Function at 0x7ff74af3050
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, qword [rsp + 0xa0]
xor ebx, ebx
lea rax, [r11 + 0x20]
mov qword [r11 - 0x48], rax
mov r15d, r9d
mov r14d, r9d
lea rax, [r11 - 0x38]
mov qword [r11 - 0x50], rbx
lea r9d, [rbx + 0x23]
mov rbp, r8
mov r12, rdx
mov rsi, rcx
mov qword [r11 - 0x58], rax
mov rdi, rbx
and r14d, 1
and r15d, 2
mov dword [rsp + 0x40], ebx
mov dword [r11 + 0x20], ebx
mov qword [r13], rbx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
cmp eax, ebx
je 0x7ff74af30f8
mov esi, eax
or esi, 0x80070000
cmp eax, 2
jne 0x7ff74b19ad4
cmp rdi, rbx
jne 0x7ff74b19b28
mov eax, esi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, dword [rsp + 0x98]
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
inc eax
and eax, 0xfffffffe
mov r8d, eax
mov dword [rsp + 0x98], eax
call qword [0x7ff74b58358]
mov rdi, rax
cmp rax, rbx
je 0x7ff74b199e0
mov r8d, dword [rsp + 0x98]
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x98]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], r11
mov r9d, 0x23
mov r8, rbp
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
cmp eax, ebx
jne 0x7ff74af30be
mov ecx, dword [rsp + 0x98]
mov r8d, dword [rsp + 0x40]
mov rsi, rdi
shr ecx, 1
mov r11d, 1
cmp r8d, ebx
je 0x7ff74b199ea
cmp r8d, r11d
jne 0x7ff74b0a62c
or edx, 0xffffffff
mov r10d, ebx
cmp ecx, r11d
jb 0x7ff74af31c0
lea rax, [rdi + rcx*2 - 2]
cmp word [rax], bx
jne 0x7ff74af31c0
add ecx, edx
sub rax, 2
mov r10d, r11d
cmp ecx, r11d
jae 0x7ff74af31ad
cmp r14d, ebx
jne 0x7ff74af31eb
movsxd rax, ecx
cmp ecx, r11d
jb 0x7ff74af31eb
lea rax, [rdi + rax*2 - 2]
cmp word [rax], 0x20
je 0x7ff74b19a4f
cmp ecx, r11d
jb 0x7ff74af31eb
cmp word [rsi], 0x20
je 0x7ff74b19a66
cmp ecx, ebx
je 0x7ff74af9561
cmp r15d, ebx
je 0x7ff74afa419
mov word [rsi + rcx*2], bx
add ecx, r11d
cmp r14d, ebx
jne 0x7ff74b0a644
cmp r10d, r11d
jne 0x7ff74b19acb
mov r12d, ecx
mov rcx, 0xffffffffffffffff
mov eax, 2
mul r12
cmovo rax, rcx
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
mov r8, rax
call qword [0x7ff74b58358]
mov rbp, rax
cmp rax, rbx
je 0x7ff74b19ac1
lea r8, [r12 + r12]
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
mov qword [r13], rbp
call qword [case.0x7ff74b3e5fd.0]
jmp 0x7ff74af3270
xor eax, eax
jmp 0x7ff74af30da
lea rax, [0x7ff74b4f658]
mov qword [r13], rax
jmp 0x7ff74af956e
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov eax, ebx
jmp 0x7ff74af30da
lea r9, [0x7ff74b4f310]
mov rax, rsi
sub r9, rsi
movzx edx, word [rax]
movzx r8d, word [rax + r9]
sub edx, r8d
je 0x7ff74b06a1c
cmp edx, ebx
jne 0x7ff74af31fc
jmp 0x7ff74b19a74
add rax, 2
test r8d, r8d
jne 0x7ff74afa426
jmp 0x7ff74afa437
cmp r8d, 7
jne 0x7ff74b199fe
cmp r14d, ebx
jne 0x7ff74af319d
jmp 0x7ff74b199fe
mov word [rsi + rcx*2], bx
add ecx, r11d
jmp 0x7ff74af320c
mov eax, 0x8007000e
jmp 0x7ff74af30da
mov r8d, r11d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x98], ebx
jmp 0x7ff74af3194
cmp dword [0x7ff74b582c8], ebx
je 0x7ff74b19ab7
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74b19ab7
test byte [rcx + 0x1c], r11b
je 0x7ff74b19ab7
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], r8d
lea r8, [0x7ff74b518d8]
mov edx, 0xb
mov r9, r12
mov qword [rsp + 0x20], rbp
call fcn.7ff74b2ddbc
jmp 0x7ff74b19ab7
add ecx, edx
sub rax, 2
mov r10d, r11d
cmp ecx, r11d
jae 0x7ff74af31d2
jmp 0x7ff74af31dc
add ecx, edx
mov r10d, r11d
add rsi, 2
jmp 0x7ff74af31dc
cmp dword [0x7ff74b582c8], ebx
je 0x7ff74b19ab7
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74b19ab7
test byte [rcx + 0x1c], r11b
je 0x7ff74b19ab7
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b518d8]
mov edx, 0xc
mov r9, r12
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbp
call fcn.7ff74b2ee18
mov ebx, 0x80040153
jmp 0x7ff74af956e
mov ebx, 0x8007000e
jmp 0x7ff74af956e
mov qword [r13], rdi
jmp 0x7ff74af3270
cmp dword [0x7ff74b582c8], ebx
je 0x7ff74af30cf
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74af30cf
test byte [rcx + 0x1c], 1
je 0x7ff74af30cf
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b518d8]
mov edx, 0xa
mov r9, r12
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbp
call fcn.7ff74b2ddbc
nop
jmp 0x7ff74af30cf
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
nop
jmp 0x7ff74af30d8