Function at 0x140096af0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xb8
mov r15, r8
mov r12, rdx
mov r14, rcx
lea rbx, section..data
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x140096b57
test byte [rcx + 0x1c], 1
je 0x140096b57
cmp byte [rcx + 0x19], 5
jb 0x140096b57
mov eax, dword [r8 + 0x10]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.14009a0e4
and qword [rbp - 0x71], 0
and dword [rbp - 0x69], 0
and dword [rbp - 0x65], 0
lea rdx, [rbp - 0x71]
mov rcx, r14
call fcn.140097c28
mov edi, eax
mov r10, qword [section..data]
cmp r10, rbx
je 0x140096bab
test byte [r10 + 0x1c], 2
je 0x140096bab
cmp byte [r10 + 0x19], 4
jb 0x140096bab
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400bd8b8]
mov rcx, qword [r10 + 0x10]
call fcn.14000ad20
mov r10, qword [section..data]
and qword [rbp - 0x59], 0
and dword [rbp - 0x51], 0
and dword [rbp - 0x4d], 0
test edi, edi
jne 0x140096cf7
mov rax, qword [r14]
movabs r10, 0x8ba916ea3852e270
mov rcx, r14
mov rax, qword [rax + 0x58]
call qword [case.0x140071786.0]
test rax, rax
je 0x140096dc4
xor ebx, ebx
mov qword [rbp - 9], rbx
xor esi, esi
mov qword [rbp - 1], rsi
mov qword [rbp + 7], rsi
mov rax, qword [r14]
movabs r10, 0x8ba916ea3852e270
mov rcx, r14
mov rax, qword [rax + 0x58]
call qword [case.0x140071786.0]
mov qword [rbp - 0x31], rsi
lea rcx, [rbp - 0x31]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140096c49
mov edi, esi
mov rbx, qword [rbp - 0x31]
mov qword [rbp - 9], rbx
mov r10, qword [section..data]
lea r13, section..data
cmp r10, r13
je 0x140096c89
test byte [r10 + 0x1c], 2
je 0x140096c89
cmp byte [r10 + 0x19], 4
jb 0x140096c89
mov edx, SysStringByteLen
mov r9d, edi
lea r8, [0x1400bd8b8]
mov rcx, qword [r10 + 0x10]
call fcn.14000ad20
mov r10, qword [section..data]
test edi, edi
jne 0x140096cd5
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 9]
call fcn.14009154c
mov edi, eax
mov r10, qword [section..data]
cmp r10, r13
je 0x140096cd5
test byte [r10 + 0x1c], 2
je 0x140096cd5
cmp byte [r10 + 0x19], 4
jb 0x140096cd5
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400bd8b8]
mov rcx, qword [r10 + 0x10]
call fcn.14000ad20
mov r10, qword [section..data]
test rbx, rbx
je 0x140096cf0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov r10, qword [section..data]
lea rbx, section..data
xor esi, esi
cmp dword [rbp - 0x69], esi
jle 0x1400972ad
xor r13d, r13d
and dword [rbp + 0x77], 0
test esi, esi
js 0x1400973b5
cmp esi, dword [rbp - 0x69]
jge 0x1400973b5
lea r8, [rbp + 0x77]
mov rdx, qword [rbp - 0x71]
mov rdx, qword [rdx + r13*8]
mov rcx, r14
call fcn.140098394
mov edi, eax
mov r10, qword [section..data]
cmp r10, rbx
je 0x140096d69
test byte [r10 + 0x1c], 2
je 0x140096d69
cmp byte [r10 + 0x19], 4
jb 0x140096d69
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400bd8b8]
mov rcx, qword [r10 + 0x10]
call fcn.14000ad20
mov r10, qword [section..data]
test edi, edi
jne 0x140096dd0
cmp dword [rbp + 0x77], 1
jne 0x140096dd0
cmp r10, rbx
je 0x14009729f
test byte [r10 + 0x1c], 2
je 0x14009729f
cmp byte [r10 + 0x19], 4
jb 0x14009729f
cmp esi, dword [rbp - 0x69]
jge 0x1400973c0
mov edx, reloc.OLEAUT32.dll_SysStringByteLen
mov rax, qword [rbp - 0x71]
mov r9, qword [rax + r13*8]
lea r8, [0x1400bd8b8]
mov rcx, qword [r10 + 0x10]
call fcn.1400062dc
mov r10, qword [section..data]
jmp 0x14009729f
mov r10, qword [section..data]
jmp 0x140096cf7
and dword [rbp - 0x61], 0
cmp esi, dword [rbp - 0x69]
jge 0x1400973aa
lea r9, [rbp - 0x61]
lea r8, str.DefaultAuthorization
mov rdx, qword [rbp - 0x71]
mov rdx, qword [rdx + r13*8]
mov rcx, r14
call fcn.14009866c
test eax, eax
jne 0x140096e3b
cmp dword [rbp - 0x61], 1
jne 0x140096e3b
mov r10, qword [section..data]
cmp r10, rbx
je 0x14009729f
test byte [r10 + 0x1c], 2
je 0x14009729f
cmp byte [r10 + 0x19], 4
jb 0x14009729f
cmp esi, dword [rbp - 0x69]
jge 0x1400973cb
mov edx, 0x95
jmp 0x140096da0
cmp esi, dword [rbp - 0x69]
jge 0x14009742e
mov rbx, qword [rbp - 0x71]
xor r8d, r8d
xor r10d, r10d
cmp dword [r12 + 8], r8d
jle 0x140096ea5
movsxd r11, dword [r12 + 8]
mov r9, qword [r12]
cmp qword [rbx + r13*8], 0
je 0x1400973d6
mov rax, qword [r9]
mov rdx, qword [rbx + r13*8]
sub rdx, rax
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140096e89
add rax, 2
test cx, cx
jne 0x140096e73
xor eax, eax
jmp 0x140096e8e
sbb eax, eax
or eax, 1
test eax, eax
je 0x140096f18
inc r8d
inc r10
add r9, 8
cmp r10, r11
jl 0x140096e5e
cmp qword [r15 + 0x10], 0
je 0x140097051
mov rax, qword [0x1400cce40]
movabs r10, 0xb1a8ae8f5a5da170
lea rcx, [0x1400cce40]
mov rax, qword [rax + 0x18]
call qword [case.0x140071786.0]
add rax, 0x18
mov qword [rbp - 0x41], rax
cmp esi, dword [rbp - 0x69]
jge 0x1400973ec
lea r9, [rbp - 0x41]
lea r8, str.NetworkInterface
mov rdx, qword [rbp - 0x71]
mov rdx, qword [rdx + r13*8]
mov rcx, r14
call fcn.140098878
mov rcx, qword [rbp - 0x41]
test eax, eax
jne 0x140097026
cmp dword [rcx - 0x10], eax
je 0x140097026
mov rax, qword [r15]
jmp 0x140096f92
cmp r8d, 0xffffffff
je 0x140096ea5
mov r10, qword [section..data]
lea rax, section..data
cmp r10, rax
je 0x140097298
test byte [r10 + 0x1c], 2
je 0x140097298
cmp byte [r10 + 0x19], 4
jb 0x140097298
mov edx, 0x96
mov r9, qword [rbx + r13*8]
lea r8, [0x1400bd8b8]
mov rcx, qword [r10 + 0x10]
call fcn.1400062dc
jmp 0x140097291
mov rdx, qword [rax + 0x10]
mov r10, rcx
sub r10, rdx
movzx r8d, word [rdx]
movzx r9d, word [rdx + r10]
sub r8d, r9d
jne 0x140096f8a
add rdx, 2
test r9d, r9d
jne 0x140096f73
test r8d, r8d
je 0x140096f99
mov rax, qword [rax]
test rax, rax
jne 0x140096f69
jmp 0x140096fa2
test rax, rax
jne 0x140097026
mov r10, qword [section..data]
lea rbx, section..data
cmp r10, rbx
je 0x140096ff2
test byte [r10 + 0x1c], 2
je 0x140096ff2
cmp byte [r10 + 0x19], 4
jb 0x140096ff2
cmp esi, dword [rbp - 0x69]
jge 0x1400973e1
mov rax, qword [rbp - 0x71]
mov edx, 0x97
mov qword [rsp + 0x20], rcx
mov r9, qword [rax + r13*8]
lea r8, [0x1400bd8b8]
mov rcx, qword [r10 + 0x10]
call fcn.140019374
mov rcx, qword [rbp - 0x41]
lea rdx, [rcx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140096db8
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
jmp 0x140096db8
lea rdx, [rcx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140097051
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
xor r15d, r15d
xor r12d, r12d
cmp dword [rbp - 0x51], r12d
jle 0x140097253
xor r14d, r14d
mov qword [rbp - 0x21], r14
and qword [rbp - 0x19], r14
and qword [rbp - 0x11], r14
mov rcx, qword [rbp + 0x5f]
mov rax, qword [rcx]
movabs r10, 0x8ba916ea3852e270
mov rax, qword [rax + 0x58]
call qword [case.0x140071786.0]
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.140005058
lea r8d, [r14 + 1]
lea rdx, [0x1400b2160]
lea rcx, [rbp - 0x39]
call fcn.14000543c
test r12, r12
js 0x14009740d
cmp r15d, dword [rbp - 0x51]
jge 0x14009740d
mov rax, qword [rbp - 0x59]
mov rdx, qword [rax + r12*8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x39]
call fcn.14000543c
and qword [rbp - 0x29], r14
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rbx, qword [rbp - 0x39]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140097111
mov r14, qword [rbp - 0x29]
mov qword [rbp - 0x21], r14
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140097148
test byte [rcx + 0x1c], 2
je 0x140097148
cmp byte [rcx + 0x19], 4
jb 0x140097148
mov edx, 0x98
mov r9d, edi
lea r8, [0x1400bd8b8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
test edi, edi
jne 0x1400971fe
and dword [rbp - 0x5d], edi
test r13, r13
js 0x140097402
cmp esi, dword [rbp - 0x69]
jge 0x140097402
mov rax, qword [rbp - 0x71]
mov dword [rbp - 0x49], 4
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x5d]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x45]
xor r8d, r8d
mov rdx, qword [rax + r13*8]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x1400971af
mov eax, dword [rbp - 0x45]
sub eax, 4
neg eax
sbb edi, edi
and edi, 0xd
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400971f4
test byte [rcx + 0x1c], 2
je 0x1400971f4
cmp byte [rcx + 0x19], 4
jb 0x1400971f4
mov edx, 0x99
mov r9d, edi
lea r8, [0x1400bd8b8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
mov rcx, qword [section..data]
lea rax, section..data
cmp dword [rbp - 0x5d], 0
jne 0x14009731c
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14009722a
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14009723f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
inc r15d
inc r12
cmp r15d, dword [rbp - 0x51]
jl 0x140097061
mov r14, qword [rbp + 0x5f]
cmp esi, dword [rbp - 0x69]
jge 0x140097423
mov rdx, qword [rbp - 0x71]
mov rdx, qword [rdx + r13*8]
mov rcx, r14
call fcn.140097440
cmp esi, dword [rbp - 0x69]
jge 0x140097418
movsxd rcx, esi
mov rax, qword [rbp - 0x71]
lea rdx, [rax + rcx*8]
mov rcx, qword [rbp + 0x7f]
call fcn.14000c674
mov r12, qword [rbp + 0x67]
mov r15, qword [rbp + 0x6f]
mov r10, qword [section..data]
lea rbx, section..data
inc esi
inc r13
cmp esi, dword [rbp - 0x69]
jl 0x140096d05
cmp r10, rbx
je 0x1400972f2
test byte [r10 + 0x1c], 1
je 0x1400972f2
movzx edx, byte [r10 + 0x19]
mov eax, edi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x1400972f2
mov rax, qword [rbp + 0x7f]
mov eax, dword [rax + 8]
mov edx, 0x9b
mov dword [rsp + 0x20], eax
mov r9d, edi
lea r8, [0x1400bd8b8]
mov rcx, qword [r10 + 0x10]
call fcn.1400192d4
nop
lea rcx, [rbp - 0x59]
call fcn.140015550
nop
lea rcx, [rbp - 0x71]
call fcn.140015550
mov eax, edi
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp rcx, rax
je 0x140097360
test byte [rcx + 0x1c], 2
je 0x140097360
cmp byte [rcx + 0x19], 4
jb 0x140097360
mov rax, qword [rbp - 0x59]
mov r8, qword [rax + r12*8]
cmp esi, dword [rbp - 0x69]
jge 0x1400973f7
mov rax, qword [rbp - 0x71]
mov edx, 0x9a
mov qword [rsp + 0x20], r8
mov r9, qword [rax + r13*8]
lea r8, [0x1400bd8b8]
mov rcx, qword [rcx + 0x10]
call fcn.140019374
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14009738c
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x1400973a1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov r14, qword [rbp + 0x5f]
jmp 0x140097289
mov ecx, 0xc000008c
call fcn.140006108
int3
mov ecx, 0xc000008c
call fcn.140006108
int3
mov ecx, 0xc000008c
call fcn.140006108
int3
mov ecx, 0xc000008c
call fcn.140006108
int3
mov ecx, 0x80004005
call fcn.1400055a0
nop
mov ecx, 0xc000008c
call fcn.140006108
int3
mov ecx, 0xc000008c
call fcn.140006108
nop
mov ecx, 0xc000008c
call fcn.140006108
int3
mov ecx, 0xc000008c
call fcn.140006108
int3
mov ecx, 0xc000008c
call fcn.140006108
nop
mov ecx, 0xc000008c
call fcn.140006108
int3
mov ecx, 0xc000008c
call fcn.140006108
int3
mov ecx, 0xc000008c
call fcn.140006108
int3