Function at 0x1400700d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x2c8
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov dword [rsp + 0x44], r9d
mov rdi, r8
mov qword [rsp + 0x50], r8
mov r15, rdx
mov r14, rcx
mov rcx, qword [rsp + 0x320]
mov qword [rsp + 0x60], rcx
mov rax, qword [rsp + 0x338]
mov qword [rsp + 0x68], rax
xor r12d, r12d
mov dword [rsp + 0x4c], r12d
xor esi, esi
cmp dword [r14 + 0x11c], esi
jne 0x140070146
xor eax, eax
jmp 0x1400704b8
xor ebx, ebx
mov dword [rsp + 0x40], ebx
mov eax, dword [rsp + 0x328]
test eax, eax
jne 0x14007015e
mov qword [rsp + 0x60], rbx
jmp 0x1400701bd
test rcx, rcx
je 0x1400701bd
mov rdi, rax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x78], eax
cmp eax, 0x104
ja 0x140070184
lea rsi, [rsp + 0x1a0]
mov qword [rsp + 0x70], rsi
jmp 0x140070199
mov rcx, rax
call fcn.14008c4a0
mov rsi, rax
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x60]
test edi, edi
je 0x1400701b2
mov r8, rdi
mov rdx, rcx
mov rcx, rsi
call fcn.1400c1a10
mov rdi, qword [rsp + 0x50]
jmp 0x1400701bd
mov rax, qword [rcx]
mov qword [rsi], rax
mov rdi, qword [rsp + 0x50]
mov eax, dword [r14 + 0x124]
cmp eax, 2
jne 0x1400702e6
mov qword [rsp + 0x58], rbx
lea rcx, [r14 + 8]
lea rdx, [rsp + 0x90]
nop
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, 1
add rdx, 1
test al, al
jne 0x1400701e0
test r15, r15
je 0x140070231
lea rcx, [rsp + 0x90]
call fcn.1400b3390
lea rdi, [rsp + 0x90]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [r15 + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x140070220
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x90]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400702da
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x44], eax
mov ecx, 3
mov edi, dword [rsp + 0x330]
test edi, edi
cmovne eax, ecx
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x328]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x44]
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400702ca
mov ebx, dword [rsp + 0x328]
mov dword [rsp + 0x40], ebx
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1400702bf
mov dword [rax], ebx
mov r12d, 1
mov dword [rsp + 0x48], r12d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14007045d
mov edi, dword [rsp + 0x330]
jmp 0x14007045d
cmp eax, 1
jne 0x140070479
cmp byte [r14 + 0x10c], bl
je 0x140070479
mov rcx, r14
call fcn.14006ed00
cmp qword [r14 + 0x128], rbx
je 0x14007043d
mov dword [rsp + 0x40], 1
mov rcx, rdi
lea rdx, [rsp + 0x90]
nop
nop
nop
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, 1
add rdx, 1
test al, al
jne 0x140070330
lea rdi, [rsp + 0x90]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [r14 + rcx + 0x10c]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x140070353
mov edi, dword [rsp + 0x330]
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov r9d, dword [rsp + 0x44]
lea r8, [rsp + 0x90]
mov rdx, r15
mov rcx, r14
call fcn.14006fb20
mov ebx, dword [rsp + 0x40]
test ebx, ebx
je 0x140070444
mov ecx, dword [rsp + 0x44]
cmp ecx, 1
jne 0x1400703c0
mov eax, dword [rsp + 0x328]
test eax, eax
jne 0x1400703d6
jmp 0x1400703c7
mov eax, dword [rsp + 0x328]
cmp ebx, eax
jbe 0x1400703d6
test eax, eax
jne 0x140070444
test rsi, rsi
jne 0x140070444
jmp 0x140070430
test rsi, rsi
je 0x140070430
cmp ecx, 1
jne 0x1400703e9
cmp eax, ebx
cmovbe ebx, eax
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov r9d, ecx
mov r8, qword [rsp + 0x50]
mov rdx, r15
mov rcx, r14
call fcn.14006fb20
mov r12d, eax
mov dword [rsp + 0x48], eax
test eax, eax
jne 0x14007042a
xor ebx, ebx
mov dword [rsp + 0x40], ebx
jmp 0x140070444
mov ebx, dword [rsp + 0x40]
jmp 0x140070444
mov r12d, 1
mov dword [rsp + 0x48], r12d
jmp 0x140070444
mov edi, dword [rsp + 0x330]
mov rcx, r14
call fcn.14006f1c0
test r12d, r12d
je 0x140070479
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x14007045d
mov dword [rax], ebx
test r12d, r12d
je 0x140070479
test rsi, rsi
je 0x140070479
test edi, edi
je 0x140070479
mov r8d, ebx
mov rdx, rsi
mov rcx, r14
call fcn.14006e8a0
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x1400704ae
test rsi, rsi
je 0x1400704ae
mov r8d, dword [rsp + 0x4c]
mov rdx, rsi
mov rcx, rax
call fcn.1400c1a10
lea rdx, [rsp + 0x1a0]
cmp rsi, rdx
je 0x1400704ae
mov rcx, rsi
call fcn.14008c4f0
nop
jmp 0x1400704b5
mov eax, r12d
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400c2a20
add rsp, 0x2c8
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret