Function at 0x140096d30
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xb8
mov r15, r8
mov r12, rdx
mov r14, rcx
lea rbx, section..data
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x140096d97
test byte [rcx + 0x1c], 1
je 0x140096d97
cmp byte [rcx + 0x19], 5
jb 0x140096d97
mov eax, dword [r8 + 0x10]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.14009a324
and qword [rbp - 0x71], 0
and dword [rbp - 0x69], 0
and dword [rbp - 0x65], 0
lea rdx, [rbp - 0x71]
mov rcx, r14
call fcn.140097e68
mov edi, eax
mov r10, qword [section..data]
cmp r10, rbx
je 0x140096deb
test byte [r10 + 0x1c], 2
je 0x140096deb
cmp byte [r10 + 0x19], 4
jb 0x140096deb
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400bd838]
mov rcx, qword [r10 + 0x10]
call fcn.14000ad20
mov r10, qword [section..data]
and qword [rbp - 0x59], 0
and dword [rbp - 0x51], 0
and dword [rbp - 0x4d], 0
test edi, edi
jne 0x140096f37
mov rax, qword [r14]
movabs r10, 0x8ba916ea3852e270
mov rcx, r14
mov rax, qword [rax + 0x58]
call qword [case.0x140071786.0]
test rax, rax
je 0x140097004
xor ebx, ebx
mov qword [rbp - 9], rbx
xor esi, esi
mov qword [rbp - 1], rsi
mov qword [rbp + 7], rsi
mov rax, qword [r14]
movabs r10, 0x8ba916ea3852e270
mov rcx, r14
mov rax, qword [rax + 0x58]
call qword [case.0x140071786.0]
mov qword [rbp - 0x31], rsi
lea rcx, [rbp - 0x31]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140096e89
mov edi, esi
mov rbx, qword [rbp - 0x31]
mov qword [rbp - 9], rbx
mov r10, qword [section..data]
lea r13, section..data
cmp r10, r13
je 0x140096ec9
test byte [r10 + 0x1c], 2
je 0x140096ec9
cmp byte [r10 + 0x19], 4
jb 0x140096ec9
mov edx, SysStringByteLen
mov r9d, edi
lea r8, [0x1400bd838]
mov rcx, qword [r10 + 0x10]
call fcn.14000ad20
mov r10, qword [section..data]
test edi, edi
jne 0x140096f15
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 9]
call fcn.1400917dc
mov edi, eax
mov r10, qword [section..data]
cmp r10, r13
je 0x140096f15
test byte [r10 + 0x1c], 2
je 0x140096f15
cmp byte [r10 + 0x19], 4
jb 0x140096f15
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400bd838]
mov rcx, qword [r10 + 0x10]
call fcn.14000ad20
mov r10, qword [section..data]
test rbx, rbx
je 0x140096f30
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov r10, qword [section..data]
lea rbx, section..data
xor esi, esi
cmp dword [rbp - 0x69], esi
jle 0x1400974ed
xor r13d, r13d
and dword [rbp + 0x77], 0
test esi, esi
js 0x1400975f5
cmp esi, dword [rbp - 0x69]
jge 0x1400975f5
lea r8, [rbp + 0x77]
mov rdx, qword [rbp - 0x71]
mov rdx, qword [rdx + r13*8]
mov rcx, r14
call fcn.1400985d4
mov edi, eax
mov r10, qword [section..data]
cmp r10, rbx
je 0x140096fa9
test byte [r10 + 0x1c], 2
je 0x140096fa9
cmp byte [r10 + 0x19], 4
jb 0x140096fa9
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400bd838]
mov rcx, qword [r10 + 0x10]
call fcn.14000ad20
mov r10, qword [section..data]
test edi, edi
jne 0x140097010
cmp dword [rbp + 0x77], 1
jne 0x140097010
cmp r10, rbx
je 0x1400974df
test byte [r10 + 0x1c], 2
je 0x1400974df
cmp byte [r10 + 0x19], 4
jb 0x1400974df
cmp esi, dword [rbp - 0x69]
jge 0x140097600
mov edx, reloc.OLEAUT32.dll_SysStringByteLen
mov rax, qword [rbp - 0x71]
mov r9, qword [rax + r13*8]
lea r8, [0x1400bd838]
mov rcx, qword [r10 + 0x10]
call fcn.1400062dc
mov r10, qword [section..data]
jmp 0x1400974df
mov r10, qword [section..data]
jmp 0x140096f37
and dword [rbp - 0x61], 0
cmp esi, dword [rbp - 0x69]
jge 0x1400975ea
lea r9, [rbp - 0x61]
lea r8, str.DefaultAuthorization
mov rdx, qword [rbp - 0x71]
mov rdx, qword [rdx + r13*8]
mov rcx, r14
call fcn.1400988ac
test eax, eax
jne 0x14009707b
cmp dword [rbp - 0x61], 1
jne 0x14009707b
mov r10, qword [section..data]
cmp r10, rbx
je 0x1400974df
test byte [r10 + 0x1c], 2
je 0x1400974df
cmp byte [r10 + 0x19], 4
jb 0x1400974df
cmp esi, dword [rbp - 0x69]
jge 0x14009760b
mov edx, 0x95
jmp 0x140096fe0
cmp esi, dword [rbp - 0x69]
jge 0x14009766e
mov rbx, qword [rbp - 0x71]
xor r8d, r8d
xor r10d, r10d
cmp dword [r12 + 8], r8d
jle 0x1400970e5
movsxd r11, dword [r12 + 8]
mov r9, qword [r12]
cmp qword [rbx + r13*8], 0
je 0x140097616
mov rax, qword [r9]
mov rdx, qword [rbx + r13*8]
sub rdx, rax
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x1400970c9
add rax, 2
test cx, cx
jne 0x1400970b3
xor eax, eax
jmp 0x1400970ce
sbb eax, eax
or eax, 1
test eax, eax
je 0x140097158
inc r8d
inc r10
add r9, 8
cmp r10, r11
jl 0x14009709e
cmp qword [r15 + 0x10], 0
je 0x140097291
mov rax, qword [0x1400cce40]
movabs r10, 0xb1a8ae8f5a5da170
lea rcx, [0x1400cce40]
mov rax, qword [rax + 0x18]
call qword [case.0x140071786.0]
add rax, 0x18
mov qword [rbp - 0x41], rax
cmp esi, dword [rbp - 0x69]
jge 0x14009762c
lea r9, [rbp - 0x41]
lea r8, str.NetworkInterface
mov rdx, qword [rbp - 0x71]
mov rdx, qword [rdx + r13*8]
mov rcx, r14
call fcn.140098ab8
mov rcx, qword [rbp - 0x41]
test eax, eax
jne 0x140097266
cmp dword [rcx - 0x10], eax
je 0x140097266
mov rax, qword [r15]
jmp 0x1400971d2
cmp r8d, 0xffffffff
je 0x1400970e5
mov r10, qword [section..data]
lea rax, section..data
cmp r10, rax
je 0x1400974d8
test byte [r10 + 0x1c], 2
je 0x1400974d8
cmp byte [r10 + 0x19], 4
jb 0x1400974d8
mov edx, 0x96
mov r9, qword [rbx + r13*8]
lea r8, [0x1400bd838]
mov rcx, qword [r10 + 0x10]
call fcn.1400062dc
jmp 0x1400974d1
mov rdx, qword [rax + 0x10]
mov r10, rcx
sub r10, rdx
movzx r8d, word [rdx]
movzx r9d, word [rdx + r10]
sub r8d, r9d
jne 0x1400971ca
add rdx, 2
test r9d, r9d
jne 0x1400971b3
test r8d, r8d
je 0x1400971d9
mov rax, qword [rax]
test rax, rax
jne 0x1400971a9
jmp 0x1400971e2
test rax, rax
jne 0x140097266
mov r10, qword [section..data]
lea rbx, section..data
cmp r10, rbx
je 0x140097232
test byte [r10 + 0x1c], 2
je 0x140097232
cmp byte [r10 + 0x19], 4
jb 0x140097232
cmp esi, dword [rbp - 0x69]
jge 0x140097621
mov rax, qword [rbp - 0x71]
mov edx, 0x97
mov qword [rsp + 0x20], rcx
mov r9, qword [rax + r13*8]
lea r8, [0x1400bd838]
mov rcx, qword [r10 + 0x10]
call fcn.140019374
mov rcx, qword [rbp - 0x41]
lea rdx, [rcx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140096ff8
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
jmp 0x140096ff8
lea rdx, [rcx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140097291
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
xor r15d, r15d
xor r12d, r12d
cmp dword [rbp - 0x51], r12d
jle 0x140097493
xor r14d, r14d
mov qword [rbp - 0x21], r14
and qword [rbp - 0x19], r14
and qword [rbp - 0x11], r14
mov rcx, qword [rbp + 0x5f]
mov rax, qword [rcx]
movabs r10, 0x8ba916ea3852e270
mov rax, qword [rax + 0x58]
call qword [case.0x140071786.0]
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.140005058
lea r8d, [r14 + 1]
lea rdx, [0x1400b2160]
lea rcx, [rbp - 0x39]
call fcn.14000543c
test r12, r12
js 0x14009764d
cmp r15d, dword [rbp - 0x51]
jge 0x14009764d
mov rax, qword [rbp - 0x59]
mov rdx, qword [rax + r12*8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x39]
call fcn.14000543c
and qword [rbp - 0x29], r14
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rbx, qword [rbp - 0x39]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140097351
mov r14, qword [rbp - 0x29]
mov qword [rbp - 0x21], r14
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140097388
test byte [rcx + 0x1c], 2
je 0x140097388
cmp byte [rcx + 0x19], 4
jb 0x140097388
mov edx, 0x98
mov r9d, edi
lea r8, [0x1400bd838]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
test edi, edi
jne 0x14009743e
and dword [rbp - 0x5d], edi
test r13, r13
js 0x140097642
cmp esi, dword [rbp - 0x69]
jge 0x140097642
mov rax, qword [rbp - 0x71]
mov dword [rbp - 0x49], 4
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x5d]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x45]
xor r8d, r8d
mov rdx, qword [rax + r13*8]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x1400973ef
mov eax, dword [rbp - 0x45]
sub eax, 4
neg eax
sbb edi, edi
and edi, 0xd
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140097434
test byte [rcx + 0x1c], 2
je 0x140097434
cmp byte [rcx + 0x19], 4
jb 0x140097434
mov edx, 0x99
mov r9d, edi
lea r8, [0x1400bd838]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
mov rcx, qword [section..data]
lea rax, section..data
cmp dword [rbp - 0x5d], 0
jne 0x14009755c
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14009746a
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14009747f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
inc r15d
inc r12
cmp r15d, dword [rbp - 0x51]
jl 0x1400972a1
mov r14, qword [rbp + 0x5f]
cmp esi, dword [rbp - 0x69]
jge 0x140097663
mov rdx, qword [rbp - 0x71]
mov rdx, qword [rdx + r13*8]
mov rcx, r14
call fcn.140097680
cmp esi, dword [rbp - 0x69]
jge 0x140097658
movsxd rcx, esi
mov rax, qword [rbp - 0x71]
lea rdx, [rax + rcx*8]
mov rcx, qword [rbp + 0x7f]
call fcn.14000c674
mov r12, qword [rbp + 0x67]
mov r15, qword [rbp + 0x6f]
mov r10, qword [section..data]
lea rbx, section..data
inc esi
inc r13
cmp esi, dword [rbp - 0x69]
jl 0x140096f45
cmp r10, rbx
je 0x140097532
test byte [r10 + 0x1c], 1
je 0x140097532
movzx edx, byte [r10 + 0x19]
mov eax, edi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x140097532
mov rax, qword [rbp + 0x7f]
mov eax, dword [rax + 8]
mov edx, 0x9b
mov dword [rsp + 0x20], eax
mov r9d, edi
lea r8, [0x1400bd838]
mov rcx, qword [r10 + 0x10]
call fcn.1400192d4
nop
lea rcx, [rbp - 0x59]
call fcn.140015550
nop
lea rcx, [rbp - 0x71]
call fcn.140015550
mov eax, edi
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp rcx, rax
je 0x1400975a0
test byte [rcx + 0x1c], 2
je 0x1400975a0
cmp byte [rcx + 0x19], 4
jb 0x1400975a0
mov rax, qword [rbp - 0x59]
mov r8, qword [rax + r12*8]
cmp esi, dword [rbp - 0x69]
jge 0x140097637
mov rax, qword [rbp - 0x71]
mov edx, 0x9a
mov qword [rsp + 0x20], r8
mov r9, qword [rax + r13*8]
lea r8, [0x1400bd838]
mov rcx, qword [rcx + 0x10]
call fcn.140019374
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400975cc
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x1400975e1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov r14, qword [rbp + 0x5f]
jmp 0x1400974c9
mov ecx, 0xc000008c
call fcn.140006108
int3
mov ecx, 0xc000008c
call fcn.140006108
int3
mov ecx, 0xc000008c
call fcn.140006108
int3
mov ecx, 0xc000008c
call fcn.140006108
int3
mov ecx, 0x80004005
call fcn.1400055a0
nop
mov ecx, 0xc000008c
call fcn.140006108
int3
mov ecx, 0xc000008c
call fcn.140006108
nop
mov ecx, 0xc000008c
call fcn.140006108
int3
mov ecx, 0xc000008c
call fcn.140006108
int3
mov ecx, 0xc000008c
call fcn.140006108
nop
mov ecx, 0xc000008c
call fcn.140006108
int3
mov ecx, 0xc000008c
call fcn.140006108
int3
mov ecx, 0xc000008c
call fcn.140006108
int3