Function at 0x1400300b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r13, r9
mov rsi, r8
mov r14, rdx
xor r15d, r15d
mov dword [rbp - 0x30], r15d
lea r12, [0x1400de328]
mov rdx, r12
mov rcx, r14
call fcn.140002710
mov dword [rbp - 0x30], 1
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x48], rax
mov rbx, r12
shr rbx, 0x10
test rbx, rbx
jne 0x14003014f
movzx edi, r12w
xor edx, edx
mov ecx, edi
call fcn.1400017e0
test rax, rax
je 0x14003015f
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140001f70
jmp 0x14003015f
xor r8d, r8d
mov rdx, r12
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x38], rax
test rbx, rbx
jne 0x1400301a0
movzx edi, r12w
xor edx, edx
mov ecx, edi
call fcn.1400017e0
test rax, rax
je 0x1400301b0
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.140001f70
jmp 0x1400301b0
xor r8d, r8d
mov rdx, r12
lea rcx, [rbp - 0x38]
call fcn.140001e80
nop
or rbx, 0xffffffffffffffff
test r13, r13
jne 0x1400301be
mov ecx, r15d
jmp 0x1400301cf
xor eax, eax
mov rcx, rbx
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, r13
lea rcx, [rbp - 0x38]
call fcn.140001e80
mov dword [rbp - 0x50], r15d
mov dword [rbp - 0x4c], r15d
mov qword [rbp - 0x20], r15
mov dword [rbp - 0x18], r15d
mov qword [rbp - 0x10], r15
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x40], rax
test rsi, rsi
je 0x14003024e
test rsi, 0xffffffffffff0000
jne 0x14003023b
movzx edi, si
xor edx, edx
mov ecx, edi
call fcn.1400017e0
test rax, rax
je 0x140030261
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140001f70
jmp 0x140030261
xor eax, eax
mov rcx, rbx
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x140030251
mov ecx, r15d
mov r8d, ecx
mov rdx, rsi
lea rcx, [rbp - 0x40]
call fcn.140001e80
nop
lea r8, [rbp - 0x40]
lea rdx, str.SYSTEMCurrentControlSetControlClass_
lea rcx, [rbp - 0x28]
call fcn.140004230
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rbp - 0x48]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400302d1
cmp dword [rdi + 0x10], 0
jl 0x1400302c3
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400302c3
call fcn.140001b90
mov rsi, rax
mov ecx, ebx
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400302b9
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rsi + 0x18]
mov qword [rbp - 0x48], rax
jmp 0x1400302d1
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400302f0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14003030e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r9d, 0x20019
mov r8, qword [rbp - 0x48]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x20]
call fcn.140008440
mov r12, qword [rbp - 0x20]
test eax, eax
jne 0x1400303ba
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x50]
xor r8d, r8d
mov rdx, r13
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400303ba
cmp dword [rbp - 0x50], 1
jne 0x1400303ba
mov ecx, dword [rbp - 0x4c]
call fcn.1400ca8e8
mov rsi, rax
test rax, rax
je 0x1400303ba
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x50]
xor r8d, r8d
mov rdx, r13
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400303b1
xor eax, eax
mov rcx, rbx
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rsi
mov rcx, r14
call fcn.140001e80
mov rcx, rsi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
nop
test r12, r12
je 0x1400303c9
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400303e8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x140030404
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, r14
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret