Function at 0x140004718
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
push rsi
sub rsp, 0x568
mov esi, 1
mov rax, qword [0x14000bb88]
mov qword [rsp + 0x558], rax
mov edx, dword [0x14000c0f8]
cmp edx, 2
je 0x140004924
lea rdx, [0x14000c0f8]
mov eax, 1
xchg dword [rdx], eax
cmp eax, 2
je 0x140004916
cmp eax, 1
jne 0x140004785
mov eax, dword [0x14000c0f8]
cmp eax, 1
jne 0x140004924
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov eax, dword [0x14000c0f8]
cmp eax, 1
je 0x14000476f
jmp 0x140004924
test eax, eax
jne 0x140004922
mov dword [rsp + 0x540], 2
lea r8, [rsp + 0x548]
movabs rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREORACLEOSD9i
mov dword [rsp + 0x544], 1
mov dword [rsp + 0x550], 0x100
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x140004818
mov rcx, qword [rsp + 0x548]
lea rax, [rsp + 0x430]
mov qword [rsp + 0x20], rax
lea rdx, str.CMDLL
xor r8d, r8d
lea rsi, [rsp + 0x550]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov rcx, qword [rsp + 0x548]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x140004af1
lea rcx, [rsp + 0x430]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14000b1c0], rax
test rax, rax
je 0x140004ad0
lea rcx, [rsp + 0x430]
xor eax, eax
movzx edx, byte [rcx + rax]
test edx, edx
je 0x140004861
movzx edx, byte [rcx + rax + 1]
add rax, 2
test edx, edx
jne 0x140004848
add rax, 0xffffffffffffffff
add rax, 1
mov rcx, rax
call qword [sym.imp.MSVCR80.dll_malloc]
mov qword [0x14000b1b8], rax
test rax, rax
je 0x140004898
lea rdi, [rsp + 0x430]
mov rsi, rax
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x140004888
mov eax, dword [0x14000b1c8]
xor esi, esi
test eax, eax
jbe 0x1400048fe
mov qword [rsp + 0x538], rbp
mov rcx, qword [0x14000b1c0]
lea edi, [rsi + 1]
movzx edx, di
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [0x14000b1d0]
mov esi, esi
lea rcx, [rsi + rsi*2]
mov qword [rdx + rcx*8], rax
mov rdx, qword [0x14000b1d0]
mov rax, qword [rdx + rcx*8]
test rax, rax
je 0x140004a92
test esi, esi
je 0x14000499c
cmp edi, dword [0x14000b1c8]
mov esi, edi
jb 0x1400048ac
mov rbp, qword [rsp + 0x538]
mov rax, qword [0x14000c0f0]
mov byte [0x14000b1d8], 0
test rax, rax
je 0x14000493d
mov esi, 1
mov dword [0x14000c0f8], 2
jmp 0x140004924
xor esi, esi
mov rcx, qword [rsp + 0x558]
call fcn.140006fe0
mov eax, esi
add rsp, 0x568
pop rsi
pop rdi
ret
xor ecx, ecx
mov edx, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x14000c0f0], rax
test rax, rax
je 0x140004995
xor edx, edx
lea rdi, [0x140000000]
lea rsi, [rdi + rdx + 0xbbc0]
mov qword [rdi + rdx + 0xbbc8], rsi
mov qword [rdi + rdx + 0xbbc0], rsi
add rdx, 0x10
cmp rdx, 0x530
jl 0x140004962
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x140004911
xor esi, esi
jmp 0x140004916
mov rbp, qword [0x14000b1d0]
mov qword [rsp + 0x20], 0
xor eax, eax
lea rcx, [rsp + 0x540]
lea rdx, [rsp + 0x530]
lea r8, [rsp + 0x30]
lea rsi, [rax + rax*2]
mov r9d, 0x400
call qword [rbp + rsi*8]
test eax, eax
je 0x140004a7e
mov eax, dword [rsp + 0x530]
cmp eax, 2
je 0x1400048ec
mov rbp, qword [rsp + 0x538]
mov r8d, dword [rsp + 0x540]
mov r9d, dword [rsp + 0x544]
mov dword [rsp + 0x20], eax
lea rcx, str._s_version_mismatch:_req__d._d_dll__d._d
mov eax, dword [rsp + 0x534]
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x430]
call fcn.140004b10
mov rcx, qword [0x14000b1c0]
test rcx, rcx
je 0x140004a41
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14000b1c0], 0
mov edx, dword [0x14000b1c8]
xor eax, eax
test edx, edx
jbe 0x140004a70
mov rcx, qword [0x14000b1d0]
mov eax, eax
lea rsi, [rax + rax*2]
lea rdx, [0x140002ce6]
add eax, 1
mov qword [rcx + rsi*8], rdx
cmp eax, dword [0x14000b1c8]
jb 0x140004a4d
mov byte [0x14000b1d8], 1
xor esi, esi
jmp 0x140004916
mov rbp, qword [rsp + 0x538]
mov eax, dword [rsp + 0x530]
jmp 0x1400049f1
mov eax, dword [rdx + rcx*8 + 8]
cmp eax, 1
je 0x140004aab
lea rax, [0x140002ce6]
mov qword [rdx + rcx*8], rax
jmp 0x1400048e4
mov rbp, qword [rsp + 0x538]
lea rdx, [rsp + 0x430]
lea rcx, str.failed_to_load__s_routine__d
mov r8d, edi
call fcn.140004b10
nop
jmp 0x140004a24
lea r8, [rsp + 0x430]
lea rcx, str.could_not_load__s_OSD_DLL__s
lea rdx, str.mandatory
call fcn.140004b10
nop
jmp 0x140004a24
lea rcx, str.CMDLL_not_found_in_the_registry__or_problems_reading_value
call fcn.140004b10
lea rcx, str.Forcing_usage_of_vacuous_functionality
call fcn.140004b10
nop
jmp 0x140004a24