Function at 0x140070ed0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0xd0
mov rax, qword [0x140430528]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor edi, edi
mov byte [rbp - 0x39], r8b
mov qword [rbp - 0x21], rdx
mov r15d, edi
mov qword [rbp - 0x29], rcx
mov r12d, edi
mov qword [rbp - 9], rdi
mov r13d, edi
mov qword [rbp - 0x11], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp + 7], rdi
test rcx, rcx
je 0x1400713b3
test rdx, rdx
je 0x1400713b3
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x38], r14
mov r14, qword [rcx]
test r14, r14
je 0x140071381
mov qword [r11 - 0x30], rsi
mov rdx, 0xffffffffffffffff
lea rsi, str.HKEY_LOCAL_MACHINE
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rsi]
mov rbx, rdx
inc rbx
cmp word [rcx + rbx*2], r12w
jne 0x140070f66
mov r8, rbx
mov rdx, r14
call fcn.140307f40
test eax, eax
je 0x140070fb6
inc rdi
add rsi, 0x10
mov rax, rdi
mov rdx, 0xffffffffffffffff
cmp rdi, 0xa
jb 0x140070f60
cmp rax, 0xa
jne 0x140070fb6
mov r8, r14
lea rdx, str.Unknown_predefined_key_in_registry_key_name:___s_
lea ecx, [rdi - 7]
call fcn.14006e290
lea ebx, [rdi - 9]
jmp 0x140071368
movzx ecx, word [r14 + rbx*2]
lea rax, [r14 + rbx*2]
cmp cx, 0x5c
je 0x140070ff0
test cx, cx
je 0x140070fe8
mov r8, r14
lea rdx, str.Unexpected_predefined_key_in_registry_key_name:___s_
mov ecx, 3
call fcn.14006e290
mov ebx, 1
jmp 0x140071368
cmp cx, 0x5c
jne 0x140070ffe
nop
movzx ecx, word [rax + 2]
add rax, 2
cmp cx, 0x5c
je 0x140070ff0
xor esi, esi
test cx, cx
mov edx, esi
cmovne rdx, rax
add rdi, rdi
lea rax, str.HKEY_LOCAL_MACHINE
mov rdi, qword [rax + rdi*8 + 8]
mov qword [rbp - 0x19], rdi
mov r12, rdi
test rdx, rdx
je 0x140071056
mov rcx, rdx
call fcn.140314264
mov qword [rbp - 0x31], rax
test rax, rax
jne 0x140071040
lea ebx, [rsi + 6]
mov r12, rax
jmp 0x140071368
lea r8, [rbp + 7]
mov rcx, rax
lea rdx, [0x1403fb2bc]
call fcn.140307ebc
mov r13, rax
lea rbx, str.REGISTRYMACHINE_
test r15, r15
je 0x14007108b
mov rdx, r13
mov rcx, r15
call fcn.1400667c0
mov rbx, rax
test rax, rax
je 0x1400712c9
mov rcx, r15
call fcn.1402ff780
mov r15, rbx
lea rbx, str.REGISTRYMACHINE_
lea rax, [rbp - 9]
mov r9d, 0x20019
mov r8d, 8
mov qword [rsp + 0x20], rax
mov rdx, r13
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140071344
mov rcx, qword [rbp - 9]
lea rax, [rbp - 1]
mov qword [rsp + 0x58], rsi
xor r9d, r9d
mov qword [rsp + 0x50], rsi
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140071325
mov eax, dword [rbp - 1]
test eax, eax
je 0x140071293
mov edx, eax
mov rax, 0xffffffffffffffff
add rdx, 2
cmovb rdx, rax
lea ecx, [rax + 2]
call fcn.1402f9040
mov qword [rbp - 0x11], rax
test rax, rax
je 0x1400712c9
mov ecx, dword [rbp - 1]
lea r9, [rbp + 0xf]
mov dword [rbp + 0x13], ecx
lea rdx, str.SymbolicLinkValue
lea rcx, [rbp + 0x13]
mov dword [rbp + 0xf], esi
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov rcx, qword [rbp - 9]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140071286
cmp dword [rbp + 0xf], 6
jne 0x140071286
cmp byte [rbp - 0x39], al
je 0x1400712dd
mov r14, qword [rbp - 0x11]
test r14, r14
je 0x1400712d3
mov rdi, rsi
mov rsi, rbx
nop dword [rax + rax]
mov rcx, qword [rsi]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x1400711a0
mov r8, rbx
mov rdx, r14
call fcn.140307f40
test eax, eax
je 0x1400711d3
inc rdi
add rsi, 0x10
mov rax, rdi
cmp rdi, 2
jb 0x140071190
cmp rax, 2
je 0x1400712d3
add rdi, rdi
lea r9, str.REGISTRYMACHINE_
mov rdx, 0xffffffffffffffff
mov rax, qword [r9 + rdi*8 + 8]
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1400711f0
xor esi, esi
mov r8d, esi
test rdx, rdx
je 0x140071227
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r9 + rdi*8 + 8]
movzx ecx, word [rax + r8*2]
mov word [r14 + r8*2], cx
inc r8
cmp r8, rdx
jb 0x140071210
sub r8, rdx
sub rdx, rbx
add r8, rbx
add rdx, rdx
lea rcx, [r14 + r8*2]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
movzx eax, word [rcx]
lea rcx, [rcx + 2]
test ax, ax
jne 0x140071240
mov rdx, qword [rbp - 0x21]
lea rcx, [rbp - 0x11]
mov r8b, 1
call fcn.140070ed0
mov ebx, eax
test eax, eax
jne 0x140071364
mov rcx, r15
call fcn.1402ff780
mov r15, qword [rbp - 0x11]
mov rcx, rsi
mov rdi, qword [rbp - 0x19]
mov qword [rbp - 0x11], rcx
jmp 0x14007128a
mov rcx, qword [rbp - 0x11]
call fcn.1402ff780
mov qword [rbp - 0x11], rsi
cmp r12, rdi
je 0x1400712a1
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r13, r13
je 0x1400712fb
lea r8, [rbp + 7]
xor ecx, ecx
lea rdx, [0x1403fb2bc]
call fcn.140307ebc
mov r13, rax
test rax, rax
je 0x1400712fb
mov r12, qword [rbp - 9]
jmp 0x140071056
mov ebx, 6
jmp 0x140071364
mov ebx, 1
jmp 0x140071364
mov rbx, qword [rbp - 0x29]
lea rdx, str.Registry_key___s__contains_a_symlink_to___s_
mov r9, qword [rbp - 0x11]
mov ecx, 3
mov r8, qword [rbx]
call fcn.14006e290
jmp 0x14007135f
mov rax, qword [rbp - 9]
mov rcx, qword [rbp - 0x21]
mov qword [rbp - 9], rsi
mov qword [rcx], rax
test r15, r15
je 0x140071321
mov rbx, qword [rbp - 0x29]
mov rcx, qword [rbx]
call fcn.1402ff780
mov qword [rbx], r15
mov r15, rsi
mov ebx, esi
jmp 0x140071364
mov rbx, qword [rbp - 0x29]
lea rdx, str.Unable_to_query_registry_key_info__key:___s___winError:__d_
mov r9d, eax
mov r8, qword [rbx]
mov ebx, 3
mov ecx, ebx
call fcn.14006e290
jmp 0x140071364
mov rbx, qword [rbp - 0x29]
lea rdx, str.Unable_to_open_registry_key_for_reading__key:___s___winError:__d_
mov r9d, eax
mov ecx, 3
mov r8, qword [rbx]
call fcn.14006e290
mov ebx, ntohs
mov r12, qword [rbp - 0x31]
mov rcx, qword [rbp - 9]
mov rsi, qword [rsp + 0xc8]
test rcx, rcx
je 0x140071386
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140071386
mov ebx, 1
mov rcx, qword [rbp - 0x11]
call fcn.1402ff780
mov rcx, r15
call fcn.1402ff780
mov rcx, r12
call fcn.1402ff780
mov r14, qword [rsp + 0xc0]
mov eax, ebx
mov rbx, qword [rsp + 0x110]
jmp 0x1400713b8
mov eax, 1
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1402f09e0
add rsp, 0xd0
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret