Function at 0x140076630
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r14, qword [0x1400f5760]
mov r15, r9
mov rsi, r8
mov byte [rsp + 0x20], 1
mov rbx, rdx
mov r12, rcx
or rdi, 0xffffffffffffffff
mov rcx, r14
mov r8, rdi
xor r9d, r9d
xor edx, edx
call fcn.14007d4e0
test rbx, rbx
jne 0x1400766bc
mov ebx, 0x57
mov ecx, ebx
mov rax, qword [0x1400edaa8]
test ebx, ebx
setne dl
mov dword [rax + 0x40], ecx
mov rcx, r12
call fcn.140030e80
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rax, qword [0x1400edaa8]
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
mov r9d, dword [rax + 0x108]
lea rax, [rbp - 0x38]
or r9d, 0x20019
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x14007679f
mov rcx, qword [rbp - 0x38]
lea r9, [rbp - 0x40]
xor r13d, r13d
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov rdx, r15
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140076795
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x140076741
cmp eax, 2
jbe 0x1400768e9
cmp eax, 3
je 0x1400767b5
cmp eax, 4
je 0x140076755
cmp eax, 7
je 0x1400768e9
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 0x65e
jmp 0x140076685
mov rcx, qword [rbp - 0x38]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp - 0x3c]
mov dword [rbp + 0x38], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140076795
mov edx, dword [rbp - 0x3c]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, r14
call fcn.140001460
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 0xffffffff
jne 0x140076685
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x140076687
mov rcx, qword [rbp - 0x38]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov rdx, r15
mov dword [rbp + 0x38], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140076795
mov eax, dword [rbp + 0x38]
test eax, eax
je 0x140076795
lea r8d, [rax + rax]
mov byte [rsp + 0x20], 1
xor r9d, r9d
xor edx, edx
mov rcx, r14
call fcn.14007d4e0
cmp eax, 1
jne 0x140076940
xor r8d, r8d
mov edx, eax
mov rcx, r14
call fcn.1400015b0
mov rsi, rax
xor r9d, r9d
xor r8d, r8d
mov word [rax], r13w
mov edx, dword [rbp + 0x38]
mov rcx, qword [rbp - 0x38]
lea edi, [rdx + rdx]
add rdi, rdi
sub rdi, rdx
mov rdx, r15
add rdi, rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14007679f
mov r10d, r13d
movzx eax, word [0x1400db668]
mov r9d, r13d
mov word [rbp - 0x10], ax
movups xmm0, xmmword [0x1400db648]
movups xmm1, xmmword [0x1400db658]
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm1
cmp dword [rbp + 0x38], r13d
jbe 0x1400768ca
mov r8, rsi
nop
mov eax, r9d
lea r8, [r8 + 4]
add r10d, 2
inc r9d
movzx ecx, byte [rax + rdi]
mov eax, ecx
mov edx, ecx
and eax, 0xf
shr rdx, 4
and edx, 0xf
movzx eax, word [rbp + rax*2 - 0x30]
mov word [r8 - 2], ax
movzx eax, word [rbp + rdx*2 - 0x30]
mov word [r8 - 4], ax
cmp r9d, dword [rbp + 0x38]
jb 0x140076890
movsxd rax, r10d
xor edx, edx
mov rcx, r14
mov word [rsi + rax*2], r13w
call fcn.140014860
test eax, eax
jne 0x140076685
jmp 0x14007669e
mov rcx, qword [rbp - 0x38]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov rdx, r15
mov dword [rbp + 0x38], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140076795
mov eax, dword [rbp + 0x38]
test eax, eax
je 0x140076795
shr eax, 1
xor r9d, r9d
xor edx, edx
mov byte [rsp + 0x20], 1
mov rcx, r14
lea r8d, [rax + 2]
call fcn.14007d4e0
cmp eax, 1
je 0x140076951
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x14007669e
xor r8d, r8d
mov rcx, r14
lea edx, [r8 + 1]
call fcn.1400015b0
mov rcx, qword [rbp - 0x38]
mov rsi, rax
lea rax, [rbp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400769cc
mov edx, dword [rbp + 0x38]
test edx, edx
je 0x1400769cc
shr edx, 1
lea eax, [rdx + 1]
mov word [rsi + rdx*2], r13w
mov word [rsi + rax*2], r13w
cmp dword [rbp - 0x40], 7
jne 0x1400769d0
mov rax, rsi
lea ecx, [rbx + 0xa]
cmp word [rax], r13w
jne 0x1400769c6
mov word [rax], cx
cmp word [rax + 2], r13w
je 0x1400769d0
add rax, 2
jmp 0x1400769b6
mov word [rsi], r13w
inc rdi
cmp word [rsi + rdi*2], r13w
jne 0x1400769d0
mov rdx, rdi
mov rcx, r14
call fcn.140014740
xor edx, edx
mov rcx, r14
call fcn.140014860
test eax, eax
jne 0x14007679f
jmp 0x14007669e