Function at 0x7ff74b304e4
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
sub rsp, 0xa0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], rsi
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0x98], r12
mov rax, qword [0x7ff74b58340]
xor rax, rbp
mov qword [rbp + 0x60], rax
xor edi, edi
mov r12, r9
mov rbx, r8
and qword [rbp + 8], rdi
and dword [rbp + 0x10], edi
mov esi, edx
test rcx, rcx
je 0x7ff74b3056b
mov rax, qword [rcx]
lea r8, [rbp + 8]
lea rdx, [0x7ff74b4f558]
call qword [rax]
mov edi, eax
test eax, eax
js 0x7ff74b30730
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x7ff74b3056b
mov rax, qword [rcx]
lea r8, [rbp + 0x10]
mov edx, esi
call qword [rax + 0x18]
mov edi, eax
test eax, eax
js 0x7ff74b30724
and qword [rbp + 0x38], 0
and qword [rbp + 0x50], 0
and qword [rbp + 0x58], 0
lea rax, [rbx + 4]
lea r8, [rbp + 0x30]
lea rcx, [rbp + 0x18]
mov qword [rbp + 0x28], rax
movzx eax, word [rbx]
mov edx, 0x20019
mov word [rbp + 0x20], ax
mov word [rbp + 0x22], ax
lea rax, [rbp + 0x20]
mov dword [rbp + 0x30], 0x30
mov dword [rbp + 0x48], 0x40
mov qword [rbp + 0x40], rax
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jns 0x7ff74b305f0
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
cmp edi, 0x80070002
jne 0x7ff74b30712
mov rax, qword [rbp + 0xa0]
xor edi, edi
mov dword [rax], 1
jmp 0x7ff74b30712
mov rcx, qword [rbp + 0x18]
and dword [rbp], 0
xor r9d, r9d
lea rax, [rbp]
lea edx, [r9 + 2]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryKey]
cmp eax, 0xc0000023
jne 0x7ff74b30708
mov r9d, dword [rbp]
xor ebx, ebx
mov esi, 0x70616548
test r9d, r9d
je 0x7ff74b30692
cmp r9, qword [0x7ff74b585e0]
ja 0x7ff74b30692
mov rax, qword [0x7ff74b585e8]
lea rcx, [r9 + rax + 8]
cmp rcx, r9
jb 0x7ff74b30692
call fcn.7ff74ae6340
test eax, eax
je 0x7ff74b3068e
mov r9d, dword [rbp]
lea eax, [r9 + 8]
mov ecx, eax
add rax, 0xf
cmp rax, rcx
ja 0x7ff74b3066c
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.7ff74ae3a20
sub rsp, rax
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x7ff74b30692
mov dword [rbx], 0x6b637453
add rbx, 8
jne 0x7ff74b306b1
mov r9d, dword [rbp]
lea eax, [r9 + 8]
cmp eax, r9d
jb 0x7ff74b306b5
mov ecx, eax
call qword [0x7ff74b585f0]
mov rbx, rax
test rax, rax
je 0x7ff74b306b1
mov dword [rax], esi
add rbx, 8
mov r9d, dword [rbp]
test r12, r12
jne 0x7ff74b306c1
mov edi, 0x8007000e
jmp 0x7ff74b30708
mov rcx, qword [rbp + 0x18]
lea rax, [rbp]
mov r8, rbx
mov edx, 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryKey]
test eax, eax
js 0x7ff74b306f5
mov rax, qword [r12]
xor ecx, ecx
cmp qword [rbx], rax
mov rax, qword [rbp + 0xa0]
setne cl
mov dword [rax], ecx
test rbx, rbx
je 0x7ff74b30708
lea rcx, [rbx - 8]
cmp dword [rcx], esi
jne 0x7ff74b30708
call qword [0x7ff74b585f8]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x7ff74b3072e
mov rax, qword [rcx]
mov edx, dword [rbp + 0x10]
call qword [rax + 0x20]
mov rcx, qword [rbp + 8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, edi
mov rcx, qword [rbp + 0x60]
xor rcx, rbp
call fcn.7ff74ae3090
mov rbx, qword [rbp + 0x80]
mov rsi, qword [rbp + 0x88]
mov rdi, qword [rbp + 0x90]
mov r12, qword [rbp + 0x98]
lea rsp, [rbp + 0x70]
pop rbp
ret