Function at 0x180014b3c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1800c9088]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor r15d, r15d
lea rax, [rsp + 0x48]
mov rsi, r9
mov dword [rsp + 0x38], r15d
mov rdi, r8
mov dword [rsp + 0x3c], r15d
mov r14, rdx
mov dword [rsp + 0x34], r15d
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, str.SYSTEMCurrentControlSetControlWmiGlobalLogger
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180014df8
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.Start
lea rax, [rsp + 0x34]
mov dword [rsp + 0x30], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180014ded
cmp dword [rsp + 0x34], r15d
je 0x180014ded
mov ecx, dword [rbx]
lea edx, [rax + 7]
lea r10, str.0123456789abcdef
mov eax, ecx
shr ecx, 4
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rbp + rdx*2 - 0x30], ax
sub rdx, 1
jns 0x180014c02
movzx edx, word [rbx + 4]
mov r9d, 0x2d
mov word [rbp - 0x20], r9w
lea ecx, [r9 - 0x2a]
mov r8d, ecx
mov eax, edx
shr edx, 4
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rbp + r8*2 - 0x1e], ax
sub r8, 1
jns 0x180014c30
movzx edx, word [rbx + 6]
mov word [rbp - 0x16], r9w
mov eax, edx
shr edx, 4
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rbp + rcx*2 - 0x14], ax
sub rcx, 1
jns 0x180014c52
movzx ecx, byte [rbx + 8]
mov edx, 2
mov eax, ecx
mov word [rbp - 0xc], r9w
shr rax, 4
and ecx, 0xf
mov word [rbp - 2], r9w
movzx eax, word [r10 + rax*2]
mov word [rbp - 0xa], ax
movzx eax, word [r10 + rcx*2]
movzx ecx, byte [rbx + 9]
mov word [rbp - 8], ax
mov eax, ecx
shr rax, 4
and ecx, 0xf
movzx eax, word [r10 + rax*2]
mov word [rbp - 6], ax
movzx eax, word [r10 + rcx*2]
mov word [rbp - 4], ax
movzx ecx, byte [rbx + rdx + 8]
mov eax, ecx
and ecx, 0xf
shr rax, 4
movzx eax, word [r10 + rax*2]
mov word [rbp + rdx*4 - 8], ax
movzx eax, word [r10 + rcx*2]
mov word [rbp + rdx*4 - 6], ax
inc rdx
cmp rdx, 8
jl 0x180014cb7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov word [rbp + 0x18], r15w
lea rdx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180014ded
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.Flags
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.Level
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x30], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x34], 1
jne 0x180014de2
mov ebx, 0x78
lea rcx, [rsp + 0x50]
mov r8d, ebx
xor edx, edx
call fcn.1800485d0
xor r9d, r9d
mov dword [rsp + 0x50], ebx
lea r8, [rsp + 0x50]
mov dword [rsp + 0x7c], 0x20000
lea rdx, str.GlobalLogger
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_ControlTraceW]
test eax, eax
je 0x180014dc5
cmp eax, 0xea
mov rax, r15
jne 0x180014dca
mov rax, qword [rsp + 0x58]
mov qword [r14], rax
test rax, rax
je 0x180014de2
mov eax, dword [rsp + 0x38]
btr eax, 0x1f
mov dword [rdi], eax
mov al, byte [rsp + 0x3c]
mov byte [rsi], al
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.180045d30
mov rbx, qword [rsp + 0x160]
add rsp, 0x130
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret