Function at 0x7ff82669e2c4
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push r13
push r14
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x7ff8266e2050]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor r13d, r13d
lea r8, [rsp + 0x50]
mov rcx, rdx
mov qword [rsp + 0x50], r13
xor edx, edx
mov qword [rsp + 0x38], r13
mov esi, r13d
mov dword [rsp + 0x30], r13d
mov ebx, r13d
mov dword [rsp + 0x40], r13d
call fcn.7ff82669e9d8
test eax, eax
jne 0x7ff8266aeca8
mov r14d, 0x104
lea rdx, [rbp - 0x70]
mov r8d, r14d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
nop dword [rax + rax]
test eax, eax
je 0x7ff8266aeccf
cmp eax, r14d
lea r8, [rsp + 0x30]
lea rcx, [rbp - 0x70]
cmova eax, r14d
mov r14d, eax
mov edx, eax
mov qword [rsp + 0x68], r14
call fcn.7ff82669e1ac
test byte [0x7ff8266e27f8], 1
jne 0x7ff8266aed02
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
nop dword [rax + rax]
mov rcx, rax
lea rdx, [rsp + 0x58]
call fcn.7ff82669e66c
mov r13d, dword [rsp + 0x58]
mov rsi, rax
test rax, rax
je 0x7ff8266aed22
cmp r13d, 2
jl 0x7ff82669e498
lea r11d, [r13 - 1]
mov qword [rsp + 0x58], r11
lea r14, [rax + 8]
test byte [0x7ff8266e27f8], 1
jne 0x7ff8266aed55
mov rcx, qword [r14]
lea r8, [rsp + 0x60]
mov edx, 0x400
call fcn.7ff82669e608
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x7ff82669e421
mov rcx, qword [r14]
mov eax, r8d
lea rdx, [rcx + rax*2]
movzx eax, word [rcx]
add rcx, 2
imul ebx, ebx, 0x25
add ebx, eax
cmp rcx, rdx
jne 0x7ff82669e3ea
imul eax, ebx, 0x12b9b0a5
cdq
mov ebx, eax
mov eax, 0x44b82f99
xor ebx, edx
sub ebx, edx
imul ebx
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3b9aca07
sub ebx, eax
add r14, 8
sub r11, 1
mov qword [rsp + 0x58], r11
jne 0x7ff82669e3b7
mov r14, qword [rsp + 0x68]
cmp r13d, 1
jle 0x7ff82669e498
mov r9d, dword [rsp + 0x30]
lea r8, str._08X__08X
mov edx, 0x12
mov dword [rsp + 0x20], ebx
lea rcx, [rsp + 0x70]
call fcn.7ff82669d408
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
nop dword [rax + rax]
test eax, eax
je 0x7ff8266aed76
test byte [0x7ff8266e27f8], 1
jne 0x7ff8266aedf9
mov rcx, qword [rsp + 0x38]
xor r13d, r13d
test rcx, rcx
jne 0x7ff8266aee10
mov ebx, dword [rsp + 0x30]
mov r9d, ebx
lea r8, str._08X
mov edx, 0x12
lea rcx, [rsp + 0x70]
call fcn.7ff82669d408
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
nop dword [rax + rax]
test eax, eax
je 0x7ff82669e56f
test byte [0x7ff8266e27f8], 1
jne 0x7ff8266aee3e
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x7ff82669e5d6
cmp qword [rsp + 0x50], r13
je 0x7ff82669e524
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test rsi, rsi
je 0x7ff82669e538
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jne 0x7ff82669e5ee
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.7ff8266a4480
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
mov rcx, qword [rsp + 0x38]
lea rdx, [rbp - 0x70]
xor r9d, r9d
mov dword [rsp + 0x20], r13d
mov r8, r14
call fcn.7ff82669f8e4
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x7ff8266aee26
mov eax, 4
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], eax
lea rdx, str.PermittedLspCategories
mov dword [rsp + 0x44], eax
xor r8d, r8d
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
nop dword [rax + rax]
jmp 0x7ff82669e500
test byte [0x7ff8266e27f8], 1
jne 0x7ff8266aee51
mov dword [0x7ff8266e2830], eax
jmp 0x7ff82669e50c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x7ff82669e546
adc byte [rcx], al
add byte [rax], al
add al, byte [rax]
add al, byte [rax]
or eax, 0
add byte [rax], al
add byte [rcx], dl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], ch
and byte [rax], al
add byte [rax], al
add byte [rax], al
add al, ah
invalid
add byte [rax], al
add byte [rax], ah
and byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], ah
and byte [rax], al
add byte [rax], al
add byte [rax], al
add al, ah
invalid
add dword [rdx], eax
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rax], bl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rcx], cl
add byte [rcx], cl
add byte [rax], ch
add byte [rdx], cl
add byte [rax], bh
add byte [rdx], cl
add byte [rax], bl
add byte [rcx], al
add byte [rax], dl
adc byte [rcx], al
add byte [rdx], r8b
add byte [rdx], al
add byte [0x7ff8266aed3d], cl
or dword [rax], eax
sub byte [rax], al
or al, byte [rax]
cmp byte [rax], al
or al, byte [rax]
sbb byte [rax], al
add dword [rax], eax
add byte [rax], al
add dl, dh
add dword [rdx], eax
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
sub byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add dword [rax], eax
add byte [rax], al
sbb byte [rax], al
add byte [rax], al
add al, byte [rax]
add byte [rax], al
add byte [rax], al
add byte [rax], al
sbb eax, dword [rax]
add dword [rax], eax
sub byte [rax], al
add byte [rax], al
sub byte [rax], al
add byte [rax], al
sbb byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add al, byte [rax]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], cl
add al, ah
add byte [rcx], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
invalid
add byte [rax], al
mov eax, 0x201e5
add byte [rax], al
add byte [rax + 0x201e5], bh
add byte [rax], al
add byte [rax], bl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add dword [rax], eax
add byte [rax], al
sbb byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
or eax, dword [rax]
or eax, dword [rax]
sub byte [rax], al
sbb byte [rax], al
add byte [rax], bl
add byte [rax], bl
add byte [rcx], al
add byte [rax], dl
add dword [rax], eax
add byte [rdx], al
add byte [rdx], al
add byte [0x7ff8266aee6d], cl
add byte [rbx], cl
add byte [rax], ch
add byte [rax], bl
add byte [rax], al
sbb byte [rax], al
sbb byte [rax], al
add dword [rax], eax
adc byte [rcx], al
add byte [rax], al
add al, byte [rax]
add al, byte [rax]
or eax, 0
add byte [rax], al
add byte [rcx], dl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], dh
and byte [rax], al
add byte [rax], al
add byte [rax], al