Function at 0x140007b70
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x14000b110]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rcx, qword [0x14000c808]
lea rax, [rsp + 0x68]
mov ebx, 0x101
lea rdx, [0x1400035a8]
xor esi, esi
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea r12d, [rsi + 4]
lea r15, [0x1400035f0]
lea r13, [0x140003280]
lea ebp, [rsi + 1]
lea r14d, [rsi + 2]
cmp eax, esi
jne 0x140007cea
lea rdi, [0x14000b158]
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
xor r8d, r8d
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x54], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r11d, eax
cmp eax, esi
jne 0x140007c8f
cmp dword [rsp + 0x58], r12d
jne 0x140007c8f
cmp dword [rsp + 0x54], r12d
jne 0x140007c8f
mov eax, dword [rsp + 0x50]
mov dword [rdi + 8], eax
cmp byte [0x14000c71a], sil
je 0x140007cc9
mov dword [rsp + 0x40], eax
mov rax, qword [rdi]
mov r9d, 0x10a
mov qword [rsp + 0x38], rax
lea rax, [0x1400035b8]
mov r8, r13
mov qword [rsp + 0x30], rax
mov edx, 3
mov ecx, r14d
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
call fcn.140003f28
jmp 0x140007cc9
cmp byte [0x14000c71a], sil
je 0x140007cc9
mov rax, qword [rdi]
mov r9d, 0x114
mov r8, r13
mov qword [rsp + 0x38], rax
lea rax, [0x140003650]
mov edx, ebp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r11d
mov ecx, r14d
mov qword [rsp + 0x20], r15
call fcn.140003f28
lea rax, [0x14000b350]
add rdi, 0x18
cmp rdi, rax
jl 0x140007bf9
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140007d1b
cmp byte [0x14000c71a], sil
je 0x140007d1b
lea rcx, [0x140003698]
mov r9d, 0x11f
mov r8, r13
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov ecx, r14d
mov edx, ebp
mov qword [rsp + 0x20], r15
call fcn.140003f28
mov rcx, qword [0x14000c808]
lea rax, [rsp + 0x60]
lea rdx, [0x1400036d0]
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x60], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x140008082
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea rdx, [0x1400036e0]
xor r8d, r8d
mov dword [rsp + 0x50], 0x20a
mov dword [rsp + 0x54], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x140007ebd
cmp dword [rsp + 0x54], ebp
jne 0x140007ebd
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
mov word [rsp + 0x278], si
repne scasw ax, word [rdi]
not rcx
sub rcx, rbp
lea rdi, [rbp + rcx]
cmp rdi, rbp
jbe 0x140007e98
cmp word [rsp + rdi*2 + 0x6e], 0x5c
jne 0x140007dcd
sub rdi, rbp
cmp rdi, rbp
jbe 0x140007e98
lea rdx, [rdi + rdi]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
cmp rax, rsi
je 0x140007e73
lea r8, [rsp + 0x70]
mov rdx, rdi
mov rcx, rax
call fcn.140003ac8
lea rcx, [0x14000b448]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x14000c7f0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [0x14000b448]
mov qword [0x14000c7f0], rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [0x14000c71a], sil
je 0x140007eee
mov rax, qword [0x14000c7f0]
mov r9d, 0x156
mov r8, r13
mov qword [rsp + 0x38], rax
lea rax, [0x140003700]
mov edx, 3
mov qword [rsp + 0x30], rax
mov ecx, r14d
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
call fcn.140003f28
jmp 0x140007eee
cmp byte [0x14000c71a], sil
je 0x140007eee
lea rax, [0x140003740]
mov r9d, 0x15f
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8007000e
jmp 0x140007edc
cmp byte [0x14000c71a], sil
je 0x140007eee
lea rax, [0x140003780]
mov r9d, 0x169
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x80070057
jmp 0x140007edc
cmp byte [0x14000c71a], sil
je 0x140007eee
lea rcx, [0x1400037d0]
mov r9d, 0x171
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov r8, r13
mov edx, ebp
mov ecx, r14d
mov qword [rsp + 0x20], r15
call fcn.140003f28
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, [0x140003808]
xor r8d, r8d
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x140007f86
cmp dword [rsp + 0x54], r12d
jne 0x140007f86
cmp dword [rsp + 0x50], r12d
jne 0x140007f86
mov eax, dword [rsp + 0x58]
mov ecx, 0xfffffff
cmp eax, ecx
cmova eax, ecx
mov dword [rsp + 0x58], eax
mov dword [0x14000b138], eax
cmp byte [0x14000c71a], sil
je 0x140007fb7
mov dword [rsp + 0x38], eax
lea rax, [0x140003830]
mov r9d, 0x18e
mov qword [rsp + 0x30], rax
mov r8, r13
mov edx, 3
mov ecx, r14d
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
call fcn.140003f28
jmp 0x140007fb7
cmp byte [0x14000c71a], sil
je 0x140007fb7
lea rcx, [0x140003870]
mov r9d, 0x197
mov r8, r13
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov ecx, r14d
mov edx, ebp
mov qword [rsp + 0x20], r15
call fcn.140003f28
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, [0x1400038b8]
xor r8d, r8d
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x140008044
cmp dword [rsp + 0x54], r12d
jne 0x140008044
cmp dword [rsp + 0x50], r12d
jne 0x140008044
mov eax, dword [rsp + 0x58]
cmp eax, esi
setne byte [0x14000c502]
cmp byte [0x14000c71a], sil
je 0x140008075
mov dword [rsp + 0x38], eax
lea rax, [0x1400038d8]
mov r9d, 0x1ad
mov qword [rsp + 0x30], rax
mov r8, r13
mov edx, 3
mov ecx, r14d
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
call fcn.140003f28
jmp 0x140008075
cmp byte [0x14000c71a], sil
je 0x140008075
lea rcx, [0x140003910]
mov r9d, 0x1b6
mov r8, r13
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov ecx, r14d
mov edx, ebp
mov qword [rsp + 0x20], r15
call fcn.140003f28
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400080b3
cmp byte [0x14000c71a], sil
je 0x1400080b3
lea rcx, [0x140003958]
mov r9d, 0x1c0
mov r8, r13
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov ecx, r14d
mov edx, ebp
mov qword [rsp + 0x20], r15
call fcn.140003f28
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400084d0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret