be0
nop
lea r8, [rsp + 0x30]
mov rdx, r15
lea rcx, [rbp - 0x70]
call fcn.14009b580
nop
mov rdx, rax
mov rcx, r13
call fcn.14002d920
nop
lea rcx, [rbp - 0x70]
call fcn.1400166f0
nop
lea rcx, [rsp + 0x30]
call fcn.1400166f0
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x108], xmm1
mov r8d, 0x22
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rbp + 0xf8]
call fcn.140030be0
nop
mov r8d, sendto
lea rdx, str.MBAMUpdaterService
lea rcx, [rbp + 0xf8]
call fcn.14002ac00
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str.Parameters
lea rcx, [rbp + 0xf8]
call fcn.14002ac00
lea rdx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 7
cmova rdx, qword [rbp + 0xf8]
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
je 0x140072c91
lea rdx, str.Failed_to_open_service_registry:
lea rcx, [0x1404abb40]
call fcn.1400337c0
mov edx, edi
mov rcx, rax
call fcn.140045c80
mov rdi, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140034b90
movzx edx, al
mov rcx, rdi
call fcn.140034620
mov rcx, rdi
call fcn.14002ddd0
xor dil, dil
jmp 0x140073086
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8d, 6
lea rdx, [0x14041b258]
lea rcx, [rsp + 0x50]
call fcn.140030be0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str.ProductCode
lea rcx, [rsp + 0x30]
call fcn.140030be0
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0xc0]
lea rcx, [rbp + 0x20]
call fcn.14007bda0
nop
mov rdx, rax
mov rcx, qword [rbp + 0xc8]
call fcn.14002d920
nop
lea rcx, [rbp + 0x20]
call fcn.1400166f0
nop
lea rcx, [rsp + 0x30]
call fcn.1400166f0
nop
lea rcx, [rsp + 0x50]
call fcn.1400166f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.UpdateDirectory
lea rcx, [rbp - 0x50]
call fcn.140030be0
nop
mov r9, r13
lea r8, [rbp - 0x50]
mov rdx, qword [rbp + 0xc0]
lea rcx, [rbp + 0x40]
call fcn.14007bda0
nop
mov rdx, rax
mov rcx, r13
call fcn.14002d920
nop
lea rcx, [rbp + 0x40]
call fcn.1400166f0
nop
lea rcx, [rbp - 0x50]
call fcn.1400166f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.ProgramDirectory
lea rcx, [rbp - 0x30]
call fcn.140030be0
nop
mov r9, r12
lea r8, [rbp - 0x30]
mov rdx, qword [rbp + 0xc0]
lea rcx, [rbp + 0x60]
call fcn.14007bda0
nop
mov rdx, rax
mov rcx, r12
call fcn.14002d920
nop
lea rcx, [rbp + 0x60]
call fcn.1400166f0
nop
lea rcx, [rbp - 0x30]
call fcn.1400166f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
mov r8d, ntohl
lea rdx, str.LKGDirectory
lea rcx, [rbp - 0x10]
call fcn.140030be0
nop
mov r9, qword [rbp + 0xd0]
lea r8, [rbp - 0x10]
mov rdx, qword [rbp + 0xc0]
lea rcx, [rbp + 0x80]
call fcn.14007bda0
nop
mov rdx, rax
mov rcx, qword [rbp + 0xd0]
call fcn.14002d920
nop
lea rcx, [rbp + 0x80]
call fcn.1400166f0
nop
lea rcx, [rbp - 0x10]
call fcn.1400166f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.DataDirectory
lea rcx, [rbp - 0x70]
call fcn.140030be0
nop
mov r9, r15
lea r8, [rbp - 0x70]
mov rdx, qword [rbp + 0xc0]
lea rcx, [rbp + 0xa0]
call fcn.14007bda0
nop
mov rdx, rax
mov rcx, r15
call fcn.14002d920
nop
lea rcx, [rbp + 0xa0]
call fcn.1400166f0
nop
lea rcx, [rbp - 0x70]
call fcn.1400166f0
movzx edi, byte [r14 + 2]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov r8d, 0x1c
lea rdx, str.CurrentProtectedServiceState
lea rcx, [rsp + 0x70]
call fcn.140030be0
nop
xor esi, esi
mov dword [rbp + 0xc8], esi
mov dword [rbp + 0xd0], 4
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rdx, qword [rsp + 0x70]
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140072f3e
cmp dword [rbp + 0xc8], 1
sete dil
mov byte [r14 + 2], dil
lea rcx, [rsp + 0x70]
call fcn.1400166f0
movzx edi, byte [r14]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.CurrentSCMStopAccess
lea rcx, [rsp + 0x50]
call fcn.140030be0
nop
mov dword [rbp + 0xc8], esi
mov dword [rbp + 0xd0], 4
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140072fd4
cmp dword [rbp + 0xc8], 1
sete dil
mov byte [r14], dil
lea rcx, [rsp + 0x50]
call fcn.1400166f0
movzx edi, byte [r14 + 1]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.CurrentSPState
lea rcx, [rsp + 0x70]
call fcn.140030be0
nop
mov dword [rbp + 0xc8], esi
mov dword [rbp + 0xd0], 4
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rdx, qword [rsp + 0x70]
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140073068
cmp dword [rbp + 0xc8], 1
sete dil
mov byte [r14 + 1], dil
lea rcx, [rsp + 0x70]
call fcn.1400166f0
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dil, 1
lea rcx, [rbp + 0xf8]
call fcn.1400166f0
nop
lea rcx, [rbp + 0xd8]
call fcn.1400307e0
nop
test rbx, rbx
je 0x1400730b3
mov r8, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r8]
movzx eax, dil
mov rcx, qword [rbp + 0x118]
xor rcx, rsp
call fcn.1402b5c00
mov rbx, qword [rsp + 0x260]
add rsp, 0x220
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret