Function at 0x140004b24
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x300
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov rax, qword [0x1400227c0]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov r12, r9
mov dword [rsp + 0x78], r8d
movsxd rdi, edx
mov rbx, rcx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], r9
mov r15, qword [rsp + 0x360]
mov r13, qword [rsp + 0x368]
mov r14, qword [rsp + 0x370]
mov rsi, qword [rsp + 0x378]
test r9, r9
jne 0x140004b9c
mov eax, 0x80070057
jmp 0x140004e96
call fcn.1400062ec
nop
test r15, r15
je 0x140004e6d
test r13, r13
je 0x140004e6d
test r14, r14
je 0x140004e6d
test rsi, rsi
je 0x140004e6d
mov rdx, rdi
mov rcx, rbx
call fcn.140005e14
test al, al
je 0x140004bee
mov dword [rsp + 0x70], SafeArrayDestroy
lea rdx, [0x14001f8a8]
lea rcx, [rsp + 0x70]
call sub.MSVCR110.dll__CxxThrowException
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x1e0]
call sub.MSVCR110.dll_memset
mov eax, 0x104
mov dword [rsp + 0x7c], eax
mov r8d, eax
xor edx, edx
lea rcx, [rsp + 0xd0]
call sub.MSVCR110.dll_memset
mov dword [rsp + 0x40], 0x104
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7c]
lea r8, [rsp + 0x1e0]
mov edx, dword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [r12], eax
xor ecx, ecx
test eax, eax
je 0x140004c88
mov dword [rsp + 0x80], eax
lea rdx, [0x14001f8a8]
lea rcx, [rsp + 0x80]
call sub.MSVCR110.dll__CxxThrowException
mov edi, 8
cmp dword [rsp + 0x40], ecx
jne 0x140004cd7
mov dword [rsi], ecx
mov word [rsp + 0x48], di
lea rcx, [rsp + 0x1e0]
call fcn.1400127b0
mov rdx, rax
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
xor r8d, r8d
mov word [rsp + 0x48], r8w
mov qword [r15], rcx
mov qword [r15 + 8], rdx
mov qword [r15 + 0x10], rax
lea rcx, [rsp + 0x48]
jmp 0x140004e64
mov word [rsp + 0x88], di
lea rcx, [rsp + 0x1e0]
call fcn.1400127b0
mov rdx, rax
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x88]
mov rax, qword [rsp + 0x98]
xor r8d, r8d
mov word [rsp + 0x88], r8w
mov qword [r15], rcx
mov qword [r15 + 8], rdx
mov qword [r15 + 0x10], rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
xor r15d, r15d
cmp dword [r13], r15d
jbe 0x140004e45
cmp dword [r13], 2
jbe 0x140004dfe
lea ecx, [r15 + 3]
cmp dword [r13], ecx
je 0x140004ddc
cmp dword [r13], 4
je 0x140004d67
cmp dword [r13], 7
je 0x140004dfe
jmp 0x140004e45
mov edi, dword [rsp + 0xd0]
movzx eax, word [rsp + 0x48]
cmp ax, cx
je 0x140004db0
cmp ax, 0xa
je 0x140004db0
cmp ax, 0xb
jne 0x140004d90
neg edi
sbb ax, ax
mov word [rsp + 0x50], ax
jmp 0x140004db4
lea rcx, [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jns 0x140004da6
mov ecx, eax
call fcn.140012550
mov eax, 3
mov word [rsp + 0x48], ax
mov dword [rsp + 0x50], edi
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov qword [r14], rax
mov qword [r14 + 8], rcx
mov qword [r14 + 0x10], rdx
mov word [rsp + 0x48], r15w
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
jmp 0x140004e50
mov r9, r14
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0xd0]
mov rcx, rbx
call fcn.140007384
mov dword [r12], eax
test eax, eax
jne 0x140004e50
jmp 0x140004dd4
lea rcx, [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jns 0x140004e14
mov ecx, eax
call fcn.140012550
mov word [rsp + 0x48], di
lea rcx, [rsp + 0xd0]
call fcn.1400127b0
mov rdx, rax
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov qword [r14], rcx
mov qword [r14 + 8], rdx
mov qword [r14 + 0x10], rax
jmp 0x140004dce
mov dword [r12], SafeArrayDestroy
mov dword [rsi], r15d
lea rcx, [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
jmp 0x140004e8c
mov dword [rsp + 0x74], 0x57
lea rdx, [0x14001f8a8]
lea rcx, [rsp + 0x74]
call sub.MSVCR110.dll__CxxThrowException
nop
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call fcn.140007b18
xor eax, eax
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.140011780
add rsp, 0x300
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret