Function at 0x1400706d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x140430528]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
lea rax, [rsp + 0x60]
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x70]
xor edi, edi
mov qword [rsp + 0x20], rax
mov r8d, 0x20019
mov qword [rsp + 0x60], rdi
call fcn.140070d90
mov esi, eax
test eax, eax
jne 0x14007093e
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0xc8], rbp
mov rbp, qword [rsp + 0x60]
mov qword [rbx + 0x40], rcx
test rbp, rbp
je 0x14007074c
mov rcx, qword [rbx + 8]
call fcn.1402ff780
mov rcx, qword [rsp + 0x70]
mov qword [rbx + 8], rbp
mov qword [rsp + 0x58], rdi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rdi
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
mov qword [rsp + 0x40], rdi
xor edx, edx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x90], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x1400707c5
mov r8, qword [rbx + 8]
lea rdx, str.Unable_to_query_registry_key_info__key:___s___winError:__d_
mov esi, 3
mov r9d, eax
mov ecx, esi
call fcn.14006e290
mov rbp, rdi
jmp 0x1400708e7
mov edx, dword [rsp + 0x68]
mov rax, 0xffffffffffffffff
add rdx, 2
cmovb rdx, rax
lea ecx, [rax + 2]
call fcn.1402f9040
mov rbp, rax
test rax, rax
jne 0x1400707f0
lea esi, [rax + 6]
jmp 0x1400708e7
mov eax, dword [rsp + 0x68]
xor r9d, r9d
mov rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140070847
mov r9, qword [rbx + 0x10]
lea rdx, str.Unable_to_query_registry_value__parentKey:___s___valueName:___s___winError:__d_
mov r8, qword [rbx + 8]
mov ecx, 3
mov dword [rsp + 0x20], eax
call fcn.14006e290
mov esi, ntohs
jmp 0x1400708e7
mov r15d, edi
call fcn.140084ec0
mov ecx, 8
mov r12, rax
call fcn.1402ff830
mov r14, rax
test rax, rax
je 0x1400708e2
call fcn.140086660
mov qword [r14], rax
test rax, rax
je 0x14007089b
xor r8d, r8d
mov rdx, r12
mov rcx, rax
call fcn.140085ef0
mov r15d, eax
test eax, eax
je 0x14007089b
mov r8d, dword [rsp + 0x78]
mov rdx, rbp
mov rcx, qword [r14]
call fcn.140085f30
mov rdi, r14
jmp 0x1400708b8
mov rcx, qword [r14]
test rcx, rcx
je 0x1400708a8
call fcn.1400865b0
mov rcx, r14
call fcn.1402ff780
mov r14, rdi
test r15d, r15d
je 0x1400708e2
lea rdx, [rbx + 0x19]
test rdx, rdx
je 0x1400708cc
mov rcx, qword [rdi]
xor r8d, r8d
call fcn.140085d50
mov rcx, r14
call fcn.1402ff780
mov rcx, rbp
mov byte [rbx + 0x18], 1
call fcn.1402ff780
jmp 0x14007091c
mov esi, 3
mov rcx, rbp
call fcn.1402ff780
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x140070902
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbx + 0x40], rdi
mov rcx, qword [rbx + 8]
call fcn.1402ff780
mov rcx, qword [rbx + 0x10]
mov qword [rbx + 8], rdi
call fcn.1402ff780
mov qword [rbx + 0x10], rdi
mov r15, qword [rsp + 0x90]
mov eax, esi
mov r14, qword [rsp + 0x98]
mov r12, qword [rsp + 0xd0]
mov rbp, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1402f09e0
add rsp, 0xa0
pop rdi
pop rsi
pop rbx
ret