Function at 0x140004660
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa40
mov r14, rcx
mov rbp, r8
mov r13, rdx
lea rcx, [rsp + 0x91]
xor edx, edx
mov r8d, 0x86
mov rbx, r9
mov byte [rsp + 0x90], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x121]
xor edx, edx
mov r8d, 0x108
mov byte [rsp + 0x120], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x231]
xor edx, edx
mov r8d, 0x800
mov byte [rsp + 0x230], 0
call sub.msvcrt.dll_memset
xor r15d, r15d
test rbp, rbp
mov dword [rsp + 0xa80], 0x800
je 0x14000473e
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov rdx, rbx
mov rcx, rbp
mov dword [rsp + 0x60], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000473e
mov eax, dword [rsp + 0x60]
add eax, 0xffffffff
mov byte [rsp + rax + 0x90], r15b
mov r12d, dword [rsp + 0xaa0]
mov rbx, qword [rsp + 0xa90]
cmp r12d, 4
jne 0x1400047b4
lea rax, [rsp + 0xaa0]
lea r9, [rsp + 0xa90]
lea rdx, str.SQLPath
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x120]
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0xaa0], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400047aa
mov eax, dword [rsp + 0xaa0]
add eax, 0xffffffff
mov byte [rsp + rax + 0x120], r15b
lea rsi, [rsp + 0x120]
jmp 0x1400047bc
mov rsi, qword [rsp + 0xaa8]
test rbx, rbx
je 0x1400048b6
mov rdx, qword [rsp + 0xa98]
lea rax, [rsp + 0xa80]
lea r9, [rsp + 0xaa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x230]
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0xa80], 0x800
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, r15d
mov ecx, 1
test eax, eax
mov byte [rsp + 0x70], r15b
cmove edi, ecx
xor eax, eax
cmp dword [rsp + 0xa80], 0x34
mov qword [rsp + 0x71], rax
mov dword [rsp + 0x79], eax
mov word [rsp + 0x7d], ax
mov byte [rsp + 0x7f], al
jb 0x1400048b2
lea r8d, [rcx + 0xe]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x264]
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1400048b2
mov rdx, qword [rsp + 0xab8]
lea rax, [rsp + 0xa80]
lea r9, [rsp + 0xaa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x230]
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0xa80], 0x800
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400048b2
lea edi, [rax + 4]
mov byte [rsp + 0xa30], r15b
mov byte [rsp + 0xa2f], r15b
mov byte [rsp + 0xa2e], r15b
jmp 0x1400048c5
test edi, edi
jne 0x1400048be
mov dword [rsp + 0xa80], r15d
mov edi, dword [rsp + 0xac0]
xor eax, eax
test rbx, rbx
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x6c], eax
je 0x1400048da
mov rcx, rbx
jmp 0x1400048e2
test rbp, rbp
je 0x14000491d
mov rcx, rbp
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
xor edx, edx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov rax, qword [rsp + 0xac8]
lea r9, [rsp + 0x230]
lea r8, [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], edi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xab0]
mov rdx, r13
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xa80]
mov qword [rsp + 0x30], rsi
mov rcx, r14
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], eax
call fcn.140002f30
lea r11, [rsp + 0xa40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret