Function at 0x14004eb60
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov rax, qword [0x1400d2478]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r15, rdx
mov rsi, rcx
mov r12b, 1
mov r8, rdx
mov edx, 0x105
call fcn.140065de0
mov qword [rsp + 0x70], 7
xor ebx, ebx
mov qword [rsp + 0x68], rbx
mov word [rsp + 0x58], bx
lea r8d, [rbx + 0x21]
lea rdx, str.SYSTEMCurrentControlSetServices
lea rcx, [rsp + 0x50]
call fcn.140001870
nop
lea r8d, [rbx + 1]
mov rbp, qword [rsp + 0x68]
test rbp, rbp
je 0x14004ec89
test rbp, rbp
je 0x14004ec78
cmp rbp, 0xffffffffffffffff
jbe 0x14004ebf7
or rcx, 0xffffffffffffffff
jmp 0x14004ebfb
lea rcx, [rbp - 1]
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rax, qword [rsp + 0x58]
lea rdi, [rax + rcx*2]
mov rcx, r8
lea rax, [0x1400ad338]
movzx edx, word [rdi]
nop dword [rax]
cmp word [rax], dx
je 0x14004ec4a
add rax, 2
sub rcx, 1
jne 0x14004ec20
lea rcx, [rsp + 0x50]
call fcn.1400016d0
cmp rdi, rax
je 0x14004ec72
sub rdi, 2
mov r8d, 1
jmp 0x14004ec10
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rax, qword [rsp + 0x58]
sub rdi, rax
sar rdi, 1
cmp rdi, 0xffffffffffffffff
je 0x14004ec78
lea rax, [rdi + 1]
cmp rbp, rax
je 0x14004ec89
jmp 0x14004ec78
mov r8d, 1
lea rdx, [0x1400ad338]
lea rcx, [rsp + 0x50]
call fcn.14000a130
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r15
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r15
lea rcx, [rsp + 0x50]
call fcn.14000a130
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
mov dword [rsp + 0x30], 0x20a
lea rdi, [rsi + 0x20a]
mov byte [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, rdi
lea r8, str.DisplayName
mov rcx, 0xffffffff80000002
call fcn.140033230
test eax, eax
je 0x14004ed02
mov r8, r15
mov edx, 0x105
mov rcx, rdi
call fcn.140065de0
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
mov dword [rsp + 0x30], 0x20a
lea r9, [rsi + 0x414]
mov byte [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, str.ImagePath
mov rcx, 0xffffffff80000002
call fcn.140033230
test eax, eax
je 0x14004ed4d
xor r12b, r12b
jmp 0x14004ed93
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
mov dword [rsp + 0x30], 0x20a
lea r9, [rsi + 0x61e]
mov byte [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, str.DependOnGroup
mov rcx, 0xffffffff80000002
call fcn.140033230
test eax, eax
je 0x14004eda7
mov word [rsi + 0x61e], bx
mov word [rsi + 0x620], bx
cmp r12b, 1
jne 0x14004eded
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
mov dword [rsp + 0x30], 0x20a
lea r9, [rsi + 0x828]
mov byte [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, str.DependOnService
mov rcx, 0xffffffff80000002
call fcn.140033230
test eax, eax
je 0x14004ee05
mov word [rsi + 0x828], bx
mov word [rsi + 0x82a], bx
cmp r12b, 1
jne 0x14004efc9
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
xor dil, dil
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004efc9
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x30], 4
lea rax, [rsi + 0xa3c]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx edi, dil
test eax, eax
mov ebp, 1
cmove edi, ebp
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dil, bpl
jne 0x14004efc9
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
xor dil, dil
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004efc9
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x38], 4
lea rax, [rsi + 0xa38]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx edi, dil
test eax, eax
cmove edi, ebp
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dil, bpl
jne 0x14004efc9
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
xor dil, dil
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004efc9
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x38], 4
lea rax, [rsi + 0xa34]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
cmove edi, ebp
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dil, bpl
je 0x14004efce
mov ebx, 0x643
cmp qword [rsp + 0x70], 8
jb 0x14004efe4
mov rcx, qword [rsp + 0x58]
call fcn.140065920
mov eax, ebx
jmp 0x14004efe6
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140064b70
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret