Function at 0x140009530
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x58]
sub rsp, 0x158
mov qword [rbp - 0x20], 0xfffffffffffffffe
xor r15d, r15d
mov qword [rbp + 0xb8], r15
mov qword [rbp + 0xb0], r15
lea r8, [rbp + 0xb0]
lea rdx, [rbp + 0xb8]
call fcn.140006de0
xor r14b, r14b
lea rcx, [rsp + 0x30]
call fcn.140005200
nop
or rsi, 0xffffffffffffffff
mov rdi, qword [rbp + 0xb0]
test rdi, rdi
je 0x14000963d
xor edx, edx
mov r8d, 0x80
lea rcx, [rsp + 0x60]
call fcn.140010440
mov dword [rbp + 0xa8], 0x80
mov dword [rbp + 0xa0], r15d
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xa0]
xor r8d, r8d
lea rdx, str.LoggingType
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000963d
lea edx, [rsi + 0x41]
lea rcx, [rsp + 0x60]
call fcn.14001db98
cmp word [rsp + 0x60], r15w
jne 0x14000960f
mov r8d, r15d
jmp 0x14000962b
lea rax, [rsp + 0x60]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140009620
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140005780
mov r14b, 1
mov rbx, qword [rbp + 0xb8]
test rbx, rbx
je 0x1400096ef
test r14b, r14b
jne 0x1400096ef
xor edx, edx
mov r8d, 0x80
lea rcx, [rsp + 0x60]
call fcn.140010440
mov dword [rbp + 0xa8], 0x80
mov dword [rbp + 0xa0], r15d
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xa0]
xor r8d, r8d
lea rdx, str.LoggingType
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400096ef
lea edx, [rax + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14001db98
cmp word [rsp + 0x60], 0
jne 0x1400096c7
mov rsi, r15
jmp 0x1400096da
lea rax, [rsp + 0x60]
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1400096d0
mov r8, rsi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140005780
mov r14b, 1
mov esi, 4
test r14b, r14b
je 0x1400097b5
lea rcx, [rsp + 0x30]
call fcn.140005280
cmp qword [rax], 0
je 0x1400097b5
lea r9d, [rsi + 1]
xor r8d, r8d
lea rdx, str.EVENT
lea rcx, [rsp + 0x30]
call fcn.14000a790
mov esi, r15d
cmp rax, 0xffffffffffffffff
setne sil
mov r9d, 4
xor r8d, r8d
lea rdx, str.FILE
lea rcx, [rsp + 0x30]
call fcn.14000a790
mov r14d, esi
or r14d, 8
cmp rax, 0xffffffffffffffff
cmove r14d, esi
mov r9d, 7
xor r8d, r8d
lea rdx, str.CONSOLE
lea rcx, [rsp + 0x30]
call fcn.14000a790
mov esi, r14d
or esi, 0x10
cmp rax, 0xffffffffffffffff
cmove esi, r14d
mov r9d, 5
xor r8d, r8d
lea rdx, str.DEBUG
lea rcx, [rsp + 0x30]
call fcn.14000a790
mov ecx, esi
or ecx, 2
cmp rax, 0xffffffffffffffff
cmove ecx, esi
mov esi, 4
test ecx, ecx
cmovne esi, ecx
xor edx, edx
lea r8d, [rdx + 0x50]
lea rcx, [rsp + 0x60]
call fcn.140010440
test esi, esi
je 0x14000992c
lea r12, vtable.HP::Shared::ChpLogListenerDebug.0
lea r13, vtable.HP::Shared::ChpLogListenerConsole.0
lea rdi, vtable.HP::Shared::ChpLogListenerEvent.0
test sil, 1
je 0x140009860
and esi, 0xfffffffe
mov ecx, 0x20
call fcn.14000d6dc
mov r14, rax
mov qword [rbp - 0x18], rax
mov rcx, rax
call fcn.140007480
nop
mov qword [r14], rdi
lea rcx, [rbp + 0x28]
call fcn.140005200
nop
lea rcx, [rbp + 8]
call fcn.140005200
nop
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x28]
call fcn.140006b20
lea rcx, [rbp + 8]
call fcn.140005220
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov qword [r14 + 0x18], rax
lea rcx, [rbp + 8]
call fcn.140005230
nop
lea rcx, [rbp + 0x28]
call fcn.140005230
nop
movsxd rax, r15d
mov qword [rsp + rax*8 + 0x60], r14
inc r15d
test sil, 8
je 0x14000988d
and esi, 0xfffffff7
mov ecx, 0x250
call fcn.14000d6dc
mov qword [rbp - 0x10], rax
xor edx, edx
mov rcx, rax
call fcn.140007d60
nop
movsxd rcx, r15d
mov qword [rsp + rcx*8 + 0x60], rax
inc r15d
test sil, 4
je 0x1400098ba
and esi, 0xfffffffb
mov ecx, 0x250
call fcn.14000d6dc
mov qword [rbp - 8], rax
mov dl, 1
mov rcx, rax
call fcn.140007d60
nop
movsxd rcx, r15d
mov qword [rsp + rcx*8 + 0x60], rax
inc r15d
test sil, 2
je 0x1400098eb
and esi, 0xfffffffd
mov ecx, SafeArrayPutElement
call fcn.14000d6dc
mov r14, rax
mov qword [rbp], rax
mov rcx, rax
call fcn.140007480
nop
mov qword [r14], r12
movsxd rcx, r15d
mov qword [rsp + rcx*8 + 0x60], r14
inc r15d
test sil, 0x10
je 0x14000991d
and esi, 0xffffffef
mov ecx, SafeArrayPutElement
call fcn.14000d6dc
mov r14, rax
mov qword [rsp + 0x50], rax
mov rcx, rax
call fcn.140007480
nop
mov qword [r14], r13
movsxd rcx, r15d
mov qword [rsp + rcx*8 + 0x60], r14
inc r15d
test esi, esi
jne 0x1400097e2
mov rdi, qword [rbp + 0xb0]
mov ecx, 0xb0
call fcn.14000d6dc
mov qword [rsp + 0x50], rax
mov r8d, r15d
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140009990
mov rsi, rax
lea rcx, [rsp + 0x30]
call fcn.140005230
nop
test rdi, rdi
je 0x140009968
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test rbx, rbx
je 0x140009976
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rsi
add rsp, 0x158
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret