Function at 0x1400e69c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor dil, dil
mov rbx, r9
xor esi, esi
mov r15, r8
mov r14d, esi
mov r12, rdx
mov r13, rcx
mov eax, 0x200
nop dword [rax + rax]
test dil, dil
jne 0x1400e6c29
mov r9d, 0x100
mov qword [rbp - 0x30], rsi
test r14d, r14d
mov rdx, r12
mov rcx, r13
cmove r9d, eax
lea rax, [rbp - 0x30]
or r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400e6c17
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x3c]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, r15
mov dword [rbp - 0x40], esi
mov dword [rbp - 0x3c], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e6c0d
mov ecx, dword [rbp - 0x40]
test ecx, ecx
je 0x1400e6c0d
mov eax, dword [rbp - 0x3c]
sub eax, 1
je 0x1400e6bbe
sub eax, 1
je 0x1400e6bbe
sub eax, 2
je 0x1400e6b30
sub eax, 3
je 0x1400e6bbe
cmp eax, 4
jne 0x1400e6c0d
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp - 0x28]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e6c0d
mov r8, qword [rbp - 0x28]
lea rdx, str._lld
lea rcx, [rbp - 0x20]
call fcn.1400268a0
lea rax, [rbp - 0x20]
cmp rbx, rax
je 0x1400e6b2a
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400e6b03
call fcn.1400556b0
mov rax, qword [rbp - 0x20]
mov dil, 1
mov qword [rbx], rax
mov eax, dword [rbp - 0x18]
mov dword [rbx + 8], eax
mov eax, dword [rbp - 0x14]
mov dword [rbx + 0xc], eax
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x20], rsi
jmp 0x1400e6c0d
mov rcx, qword [rbp - 0x20]
jmp 0x1400e6baf
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp - 0x38]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e6c0d
mov r8d, dword [rbp - 0x38]
lea rdx, [0x140281b38]
lea rcx, [rbp - 0x10]
call fcn.1400268a0
lea rax, [rbp - 0x10]
cmp rbx, rax
je 0x1400e6bab
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400e6b87
call fcn.1400556b0
mov rax, qword [rbp - 0x10]
mov dil, 1
mov qword [rbx], rax
mov eax, dword [rbp - 8]
mov dword [rbx + 8], eax
mov eax, dword [rbp - 4]
mov dword [rbx + 0xc], eax
mov qword [rbp - 8], 0
mov qword [rbp - 0x10], rsi
jmp 0x1400e6c0d
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400e6bb9
call fcn.1400556b0
mov dil, 1
jmp 0x1400e6c0d
call fcn.14001c7e0
mov rcx, qword [rbp - 0x30]
mov rsi, rax
lea rax, [rbp - 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e6c03
mov r8d, dword [rbp - 0x40]
mov rdx, rsi
shr r8d, 1
mov rcx, rbx
dec r8d
call fcn.1400246e0
mov dil, 1
mov rcx, rsi
call fcn.14001c880
xor esi, esi
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r14d
mov eax, 0x200
cmp r14d, 2
jl 0x1400e6a00
lea r11, [rsp + 0x70]
movzx eax, dil
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret