Function at 0x1000f196c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x410
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x400], rax
mov eax, dword [rsp + 0xcc]
xor r14d, r14d
mov rsi, rcx
and eax, 0xfffffffe
lea rcx, [r11 - 0x368]
lea r13d, [r14 + 0x18]
and eax, 0xfffffffb
mov qword [r11 - 0x378], rcx
mov qword [r11 - 0x388], r14
or eax, 2
mov dword [r11 - 0x380], r13d
lea rcx, [r11 - 0x318]
mov dword [rsp + 0xcc], eax
mov eax, dword [rsp + 0x11c]
mov qword [r11 - 0x338], r14
and eax, 0xfffffffe
mov dword [r11 - 0x330], r13d
mov qword [r11 - 0x328], rcx
and eax, 0xfffffffb
mov rdi, rdx
mov ebx, r14d
or eax, 2
mov qword [rsp + 0x50], r14
mov r12, r14
mov dword [rsp + 0x11c], eax
mov dword [r11 - 0x370], r14d
mov word [r11 - 0x368], r14w
mov dword [r11 - 0x320], r14d
mov word [r11 - 0x318], r14w
cmp rdx, r14
jne 0x1000f1a67
lea r8, [0x10000f6d8]
lea rcx, [0x10000f138]
mov edx, 0x374
call fcn.10009a050
mov rax, qword [rsp + 0xc0]
mov word [rax], r14w
mov dword [rsp + 0xc8], r14d
jmp 0x1000f1a83
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0xb0]
mov rdx, rdi
mov r8d, eax
call fcn.1000f2f98
mov edx, 0x5c
mov rcx, rdi
call sub.msvcrt.dll_wcschr
mov rbp, rax
cmp rax, r14
je 0x1000f1ad8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x100]
mov rdx, rbp
mov r8d, eax
call fcn.1000f2f98
mov edx, dword [rsp + 0xc8]
sub edx, dword [rsp + 0x118]
cmp edx, dword [rsp + 0xc8]
jae 0x1000f1ad8
lea rcx, [rsp + 0xb0]
call fcn.1000fd0c0
or ebp, 0xffffffff
lea rdx, [0x10000f6e8]
lea rcx, [rsp + 0xb0]
mov r8d, 1
mov r9d, ebp
mov dword [rsp + 0x20], r14d
call fcn.1000f2cf8
cmp eax, r14d
jne 0x1000f1e11
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
cmp rcx, rbp
je 0x1000f1b3d
test byte [rcx + 0x1c], 1
je 0x1000f1b3d
cmp byte [rcx + 0x19], 4
jb 0x1000f1b3d
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003108]
mov edx, 0x15
mov r9, rdi
call fcn.10001db08
mov ecx, 0x2000
call qword [sym.imp.msvcrt.dll_malloc]
mov r12, rax
cmp rax, r14
jne 0x1000f1b65
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x8007000e
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
cmp r12, r14
jne 0x1000f1b83
mov ebx, 0x8007000e
mov dword [rsp + 0x70], 0x387
lea r9, [0x10000f4b8]
jmp 0x1000f1eda
xor edx, edx
mov r8d, 0x2000
mov rcx, r12
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x50]
lea rdx, [0x10000f710]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
je 0x1000f1c08
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x1000f1f13
test byte [rcx + 0x1c], 1
je 0x1000f1f13
cmp byte [rcx + 0x19], 3
jb 0x1000f1f13
mov rcx, qword [rcx + 0x10]
lea r9, [0x10000f710]
lea r8, [0x100003108]
mov edx, 0x16
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
jmp 0x1000f1f13
mov r13d, r14d
lea rcx, [rsp + 0x1f0]
xor edx, edx
mov r8d, 0x104
mov dword [rsp + 0x40], 0x104
mov dword [rsp + 0x48], 0x2000
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x50]
lea r11, [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x1f0]
mov edx, r13d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc r13d
mov edi, eax
cmp eax, r14d
jne 0x1000f1d58
cmp dword [rsp + 0x44], 2
jne 0x1000f1d5f
lea rcx, [rsp + 0x1a0]
xor r8d, r8d
mov rdx, r12
call fcn.1000f29c4
mov r11d, dword [rsp + 0x16c]
lea rax, [rsp + 0x170]
and r11d, 0xfffffffe
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x58]
and r11d, 0xfffffffb
mov qword [rsp + 0x150], r14
mov dword [rsp + 0x158], 0x18
or r11d, 2
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x168], r14d
mov dword [rsp + 0x16c], r11d
mov word [rsp + 0x170], r14w
call fcn.1000f2a34
lea rdx, [rsp + 0x150]
mov rcx, rax
call fcn.1000fd19c
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x150]
xor r9d, r9d
xor r8d, r8d
call fcn.1000f2aac
lea rdx, [rsp + 0x150]
mov rcx, rsi
call fcn.1000f160c
cmp eax, r14d
mov ebx, eax
jl 0x1000f1daa
lea rcx, [rsp + 0x150]
call fcn.1000f2a80
lea rcx, [rsp + 0x1a0]
call fcn.1000f2a80
jmp 0x1000f1c0b
cmp eax, 0x103
je 0x1000f1d9c
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x1000f1d9c
test byte [rcx + 0x1c], 1
je 0x1000f1d9c
cmp byte [rcx + 0x19], 3
jb 0x1000f1d9c
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
lea r9, [0x10000f6e8]
lea r8, [0x100003108]
mov edx, 0x17
mov dword [rsp + 0x20], r13d
call fcn.10001e4b0
cmp edi, r14d
jne 0x1000f1f13
jmp 0x1000f1c0b
lea rax, [0x100167d30]
lea r9, [0x10000f788]
lea r8, [0x10000f2b0]
mov qword [rsp + 0x58], rax
lea rax, [0x10000f1c0]
lea rdx, [0x10000fa40]
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x70], 0x3b5
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rsi
call sym.wbengine.exe_public:_void___cdecl_CTraceFailureHelper::TraceMessage_unsigned_short_int_const____ptr64____ptr64
lea rcx, [rsp + 0x150]
call fcn.1000f2a80
lea rcx, [rsp + 0x1a0]
call fcn.1000f2a80
jmp 0x1000f1f13
lea rdx, [0x10000f7a8]
lea rcx, [rsp + 0xb0]
mov r9d, ebp
mov r8d, 1
mov dword [rsp + 0x20], r14d
call fcn.1000f2cf8
cmp eax, r14d
jne 0x1000f1e99
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
cmp rcx, rbp
je 0x1000f1e6d
test byte [rcx + 0x1c], 1
je 0x1000f1e6d
cmp byte [rcx + 0x19], 4
jb 0x1000f1e6d
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003108]
mov edx, r13d
mov r9, rdi
call fcn.10001db08
lea rdx, [rsp + 0x100]
mov rcx, rsi
call fcn.1000f160c
cmp eax, r14d
mov ebx, eax
jge 0x1000f1f13
mov dword [rsp + 0x70], 0x3c8
lea r9, [0x10000f7c8]
jmp 0x1000f1eda
lea rcx, [rsp + 0x1a0]
xor r8d, r8d
mov rdx, rdi
call fcn.1000f29c4
mov rcx, rsi
mov rdx, rax
call fcn.1000f160c
lea rcx, [rsp + 0x1a0]
mov ebx, eax
call fcn.1000f2a80
cmp ebx, r14d
jge 0x1000f1f13
mov dword [rsp + 0x70], 0x3cf
lea r9, [0x10000f7f0]
lea rax, [0x100167d30]
lea r8, [0x10000f2b0]
lea rdx, [0x10000fa40]
mov qword [rsp + 0x58], rax
lea rax, [0x10000f1c0]
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x68], rax
call sym.wbengine.exe_public:_void___cdecl_CTraceFailureHelper::TraceMessage_unsigned_short_int_const____ptr64____ptr64
mov rcx, qword [rsp + 0x50]
cmp rcx, r14
je 0x1000f1f23
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_free]
lea rcx, [rsp + 0x100]
call fcn.1000f2a80
lea rcx, [rsp + 0xb0]
call fcn.1000f2a80
mov eax, ebx
mov rcx, qword [rsp + 0x400]
xor rcx, rsp
call fcn.10014e600
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret