Function at 0x1400148d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x2b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor r12d, r12d
mov rbp, rcx
xor r9d, r9d
lea r13d, [r12 + 1]
xor r8d, r8d
xor ecx, ecx
mov edx, r13d
mov rdi, r12
mov dword [0x1400a4008], r12d
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea rax, [rsp + 0x48]
lea rdx, str.SoftwareDebugehRecvr.exe
mov r9d, r13d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x48], r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r12d
je 0x14001692d
mov ecx, dword [rsp + 0x38]
cmp ecx, r12d
ja 0x1400169b3
call fcn.14013a000
xor edx, edx
lea rcx, [rsp + 0x54]
lea r8d, [rdx + 0x2c]
call sub.msvcrt.dll_memset
lea rax, [0x14005ad88]
mov qword [rsp + 0x60], r12
movdqu xmm5, xmmword [0x14005ad78]
mov dword [rsp + 0x68], r13d
mov qword [rsp + 0x70], rax
movdqu xmmword [rsp + 0x50], xmm5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, 0x80
lea edx, [rsi - 0x78]
mov rcx, rax
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, r12
je 0x1400169c5
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x1400149d3
cmp rbx, r12
je 0x1400169cd
lea rcx, [rbx + 0x30]
lea rdx, [rsp + 0x50]
mov r8d, 0x30
call sub.msvcrt.dll_memcpy
mov qword [rbx + 0x60], rbp
mov qword [rbx + 0x68], r12
mov byte [rbx + 0x70], r12b
mov qword [rbx + 0x78], r12
mov qword [rbx + 0x18], r12
mov qword [rbx + 0x20], r12
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x28], r12
lea r9, str.Start_event_trace_in_ehRecvr.exe
mov r8d, 0x54000001
mov edx, r13d
mov rcx, rbx
mov qword [0x1400a4018], rbx
call fcn.140015bd0
mov qword [0x1400a4e10], rbp
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, str.ehRecvr
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov qword [0x1400a47f0], rax
cmp rax, r12
je 0x1400169d5
lea rbx, [0x1400a4500]
cmp rbx, 0xffffffffffffffff
je 0x140014a91
mov qword [0x1400a47c8], rbx
cmp qword [0x1400a4500], r12
je 0x140014a91
mov cl, r13b
call qword [rbx + 0x40]
add rbx, 0x48
cmp qword [rbx], r12
jne 0x140014a82
mov rbx, qword [0x1400a4710]
mov rax, qword [0x1400a4718]
jmp 0x140014aa1
cmp rbx, rax
jb 0x1400169f3
lea r14, [0x1400a4808]
mov ebx, 0x100
mov edx, 0x64
mov rcx, rbp
mov r8, r14
mov r9d, ebx
mov dword [0x1400a47d0], r13d
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r12d
je 0x140016a11
lea r8, [0x1400a4a08]
mov r9d, ebx
mov edx, 0x65
mov rcx, rbp
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r12d
je 0x140016a11
lea r8, [0x1400a4c08]
mov r9d, ebx
mov edx, 0x66
mov rcx, rbp
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r12d
je 0x140016a11
mov qword [0x1400a4800], r12
mov dword [0x1400a47d4], 0x10
mov dword [0x1400a47d8], r13d
mov dword [0x1400a47dc], 0x45
mov dword [0x1400a47e0], r12d
mov dword [0x1400a47e8], r12d
mov dword [0x1400a47ec], r12d
mov dword [0x1400a47e4], r12d
mov eax, dword [0x14005b174]
lea rcx, [rsp + 0x80]
mov dword [0x1400a47d0], r13d
mov dword [rcx], eax
movzx eax, word [0x14005b178]
cmp rsi, r12
mov word [rcx + 4], ax
je 0x140014bc0
cmp word [rsi], r12w
je 0x140014bc0
lea rax, [rsp + 0x80]
movzx ecx, word [rax]
cmp cx, r12w
je 0x140014baf
cmp word [rsi], cx
je 0x140016a3d
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
cmp rax, r12
jne 0x140014b8f
mov rcx, rsi
call qword [sym.imp.USER32.dll_CharNextW]
mov rsi, rax
cmp rax, r12
jmp 0x140014b7f
mov rsi, r12
cmp rsi, r12
jne 0x140016a4e
call fcn.140015c70
cmp eax, r12d
je 0x140016b6a
lea rax, [rsp + 0x40]
mov ebp, 0x20019
lea rdx, str.AppID
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov r9d, ebp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, r12d
jne 0x140016a6f
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, str.b622553e_eadb_445e_9493_c3df5af99268
mov r9d, ebp
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, r12d
jne 0x140016c7e
mov rbp, qword [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x90]
lea rdx, str.LocalService
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x50], rbp
call fcn.140005980
mov ecx, r12d
cmp eax, r12d
lea rax, [0x140014cd4]
mov qword [rsp + 0x50], r14
cmove ecx, r13d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov dword [0x1400a47d0], ecx
mov qword [rsp + 0x58], rax
cmp ecx, r12d
je 0x140016bba
lea rcx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
nop
jmp 0x140016b9b
mov rdi, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
lea ebx, [r12 + 4]
mov qword [rsp + 0x28], rax
lea rax, [0x1400a4008]
lea r9, [rsp + 0x40]
lea rdx, str.DbgLevel
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
lea rdx, str.StartupSleepSeconds
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp rdi, r12
je 0x140014958
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r12
jmp 0x140014958
imul ecx, ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x140014965
mov rbx, r12
jmp 0x1400149d3
mov rbx, r12
jmp 0x140014a17
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CRecvrServiceModule::Init:_Failed_to_RegisterEventSource_0x_x
mov ecx, r13d
mov r8d, eax
call fcn.140001110
nop
jmp 0x140014a65
mov rdx, qword [rbx]
cmp rdx, r12
je 0x140016a08
mov cl, r13b
call qword [rdx + 0x40]
mov rax, qword [0x1400a4718]
add rbx, 8
jmp 0x140014aa1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CRecvrServiceModule::Init:_Failed_to_LoadString_0x_x
mov ecx, r13d
movzx r8d, ax
or r8d, 0x80070000
cmp eax, r12d
cmovle r8d, eax
call fcn.140001110
jmp 0x140014b5a
mov rcx, rsi
call qword [sym.imp.USER32.dll_CharNextW]
mov rsi, rax
jmp 0x140014bc3
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
cmp eax, r12d
mov ebx, eax
jge 0x140016ab7
lea rdx, str.ehRecvr::_Failed_to_CoInitialize__0x_x
mov r8d, eax
mov ecx, r13d
call fcn.140001110
lea rcx, [0x1400a4780]
call fcn.140025e78
cmp rdi, r12
je 0x140016a89
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140001170
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
lea rdx, str.UnregServer
mov r8d, 0xb
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, r12d
jne 0x140016aee
lea rcx, [0x1400a4780]
call fcn.1400256f0
cmp eax, r12d
mov ebx, eax
jge 0x140016b53
lea rdx, str.ehRecvr::_Failed_to_UnregisterServer__0x_x
jmp 0x140016b48
lea rdx, str.RegServer
mov r8d, 9
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, r12d
jne 0x140016b0e
xor r8d, r8d
jmp 0x140016b2c
lea rdx, str.Service
mov r8d, 7
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, r12d
jne 0x140016b53
mov r8d, r13d
lea rcx, [0x1400a4780]
xor edx, edx
call fcn.140024fa0
cmp eax, r12d
mov ebx, eax
jge 0x140016b53
lea rdx, str.ehRecvr::_Failed_to_RegisterServer__0x_x
mov r8d, eax
mov ecx, r13d
call fcn.140001110
lea rcx, [0x1400a4780]
call fcn.140025e78
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x140016a7b
lea rdx, str.ehRecvr::_Not_allowed_to_start__exiting
mov ecx, r13d
call fcn.140001110
lea rcx, [0x1400a4780]
call fcn.140025e78
cmp rdi, r12
je 0x140016b93
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x140016a8b
cmp eax, r12d
jne 0x140016bc6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CRecvrServiceModule::Start:_Failed_to_start_0x_X
mov ecx, r13d
mov r8d, eax
call fcn.140001110
jmp 0x140016bc6
lea rcx, [0x1400a4780]
call fcn.1400018e0
mov rcx, qword [0x1400a4018]
lea r9, str.End_event_trace_in_ehRecvr.exe
mov r8d, 0x54000002
mov edx, r13d
call fcn.140015bd0
mov rbx, qword [0x1400a4018]
cmp rbx, r12
je 0x140016c2e
mov rax, qword [rbx + 0x20]
cmp rax, r12
je 0x140016c01
mov rcx, qword [rbx + 0x68]
call rax
mov qword [rbx + 0x68], r12
cmp byte [rbx + 0x70], r12b
je 0x140016c1a
mov rcx, qword [rbx + 0x78]
cmp rcx, r12
je 0x140016c1a
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0x78], r12
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [0x1400a4780]
call fcn.140025e78
mov rcx, qword [0x1400a4010]
cmp rcx, r12
je 0x140016c53
call qword [sym.imp.msvcrt.dll_fclose]
mov qword [0x1400a4010], r12
mov ebx, dword [0x1400a47e0]
cmp rbp, r12
je 0x140016c67
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp rsi, r12
je 0x140016a7b
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140016a7b
lea rcx, [0x1400a4780]
call fcn.140025e78
jmp 0x140016c67