Function at 0x1400748a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rbp + 0x118], rax
mov qword [rbp + 0xd0], r9
mov r12, r8
mov r13, rdx
mov r15, qword [rbp + 0x180]
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0xc8], rax
mov r14, qword [rbp + 0x190]
xor ebx, ebx
mov qword [rbp + 0xf0], rbx
lea rax, [rsp + 0x50]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
xor r8d, r8d
lea rdx, [0x14041a6b8]
lea rcx, [rsp + 0x50]
call fcn.140031e00
nop
lea rax, [rsp + 0x70]
mov qword [rbp + 0x18], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0xf0]
call fcn.1400ea550
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], rax
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd8], xmm1
mov qword [rbp + 0xe8], rbx
mov rbx, qword [rbp + 0xf0]
mov rax, qword [rbx]
mov rdi, qword [rax + 8]
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x28
lea rdx, [0x140423760]
lea rcx, [rsp + 0x30]
call fcn.140031e00
nop
lea r8, [rbp + 0xd8]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call rdi
nop
lea rcx, [rsp + 0x30]
call fcn.1400166f0
mov rdi, qword [rbp + 0xd8]
mov rsi, qword [rbp + 0xe0]
cmp rdi, rsi
je 0x140074a93
cmp r12, rdi
je 0x140074a02
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x1400749f7
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, r12
call fcn.140031b60
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 3
lea rdx, [0x14041cd38]
lea rcx, [rsp + 0x30]
call fcn.140031e00
nop
lea r8, [rsp + 0x30]
mov rdx, r12
lea rcx, [rbp - 0x70]
call fcn.1400a2f80
nop
mov rdx, rax
mov rcx, qword [rbp + 0xd0]
call fcn.14002eb40
nop
lea rcx, [rbp - 0x70]
call fcn.1400166f0
nop
lea rcx, [rsp + 0x30]
call fcn.1400166f0
mov rsi, qword [rbp + 0xe0]
mov rdi, qword [rbp + 0xd8]
cmp rdi, rsi
je 0x140074a93
mov rcx, rdi
call fcn.1400166f0
add rdi, 0x20
cmp rdi, rsi
jne 0x140074a74
mov rax, qword [rbp + 0xd8]
mov qword [rbp + 0xe0], rax
mov rax, qword [rbx]
mov rdi, qword [rax + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x26
lea rdx, str._PROGRAMDATA_MalwarebytesMBAMService
lea rcx, [rsp + 0x30]
call fcn.140031e00
nop
lea r8, [rbp + 0xd8]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call rdi
nop
lea rcx, [rsp + 0x30]
call fcn.1400166f0
mov rdx, qword [rbp + 0xd8]
cmp rdx, qword [rbp + 0xe0]
je 0x140074b65
cmp r15, rdx
je 0x140074b0a
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140074b02
mov rdx, qword [rdx]
mov rcx, r15
call fcn.140031b60
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 7
lea rdx, str.ctlrpkg
lea rcx, [rsp + 0x30]
call fcn.140031e00
nop
lea r8, [rsp + 0x30]
mov rdx, r15
lea rcx, [rbp - 0x70]
call fcn.1400a2f80
nop
mov rdx, rax
mov rcx, r13
call fcn.14002eb40
nop
lea rcx, [rbp - 0x70]
call fcn.1400166f0
nop
lea rcx, [rsp + 0x30]
call fcn.1400166f0
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x108], xmm1
mov r8d, 0x22
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rbp + 0xf8]
call fcn.140031e00
nop
mov r8d, socket
lea rdx, str.MBAMUpdaterService
lea rcx, [rbp + 0xf8]
call fcn.14002be20
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str.Parameters
lea rcx, [rbp + 0xf8]
call fcn.14002be20
lea rdx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 7
cmova rdx, qword [rbp + 0xf8]
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
je 0x140074c51
lea rdx, str.Failed_to_open_service_registry:
lea rcx, [0x1404b5d00]
call fcn.140034a00
mov edx, edi
mov rcx, rax
call fcn.140047c40
mov rdi, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140035dd0
movzx edx, al
mov rcx, rdi
call fcn.140035860
mov rcx, rdi
call fcn.14002eff0
xor dil, dil
jmp 0x140075046
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8d, 6
lea rdx, [0x140423848]
lea rcx, [rsp + 0x50]
call fcn.140031e00
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str.ProductCode
lea rcx, [rsp + 0x30]
call fcn.140031e00
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0xc0]
lea rcx, [rbp + 0x20]
call fcn.14007dd60
nop
mov rdx, rax
mov rcx, qword [rbp + 0xc8]
call fcn.14002eb40
nop
lea rcx, [rbp + 0x20]
call fcn.1400166f0
nop
lea rcx, [rsp + 0x30]
call fcn.1400166f0
nop
lea rcx, [rsp + 0x50]
call fcn.1400166f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.UpdateDirectory
lea rcx, [rbp - 0x50]
call fcn.140031e00
nop
mov r9, r13
lea r8, [rbp - 0x50]
mov rdx, qword [rbp + 0xc0]
lea rcx, [rbp + 0x40]
call fcn.14007dd60
nop
mov rdx, rax
mov rcx, r13
call fcn.14002eb40
nop
lea rcx, [rbp + 0x40]
call fcn.1400166f0
nop
lea rcx, [rbp - 0x50]
call fcn.1400166f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.ProgramDirectory
lea rcx, [rbp - 0x30]
call fcn.140031e00
nop
mov r9, r12
lea r8, [rbp - 0x30]
mov rdx, qword [rbp + 0xc0]
lea rcx, [rbp + 0x60]
call fcn.14007dd60
nop
mov rdx, rax
mov rcx, r12
call fcn.14002eb40
nop
lea rcx, [rbp + 0x60]
call fcn.1400166f0
nop
lea rcx, [rbp - 0x30]
call fcn.1400166f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
mov r8d, recvfrom
lea rdx, str.LKGDirectory
lea rcx, [rbp - 0x10]
call fcn.140031e00
nop
mov r9, qword [rbp + 0xd0]
lea r8, [rbp - 0x10]
mov rdx, qword [rbp + 0xc0]
lea rcx, [rbp + 0x80]
call fcn.14007dd60
nop
mov rdx, rax
mov rcx, qword [rbp + 0xd0]
call fcn.14002eb40
nop
lea rcx, [rbp + 0x80]
call fcn.1400166f0
nop
lea rcx, [rbp - 0x10]
call fcn.1400166f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.DataDirectory
lea rcx, [rbp - 0x70]
call fcn.140031e00
nop
mov r9, r15
lea r8, [rbp - 0x70]
mov rdx, qword [rbp + 0xc0]
lea rcx, [rbp + 0xa0]
call fcn.14007dd60
nop
mov rdx, rax
mov rcx, r15
call fcn.14002eb40
nop
lea rcx, [rbp + 0xa0]
call fcn.1400166f0
nop
lea rcx, [rbp - 0x70]
call fcn.1400166f0
movzx edi, byte [r14 + 2]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov r8d, 0x1c
lea rdx, str.CurrentProtectedServiceState
lea rcx, [rsp + 0x70]
call fcn.140031e00
nop
xor esi, esi
mov dword [rbp + 0xc8], esi
mov dword [rbp + 0xd0], 4
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rdx, qword [rsp + 0x70]
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140074efe
cmp dword [rbp + 0xc8], 1
sete dil
mov byte [r14 + 2], dil
lea rcx, [rsp + 0x70]
call fcn.1400166f0
movzx edi, byte [r14]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.CurrentSCMStopAccess
lea rcx, [rsp + 0x50]
call fcn.140031e00
nop
mov dword [rbp + 0xc8], esi
mov dword [rbp + 0xd0], 4
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140074f94
cmp dword [rbp + 0xc8], 1
sete dil
mov byte [r14], dil
lea rcx, [rsp + 0x50]
call fcn.1400166f0
movzx edi, byte [r14 + 1]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.CurrentSPState
lea rcx, [rsp + 0x70]
call fcn.140031e00
nop
mov dword [rbp + 0xc8], esi
mov dword [rbp + 0xd0], 4
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rdx, qword [rsp + 0x70]
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140075028
cmp dword [rbp + 0xc8], 1
sete dil
mov byte [r14 + 1], dil
lea rcx, [rsp + 0x70]
call fcn.1400166f0
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dil, 1
lea rcx, [rbp + 0xf8]
call fcn.1400166f0
nop
lea rcx, [rbp + 0xd8]
call fcn.140031a00
nop
test rbx, rbx
je 0x140075073
mov r8, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r8]
movzx eax, dil
mov rcx, qword [rbp + 0x118]
xor rcx, rsp
call fcn.1402ba9b0
mov rbx, qword [rsp + 0x260]
add rsp, 0x220
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret