Function at 0x1400a5c30
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov dword [r11 + 0x10], 0
lea rax, [r11 - 0x48]
mov qword [r11 + 8], rax
call fcn.14012a060
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400a5c72
mov ecx, 0x80004005
call fcn.140002cb0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, str.DTSSpkMode
or rsi, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x1400a5cb9
movzx edi, dx
mov ecx, edi
call fcn.140138f84
test rax, rax
je 0x1400a5cd6
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140004c30
jmp 0x1400a5cd6
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x30]
call fcn.140003210
nop
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x1400a5d09
cmp rax, qword [rdi - 0x18]
jne 0x1400a5d09
lea rbx, [rdi - 0x18]
lock add dword [rdi - 8], 1
jmp 0x1400a5d47
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x1400a5d25
call fcn.1400b7870
int3
mov eax, dword [rdi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rbx + 0x18]
call fcn.140144ee0
add rbx, 0x18
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SOFTWAREDTSU2PPresets
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400a5e46
mov rdi, qword [rsp + 0x38]
mov dword [rsp + 0x90], 4
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x98]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a5e1b
cmp dword [rsp + 0x98], 4
jne 0x1400a5e1b
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x88], eax
test rdi, rdi
je 0x1400a5dfe
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400a5e62
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400a5e62
test rdi, rdi
je 0x1400a5e29
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400a5e62
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400a5e62
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400a5e62
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x1400a5e80
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret