Function at 0x140003e62
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbp
sub rsp, 0x568
mov r14d, r9d
mov r13, r8
mov r12d, edx
mov rbp, rcx
mov rax, qword [0x14000bb88]
mov qword [rsp + 0x558], rax
mov r10d, dword [0x14000c0f8]
cmp r10d, 2
je 0x140004079
lea rdx, [0x14000c0f8]
mov eax, 1
xchg dword [rdx], eax
cmp eax, 2
je 0x14000406f
cmp eax, 1
jne 0x140003edf
mov eax, dword [0x14000c0f8]
cmp eax, 1
jne 0x140004079
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov eax, dword [0x14000c0f8]
cmp eax, 1
je 0x140003ec9
jmp 0x140004079
test eax, eax
jne 0x140004079
mov dword [rsp + 0x540], 2
lea r8, [rsp + 0x548]
movabs rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREORACLEOSD9i
mov dword [rsp + 0x544], 1
mov dword [rsp + 0x550], 0x100
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x140003f72
mov rcx, qword [rsp + 0x548]
lea rax, [rsp + 0x430]
mov qword [rsp + 0x20], rax
lea rdx, str.CMDLL
xor r8d, r8d
lea rsi, [rsp + 0x550]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov rcx, qword [rsp + 0x548]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x1400042b0
lea rcx, [rsp + 0x430]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14000b1c0], rax
test rax, rax
je 0x14000428f
lea rcx, [rsp + 0x430]
xor eax, eax
movzx edx, byte [rcx + rax]
test edx, edx
je 0x140003fbb
movzx edx, byte [rcx + rax + 1]
add rax, 2
test edx, edx
jne 0x140003fa2
add rax, 0xffffffffffffffff
add rax, 1
mov rcx, rax
call qword [sym.imp.MSVCR80.dll_malloc]
mov qword [0x14000b1b8], rax
test rax, rax
je 0x140003ff2
lea rdi, [rsp + 0x430]
mov rsi, rax
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x140003fe2
mov eax, dword [0x14000b1c8]
xor esi, esi
test eax, eax
jbe 0x140004058
mov qword [rsp + 0x538], r15
mov rcx, qword [0x14000b1c0]
lea edi, [rsi + 1]
movzx edx, di
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [0x14000b1d0]
mov esi, esi
lea rcx, [rsi + rsi*2]
mov qword [rdx + rcx*8], rax
mov rdx, qword [0x14000b1d0]
mov rax, qword [rdx + rcx*8]
test rax, rax
je 0x140004251
test esi, esi
je 0x14000415d
cmp edi, dword [0x14000b1c8]
mov esi, edi
jb 0x140004006
mov r15, qword [rsp + 0x538]
mov rax, qword [0x14000c0f0]
mov byte [0x14000b1d8], 0
test rax, rax
je 0x140004101
mov dword [0x14000c0f8], 2
movzx eax, byte [0x14000b1d8]
cmp eax, 1
je 0x140004314
mov rax, qword [0x14000b1c0]
test rax, rax
je 0x1400042ce
cmp r12d, 1
je 0x1400040bf
cmp r12d, 2
jne 0x1400040ac
mov edx, 1
jmp 0x1400040c1
mov eax, 2
cmp r12d, 3
mov edx, 0xffffffff
cmove edx, eax
jmp 0x1400040c1
xor edx, edx
mov rsi, qword [0x14000b1d0]
mov eax, 1
lea rdi, [rax + rax*2]
mov rcx, rbp
mov r8, r13
mov r9d, r14d
call qword [rsi + rdi*8]
mov rcx, qword [rsp + 0x558]
movsxd rbp, eax
call fcn.140006fe0
mov rax, rbp
add rsp, 0x568
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
xor ecx, ecx
mov edx, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x14000c0f0], rax
test rax, rax
je 0x14000406f
xor edx, edx
lea rdi, [0x140000000]
lea rsi, [rdi + rdx + 0xbbc0]
mov qword [rdi + rdx + 0xbbc8], rsi
mov qword [rdi + rdx + 0xbbc0], rsi
add rdx, 0x10
cmp rdx, 0x530
jl 0x14000412a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x14000406f
mov rsi, qword [0x14000b1d0]
mov qword [rsp + 0x20], 0
xor eax, eax
lea rcx, [rsp + 0x540]
lea rdx, [rsp + 0x530]
lea r8, [rsp + 0x30]
lea r10, [rax + rax*2]
mov r9d, 0x400
call qword [rsi + r10*8]
test eax, eax
je 0x14000423d
mov eax, dword [rsp + 0x530]
cmp eax, 2
je 0x140004046
mov r15, qword [rsp + 0x538]
mov r8d, dword [rsp + 0x540]
mov r9d, dword [rsp + 0x544]
mov dword [rsp + 0x20], eax
lea rcx, str._s_version_mismatch:_req__d._d_dll__d._d
mov eax, dword [rsp + 0x534]
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x430]
call fcn.140004b10
mov rcx, qword [0x14000b1c0]
test rcx, rcx
je 0x140004202
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14000b1c0], 0
mov edx, dword [0x14000b1c8]
xor eax, eax
test edx, edx
jbe 0x140004231
mov rcx, qword [0x14000b1d0]
mov eax, eax
lea rsi, [rax + rax*2]
lea rdx, [0x140002ce6]
add eax, 1
mov qword [rcx + rsi*8], rdx
cmp eax, dword [0x14000b1c8]
jb 0x14000420e
mov byte [0x14000b1d8], 1
jmp 0x14000406f
mov r15, qword [rsp + 0x538]
mov eax, dword [rsp + 0x530]
jmp 0x1400041b2
mov eax, dword [rdx + rcx*8 + 8]
cmp eax, 1
je 0x14000426a
lea rax, [0x140002ce6]
mov qword [rdx + rcx*8], rax
jmp 0x14000403e
mov r15, qword [rsp + 0x538]
lea rdx, [rsp + 0x430]
lea rcx, str.failed_to_load__s_routine__d
mov r8d, edi
call fcn.140004b10
nop
jmp 0x1400041e5
lea r8, [rsp + 0x430]
lea rcx, str.could_not_load__s_OSD_DLL__s
lea rdx, str.mandatory
call fcn.140004b10
nop
jmp 0x1400041e5
lea rcx, str.CMDLL_not_found_in_the_registry__or_problems_reading_value
call fcn.140004b10
lea rcx, str.Forcing_usage_of_vacuous_functionality
call fcn.140004b10
nop
jmp 0x1400041e5
lea rax, str.skgxnqtsz1
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov edx, 1
mov r8d, 0x24ba
lea r9, str.skgxnqtsz_not_loaded
call fcn.14000235a
mov rcx, qword [rsp + 0x558]
call fcn.140006fe0
xor eax, eax
add rsp, 0x568
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
mov edx, 0x4e2f4156
lea rax, str.forced_vacuous_skgxn
mov qword [rsp + 0x20], rax
mov rcx, rbp
xor r8d, r8d
lea r9, str.skgxnqtsz
call fcn.14000235a
mov rcx, qword [rsp + 0x558]
call fcn.140006fe0
xor eax, eax
add rsp, 0x568
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret