Function at 0x140005da0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push r12
push r13
push r14
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x14007a0f8]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
movsxd r13, r8d
mov r12, rdx
mov rbx, rcx
xor eax, eax
xor edx, edx
mov qword [rsp + 0x60], rax
mov r8d, 0x208
lea rcx, [rbp - 0x80]
mov r14, r9
call fcn.140009970
xor edx, edx
lea rcx, [rbp + 0x190]
mov r8d, 0x208
call fcn.140009970
test rbx, rbx
je 0x1400060db
test r12, r12
je 0x1400060db
test r14, r14
je 0x1400060db
mov rcx, qword [0x14007bb30]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x4b8], rsi
xor edx, edx
mov r8d, 0x20019
mov qword [rsp + 0x4b0], rdi
mov rcx, qword [rcx]
call sub.api_ms_win_service_core_l1_1_3.dll_GetServiceRegistryStateKey
mov esi, eax
test eax, eax
je 0x140005efd
lea rdi, str.Parameters
mov r9, rbx
lea r8, str.BSPDRIVERSCurrentControlSetServices_s_s
mov qword [rsp + 0x20], rdi
mov edx, 0x104
lea rcx, [rbp + 0x190]
call fcn.140006a80
lea rax, [rsp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x190]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
mov esi, eax
test eax, eax
je 0x140005efd
mov r9, rbx
mov qword [rsp + 0x20], rdi
lea r8, str.OEMDRIVERSCurrentControlSetServices_s_s
mov edx, 0x104
lea rcx, [rbp + 0x190]
call fcn.140006a80
lea rax, [rsp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x190]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
mov esi, eax
test eax, eax
je 0x140005efd
mov edi, 0x3f3
jmp 0x14000609b
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, str.AppName
lea rax, [rbp - 0x80]
mov dword [rsp + 0x68], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x140005f67
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [0x140066188]
lea rax, [rbp - 0x80]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140005f93
mov edx, 0x2e
lea rcx, [rbp - 0x80]
call fcn.140009d04
test rax, rax
jne 0x140005f8f
lea r8, str..dll
mov edx, 0x104
lea rcx, [rbp - 0x80]
call fcn.140032378
test ebx, ebx
je 0x140005f9d
mov edi, 0x3f3
jmp 0x14000609b
lea rcx, [rbp - 0x80]
call fcn.140003ed0
mov edi, eax
test eax, eax
je 0x140005fb6
mov edi, 0x3f3
jmp 0x14000609b
lea rcx, [rsp + 0x48]
call fcn.140003960
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
cmp qword [rsp + 0x34], 0
jne 0x140005fe6
lea rcx, str.Error:_Unable_to_get_the_executable_file_path._n
mov edi, 0x3f3
call fcn.140004880
jmp 0x14000609b
mov r8, qword [rsp + 0x34]
mov rdx, r13
mov rcx, r12
call fcn.140031278
mov rcx, qword [rsp + 0x34]
call fcn.14002e7dc
mov edx, 0x5c
mov rcx, r12
call fcn.140009d80
xor ecx, ecx
lea r8, [rbp - 0x80]
mov rdx, r13
mov word [rax + 2], cx
mov rcx, r12
call fcn.140032378
movsxd rbx, dword [rbp + 0x410]
lea rdx, str.Server
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
lea eax, [rbx + rbx]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
test eax, eax
jne 0x140006067
mov rcx, r14
call fcn.140004050
mov edi, eax
jmp 0x14000609b
mov rdx, rbx
lea rcx, str.pipe:__ipfsrv.public
call fcn.14002f470
lea r9, str.pipe:__ipfsrv.public
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rcx, [rsp + 0x70]
mov rdx, r14
call fcn.140031e24
test eax, eax
je 0x14000609b
mov edi, 0x709
test esi, esi
mov rsi, qword [rsp + 0x4b8]
jne 0x1400060b2
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, edi
mov rdi, qword [rsp + 0x4b0]
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.140008600
add rsp, 0x4c0
pop r14
pop r13
pop r12
pop rbx
pop rbp
ret
mov eax, 0x8fc
jmp 0x1400060bc