Function at 0x7ff4b419d70
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov rbp, rcx
movabs r12, 0x4000000000000000
cmp dword [0x7ff4b426e6c], r15d
je 0x7ff4b419dda
mov al, byte [0x7ff4b426e70]
cmp al, 4
jae 0x7ff4b419dac
cmp al, r15b
jne 0x7ff4b419dda
test qword [0x7ff4b426e58], r12
je 0x7ff4b419dda
mov rcx, qword [0x7ff4b426e60]
mov rax, rcx
and rax, r12
cmp rax, rcx
jne 0x7ff4b419dda
mov rcx, qword [0x7ff4b426e40]
lea rdx, [0x7ff4b405c80]
call fcn.7ff4b4123dc
lea r8, [rsp + 0x98]
mov edx, 1
mov rcx, rbp
mov r13, r15
mov ebx, r15d
call fcn.7ff4b419cb4
cmp eax, r15d
mov edi, eax
mov r14d, 0x80004005
jl 0x7ff4b419f1a
mov rcx, qword [rsp + 0x98]
lea rax, [rsp + 0x88]
mov edi, 8
mov qword [rsp + 0x30], rax
lea r8, [0x7ff4b40f480]
mov r9d, edi
xor edx, edx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x88], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp eax, 2
jne 0x7ff4b419e51
mov edi, r15d
jmp 0x7ff4b419f0c
cmp eax, r15d
jne 0x7ff4b419efd
mov eax, dword [rsp + 0x88]
cmp eax, r15d
je 0x7ff4b419ef8
mov rcx, rax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rsi, rax
cmp rax, r15
jne 0x7ff4b419e84
mov edi, 0x8007000e
jmp 0x7ff4b419f0c
mov eax, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x98]
lea r8, [0x7ff4b40f480]
mov dword [rsp + 0x90], eax
lea rax, [rsp + 0x90]
mov r9d, edi
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
movzx edi, ax
or edi, 0x80070000
cmp eax, r15d
cmovle edi, eax
cmp edi, r15d
jl 0x7ff4b419eee
mov eax, dword [rsp + 0x90]
cmp eax, dword [rsp + 0x88]
ja 0x7ff4b419eee
mov r13, rsi
mov ebx, eax
jmp 0x7ff4b419f0c
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x7ff4b419f0c
mov edi, r14d
jmp 0x7ff4b419f0c
movzx edi, ax
or edi, 0x80070000
cmp eax, r15d
cmovle edi, eax
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, r15d
jl 0x7ff4b41a0d5
cmp ebx, r15d
jbe 0x7ff4b41a0d5
mov eax, ebx
mov rcx, r13
shr eax, 1
dec eax
mov word [r13 + rax*2], r15w
call sub.wevtapi.dll_EvtCreateBookmark
mov qword [rbp + 0x40], rax
cmp rax, r15
jne 0x7ff4b419f6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, r15d
cmovle edi, eax
cmp edi, r15d
cmovge edi, r14d
jmp 0x7ff4b41a04b
cmp r13, r15
je 0x7ff4b419f9c
mov eax, 0x7fffffff
mov rdx, r13
mov edi, r15d
mov rcx, rax
cmp word [rdx], r15w
je 0x7ff4b419f8d
add rdx, 2
sub rcx, 1
jne 0x7ff4b419f7d
cmp rcx, r15
jne 0x7ff4b419f97
mov rax, r15
jmp 0x7ff4b419fa4
sub rax, rcx
jmp 0x7ff4b419fa9
mov rax, qword [rsp + 0x88]
mov edi, 0x80070057
cmp edi, r15d
cmovl rax, r15
cmp edi, r15d
jl 0x7ff4b41a04b
lea rcx, [rax + rax + 2]
mov edx, ecx
and edx, 0xf
je 0x7ff4b419fcf
mov eax, 0x10
sub eax, edx
add rcx, rax
mov eax, ebx
cmp rax, rcx
jbe 0x7ff4b41a04b
lea rsi, [rcx + r13]
sub ebx, ecx
cmp ebx, 0x10
jbe 0x7ff4b41a041
mov r8b, byte [rsi + 8]
mov edx, dword [rsi + 4]
mov rcx, rbp
mov r14, rsi
call fcn.7ff4b4197cc
mov r12, rax
cmp rax, r15
je 0x7ff4b41a03c
add ebx, 0xfffffff0
add rsi, 0x10
cmp dword [r14], ebx
jbe 0x7ff4b41a00e
mov edi, 0x8000ffff
jmp 0x7ff4b41a02b
mov edx, dword [r14]
mov r8, rsi
mov rcx, rax
call fcn.7ff4b41da0c
cmp eax, r15d
mov edi, eax
jl 0x7ff4b41a02b
mov ecx, dword [r14]
add rsi, rcx
sub ebx, ecx
mov rdx, qword [r12]
mov rcx, r12
call qword [rdx + 0x10]
cmp edi, r15d
jl 0x7ff4b41a041
jmp 0x7ff4b419fdc
mov edi, 0x8000ffff
movabs r12, 0x4000000000000000
mov rcx, r13
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp edi, r15d
jge 0x7ff4b41a0d5
mov rcx, qword [rbp + 0x18]
lea rdx, [rsp + 0x88]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, r15d
jl 0x7ff4b41a0c3
mov esi, r15d
cmp dword [rsp + 0x88], r15d
jbe 0x7ff4b41a0c3
mov rcx, qword [rbp + 0x18]
lea r8, [rsp + 0x90]
mov edx, esi
call fcn.7ff4b41ca64
cmp eax, r15d
jl 0x7ff4b41a0b8
mov rbx, qword [rsp + 0x90]
xor r8d, r8d
mov rax, qword [rbx + 0x30]
mov rcx, rbx
mov edx, dword [rax + 0x10]
call fcn.7ff4b41d278
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
inc esi
cmp esi, dword [rsp + 0x88]
jb 0x7ff4b41a07c
mov rcx, qword [rbp + 0x40]
cmp rcx, r15
je 0x7ff4b41a0d5
call sub.wevtapi.dll_EvtClose
mov qword [rbp + 0x40], r15
mov r8d, dword [0x7ff4b426e6c]
cmp r8d, r15d
je 0x7ff4b41a181
mov dl, byte [0x7ff4b426e70]
cmp dl, 4
jae 0x7ff4b41a0f5
cmp dl, r15b
jne 0x7ff4b41a130
test qword [0x7ff4b426e58], r12
je 0x7ff4b41a130
mov rcx, qword [0x7ff4b426e60]
mov rax, rcx
and rax, r12
cmp rax, rcx
jne 0x7ff4b41a137
mov rcx, qword [0x7ff4b426e40]
lea rdx, [0x7ff4b405c90]
call fcn.7ff4b4123dc
mov dl, byte [0x7ff4b426e70]
mov r8d, dword [0x7ff4b426e6c]
mov rcx, qword [0x7ff4b426e60]
cmp r8d, r15d
je 0x7ff4b41a181
cmp dl, 4
jae 0x7ff4b41a146
cmp dl, r15b
jne 0x7ff4b41a181
movabs rdx, 0x8000000000000000
test qword [0x7ff4b426e58], rdx
je 0x7ff4b41a181
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x7ff4b41a181
mov r8, qword [rbp + 0x10]
mov rcx, qword [0x7ff4b426e40]
lea rdx, [0x7ff4b405b90]
mov r8, qword [r8]
mov r9d, edi
call fcn.7ff4b410520
mov eax, edi
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret