Function at 0x140035270
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x1400d1608]
xor rax, rsp
mov qword [rbp + 0x350], rax
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x140035356
cmp dword [0x1400bb8f0], 0
jne 0x140035356
mov rdx, qword [str.0_f_]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140035302
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.deiMTPexpedatcf_encrypt
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140035356
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0x400
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14003534b
cmp dword [rsp + 0x30], eax
jbe 0x14003534b
cmp byte [rsp + 0x50], 0x30
setne al
mov dword [reloc.WS2_32.dll_accept], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x1400c0a30]
xor r8d, r8d
cmp dword [reloc.WS2_32.dll_accept], r8d
mov edx, 0x402
mov qword [rsp + 0x480], rdi
setne r8b
call qword [sym.imp.USER32.dll_CheckDlgButton]
mov rdx, qword [str.__f_]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14003548f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, 1
test eax, eax
jne 0x140035494
cmp dword [rsp + 0x30], 0x10
ja 0x140035494
mov rcx, qword [0x1400c1478]
xor r8d, r8d
mov byte [rsp + 0x5f], al
cmp byte [rsp + 0x50], r8b
je 0x140035471
lea r9, [rsp + 0x50]
mov edx, 0x158
call qword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x140035456
mov rcx, qword [0x1400c1478]
xor r9d, r9d
movsxd r8, eax
mov edx, 0x14e
call qword [sym.imp.USER32.dll_SendMessageW]
lea r8d, [rdi + 0xf]
lea rdx, [rsp + 0x50]
lea rcx, [0x1400d22c8]
call fcn.1400498e0
call fcn.140034620
xor eax, eax
jmp 0x140035496
lea rdx, [rsp + 0x50]
lea rcx, str.Handler___s__not_found_in_list_r_n
call fcn.140020ee0
mov rcx, qword [0x1400c1478]
xor r8d, r8d
xor r9d, r9d
mov edx, 0x14e
call qword [sym.imp.USER32.dll_SendMessageW]
mov byte [0x1400d22c8], 0
call fcn.140034620
xor eax, eax
jmp 0x140035496
mov edi, 1
mov eax, edi
mov rdx, qword [str.SoftwaredeiMTPexpedatcf_user]
mov r9d, 0x20019
mov dword [0x140239390], eax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140035519
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0x20
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140035519
cmp dword [rsp + 0x30], 0x20
ja 0x140035519
mov rcx, qword [0x1400c0d48]
lea rdx, [rsp + 0x50]
mov byte [rsp + 0x6f], al
call qword [sym.imp.USER32.dll_SetWindowTextA]
cmp dword [0x1400bb8f0], 0
je 0x140035563
cmp dword [0x1400bb924], 0
je 0x140035563
mov rcx, qword [0x1400c0a30]
mov r8d, edi
mov edx, 0x402
mov dword [reloc.WS2_32.dll_accept], edi
call qword [sym.imp.USER32.dll_CheckDlgButton]
mov rcx, qword [0x1400c0a30]
mov edx, 0x402
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
mov rdx, qword [str._b_f_]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400355bd
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.deiMTPexpedat_servers
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400356ac
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x470], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rsp + 0x30], 0x400
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400356a4
mov eax, dword [rsp + 0x30]
cmp eax, 3
jb 0x1400356a4
mov qword [rsp + 0x478], rsi
lea rcx, [rsp + 0x50]
lea rsi, [rsp + 0x50]
mov qword [rsp + 0x48], rcx
add rsi, rax
nop dword [rax]
nop word [rax + rax]
mov r8, rsi
lea rdx, [0x1400c2b54]
lea rcx, [rsp + 0x48]
call fcn.140052590
mov rbx, rax
test rax, rax
je 0x140035694
cmp byte [rax], 0
je 0x140035694
mov rcx, qword [0x1400c0ca8]
mov r9, rax
xor r8d, r8d
mov edx, 0x143
call qword [sym.imp.USER32.dll_SendMessageA]
test edi, edi
je 0x140035694
mov rcx, qword [0x1400c0a30]
xor edi, edi
mov r8, rbx
mov edx, 0x3e8
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
cmp qword [rsp + 0x48], 0
jne 0x140035640
mov rsi, qword [rsp + 0x478]
mov rbx, qword [rsp + 0x470]
mov rdi, qword [rsp + 0x480]
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.14006f1f0
add rsp, 0x460
pop rbp
ret