Function at 0x14000fd70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov qword [rbp + 0x2f], 0xfffffffffffffffe
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
cmp eax, dword [0x140031bd4]
jbe 0x14000ffdf
xor r14d, r14d
mov qword [rbp + 7], r14
mov dword [rbp + 0xf], r14d
mov qword [rbp + 0x17], r14
mov r9d, 0x20019
lea r8, str.SOFTWAREDigitalPersonaTracing
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 7]
call fcn.140010800
test eax, eax
je 0x14000fdf6
call fcn.1400107f0
test al, al
je 0x14000fdf6
mov r9d, 0x20219
lea r8, str.SOFTWAREDigitalPersonaTracing
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 7]
call fcn.140010800
nop
mov ebx, r14d
mov rdi, qword [rbp + 7]
test rdi, rdi
je 0x14000ff7c
mov dword [rbp + 0x67], r14d
mov dword [rbp - 1], 4
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 9]
xor r8d, r8d
lea rdx, str.TraceToFile
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000fe4a
cmp dword [rbp - 9], 4
jne 0x14000fe4a
cmp dword [rbp + 0x67], 1
jne 0x14000fe4f
mov ebx, 4
mov dword [rbp + 0x6f], r14d
mov dword [rbp - 0x19], 4
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 5]
xor r8d, r8d
lea rdx, str.NewFileAlways
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000fe97
cmp dword [rbp - 5], 4
jne 0x14000fe97
cmp dword [rbp + 0x6f], eax
seta al
test al, al
je 0x14000fe9a
or ebx, 8
mov dword [rbp + 0x77], r14d
mov dword [rbp - 0x11], 4
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x25]
xor r8d, r8d
lea rdx, str.DoTrace
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000fee5
cmp dword [rbp - 0x25], 4
jne 0x14000fee5
cmp dword [rbp + 0x77], eax
seta al
test al, al
je 0x14000fee5
or ebx, 0x20
mov dword [rbp + 0x7f], r14d
mov dword [rbp - 0x21], 4
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x1d]
xor r8d, r8d
lea rdx, str.DoLog
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ff31
cmp dword [rbp - 0x1d], 4
jne 0x14000ff31
cmp dword [rbp + 0x7f], eax
seta al
test al, al
je 0x14000ff31
bts ebx, 7
mov dword [rbp - 0x29], r14d
mov dword [rbp - 0x15], 4
lea rax, [rbp - 0x15]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0xd]
xor r8d, r8d
lea rdx, str.DoProfiling
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ff7c
cmp dword [rbp - 0xd], 4
jne 0x14000ff7c
cmp dword [rbp - 0x29], eax
seta al
test al, al
je 0x14000ff7c
or ebx, 0x40
cmp ebx, dword [0x14003000c]
je 0x14000ffbc
lea rdi, [0x140031e10]
mov qword [rbp + 0x1f], rdi
mov byte [rbp + 0x27], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rbp + 0x27], 1
xor ecx, ecx
call fcn.14000f670
mov ecx, ebx
call fcn.14000fff0
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rbp + 0x27], 0
lea eax, [rsi + 0x7530]
xchg dword [0x140031bd4], eax
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x14000ffdb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 7], r14
mov dword [rbp + 0xf], r14d
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret