Function at 0x140087650
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x14010bcf8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r15, rdx
mov qword [rbp - 0x11], 0
mov rdx, rcx
lea rax, [rbp - 0x11]
mov rsi, r8
mov qword [rsp + 0x20], rax
mov rbx, rcx
mov r9d, 0x20019
mov rcx, 0xffffffff80000002
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test eax, eax
je 0x1400876ea
mov ecx, eax
call fcn.140086b90
mov qword [rsp + 0x30], rax
lea r9, [0x1400dd6e0]
mov r8d, 0x46
mov dword [rsp + 0x28], edi
lea rax, [0x1400dd6c0]
lea rdx, [0x1400dd6f8]
mov qword [rsp + 0x20], rax
lea ecx, [r8 - 0x42]
call fcn.140082160
xor al, al
jmp 0x1400879dd
mov rcx, qword [rbp - 0x11]
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x19]
xorps xmm0, xmm0
mov qword [rsp + 0xd8], r14
lea rax, [rbp + 0xf]
mov dword [rbp - 9], 0x1f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x1400dd728]
mov dword [rbp - 0x19], 0
xor r14b, r14b
movups xmmword [rbp + 0xf], xmm0
movups xmmword [rbp + 0x1f], xmm0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test eax, eax
je 0x1400877a8
cmp eax, 0xea
jne 0x140087783
mov ecx, eax
call fcn.140086b90
mov qword [rsp + 0x30], rax
lea r9, [0x1400dd6e0]
mov r8d, 0x59
mov dword [rsp + 0x28], edi
lea rax, [0x1400dd740]
lea rdx, [0x1400dd6f8]
mov qword [rsp + 0x20], rax
lea ecx, [r8 - 0x55]
call fcn.140082160
jmp 0x1400879a6
mov ecx, edi
call fcn.140086b90
mov r9d, edi
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [0x1400dd7a0]
xor ecx, ecx
call fcn.140082080
jmp 0x1400879a6
cmp dword [rbp - 0x19], 1
je 0x1400877c4
mov r8, rbx
lea rdx, [0x1400dd7f0]
xor ecx, ecx
call fcn.140082080
jmp 0x1400879a6
mov rcx, r15
call fcn.1400ba110
mov rcx, rax
call fcn.1400ba38c
lea rcx, [rbp + 0xf]
mov rdi, rax
call fcn.1400ba38c
mov rcx, rax
mov rdx, rdi
call fcn.1400b1b38
test rax, rax
jne 0x14008782f
mov r8d, WSAStartup
lea rax, [rbp + 0xf]
mov qword [rsp + 0x28], rax
lea r9, [0x1400dd6e0]
lea rax, [0x1400dd840]
lea rdx, [0x1400dd6f8]
mov qword [rsp + 0x20], rax
lea ecx, [r8 - 0x6d]
call fcn.140082160
mov rcx, rdi
call fcn.1400b8268
jmp 0x1400879a6
mov rcx, rdi
call fcn.1400b8268
mov rcx, qword [rbp - 0x11]
lea rax, [rbp - 5]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x19]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, [0x1400dd878]
mov dword [rbp - 5], 0x27
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test eax, eax
je 0x14008788f
mov ecx, eax
call fcn.140086b90
mov r9d, edi
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [0x1400dd890]
xor ecx, ecx
call fcn.140082080
jmp 0x1400879a6
cmp dword [rbp - 0x19], 1
je 0x1400878ab
mov r8, rbx
lea rdx, [0x1400dd8e0]
xor ecx, ecx
call fcn.140082080
jmp 0x1400879a6
lea rcx, [rbp - 1]
mov dword [rbp - 1], 0x100
mov qword [rsp + 0x28], rcx
lea rax, [rsi + 0x27]
mov rcx, qword [rbp - 0x11]
lea r9, [rbp - 0x19]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x1400dd930]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test eax, eax
je 0x140087907
mov ecx, eax
call fcn.140086b90
mov r9d, edi
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [0x1400dd950]
xor ecx, ecx
call fcn.140082080
jmp 0x1400879a6
cmp dword [rbp - 0x19], 1
mov r8, rbx
je 0x140087923
lea rdx, [0x1400dd9a0]
xor ecx, ecx
call fcn.140082080
jmp 0x1400879a6
lea r9, [rbp + 0xf]
mov qword [rsp + 0x20], rsi
lea rdx, [0x1400dd9f0]
mov ecx, 3
call fcn.140082080
lea rcx, [rbp + 3]
mov dword [rbp + 3], 4
mov qword [rsp + 0x28], rcx
lea rax, [rsi + 0x128]
mov rcx, qword [rbp - 0x11]
lea rdx, [0x1400dda58]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov r14b, 1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea rcx, [rbp + 7]
mov dword [rbp + 7], 4
mov qword [rsp + 0x28], rcx
lea rax, [rsi + 0x12c]
mov rcx, qword [rbp - 0x11]
lea rdx, [0x1400dda68]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
test eax, eax
je 0x1400879d1
mov ecx, eax
call fcn.140086b90
mov r9, rax
lea rdx, [0x1400dda70]
mov r8d, ebx
xor ecx, ecx
call fcn.140082080
movzx eax, r14b
mov r14, qword [rsp + 0xd8]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400b06c0
add rsp, 0x90
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret