Function at 0x30004220
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov r11, rsp
sub rsp, 0x40
xor r14d, r14d
mov r13, rdx
mov rdi, rcx
cmp rcx, r14
mov qword [r11 - 8], r14
mov rsi, r14
mov dword [r11 + 0x50], r14d
mov r12, r14
mov dword [r11 + 0x40], r14d
mov dword [r11 + 0x58], r14d
je 0x300044d3
cmp word [rcx], r14w
je 0x300044d3
cmp rdx, r14
je 0x300044d3
cmp qword [rdx], r14
jne 0x300044d3
mov rdx, qword [str.SOFTWAREMicrosoftSharedXMLProgIDs]
lea rax, [r11 - 8]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, 0x80070000
movzx ebx, ax
or ebx, ebp
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x30004379
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, ebp
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x30004379
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
add eax, 1
mov ebp, eax
lea rdx, [rax + rax]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, r14
mov rsi, rax
je 0x3000445b
cmp rbp, r14
mov ebx, r14d
je 0x30004324
cmp rbp, 0x7fffffff
jbe 0x30004329
mov ebx, 0x80070057
cmp ebx, r14d
jl 0x300044d8
cmp rbp, r14
mov rcx, rax
mov ebx, r14d
je 0x300044b8
mov edx, 0x7ffffffe
sub rdx, rbp
sub rdi, rax
lea rax, [rdx + rbp]
cmp rax, r14
je 0x300044b3
movzx eax, word [rdi + rcx]
cmp ax, r14w
je 0x300044b3
mov word [rcx], ax
add rcx, 2
sub rbp, 1
jne 0x3000434c
jmp 0x300044b3
cmp ebx, 0x80070002
jne 0x300044d8
lea rdx, [rsp + 0x90]
mov rcx, rdi
call fcn.30003fec
cmp eax, r14d
mov ebx, eax
jl 0x300044d8
cmp dword [rsp + 0x90], r14d
je 0x300044d8
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, rdi
call fcn.300066cc
cmp eax, r14d
jl 0x30004402
mov edx, dword [rsp + 0x80]
xor ecx, ecx
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, r14
mov r12, rax
je 0x30004402
lea r8, [rsp + 0x80]
mov rdx, rax
mov rcx, rdi
call fcn.300066cc
cmp eax, r14d
jge 0x30004402
mov rcx, r12
call fcn.300034e4
mov r12, r14
mov rdx, rdi
cmp r12, r14
lea r8, [rsp + 0x98]
cmovne rdx, r12
mov rcx, 0xffffffff80000000
call fcn.30004ce8
cmp eax, r14d
mov ebx, eax
jl 0x300044d8
cmp dword [rsp + 0x98], r14d
je 0x300044d8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
add eax, 1
mov ebp, eax
lea rdx, [rax + rax]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, r14
mov rsi, rax
jne 0x30004462
mov ebx, 0x8007000e
jmp 0x300044d8
cmp rbp, r14
mov ebx, r14d
je 0x30004473
cmp rbp, 0x7fffffff
jbe 0x30004478
mov ebx, 0x80070057
cmp ebx, r14d
jl 0x300044d8
cmp rbp, r14
mov rcx, rax
mov ebx, r14d
je 0x300044b8
mov edx, 0x7ffffffe
sub rdx, rbp
sub rdi, rax
lea rax, [rdx + rbp]
cmp rax, r14
je 0x300044b3
movzx eax, word [rdi + rcx]
cmp ax, r14w
je 0x300044b3
mov word [rcx], ax
add rcx, 2
sub rbp, 1
jne 0x30004493
cmp rbp, r14
jne 0x300044c1
sub rcx, 2
mov ebx, 0x8007007a
cmp ebx, r14d
mov word [rcx], r14w
jl 0x300044d8
mov qword [r13], rsi
mov rsi, r14
jmp 0x300044d8
mov ebx, 0x80070057
mov rcx, rsi
call fcn.300034e4
mov rcx, r12
call fcn.300034e4
mov rcx, qword [rsp + 0x38]
cmp rcx, r14
je 0x300044f8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret