Function at 0x14000fba8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b8]
sub rsp, 0x2b8
xor esi, esi
mov dword [rsp + 0x30], 0x790073
mov r13, rcx
mov dword [rbp + 0x208], esi
lea rcx, [rbp - 0x60]
mov qword [rbp + 0x218], rsi
lea rdx, str.REGISTRY_
mov dword [rsp + 0x34], 0x740073
mov edi, esi
mov dword [rsp + 0x38], 0x6d0065
mov r14d, esi
mov dword [rsp + 0x3c], 0x320033
mov dword [rsp + 0x40], 0x5c
call fcn.1400017f8
lea rdx, str.MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
lea rcx, [rbp - 0x60]
call fcn.14000174c
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x68], 0x30
xorps xmm0, xmm0
mov qword [rsp + 0x78], rax
lea r8, [rsp + 0x68]
mov qword [rsp + 0x70], rsi
mov edx, 0x20019
mov dword [rbp - 0x80], 0x40
lea rcx, [rbp + 0x218]
movdqu xmmword [rbp - 0x78], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x14000fe21
mov r15, qword [r13 + 0x10]
mov r12, qword [rbp + 0x218]
mov edi, esi
mov dword [rbp + 0x200], esi
mov dword [rbp + 0x210], edi
test r15, r15
jne 0x14000fca6
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r15, qword [rcx + 0x30]
lea rdx, str.SystemRoot
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor r9d, r9d
lea rax, [rbp + 0x200]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x48]
mov rcx, r12
mov dword [rsp + 0x20], esi
lea r8d, [r9 + 2]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
cmp eax, 0xc0000023
jne 0x14000fd9e
mov r8d, dword [rbp + 0x200]
mov edx, 8
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor esi, esi
mov rdi, rax
test rax, rax
je 0x14000fe17
mov edx, dword [rbp + 0x200]
lea rax, [rbp + 0x200]
mov qword [rsp + 0x28], rax
lea r8d, [rsi + 2]
mov dword [rsp + 0x20], edx
mov r9, rdi
lea rdx, [rsp + 0x48]
mov rcx, r12
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
test eax, eax
js 0x14000fd8a
cmp dword [rdi + 4], 1
jne 0x14000fd85
mov r8d, dword [rdi + 8]
mov edx, 8
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
je 0x14000fd7e
mov r8d, dword [rdi + 8]
lea rdx, [rdi + 0xc]
mov rcx, rax
call fcn.14001aff0
mov eax, dword [rdi + 8]
mov r14, rsi
mov dword [rbp + 0x210], eax
xor esi, esi
jmp 0x14000fd8a
mov esi, 0xc0000017
jmp 0x14000fd8a
mov esi, 0xc0000024
mov r8, rdi
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edi, dword [rbp + 0x210]
test esi, esi
js 0x14000fe1b
xor esi, esi
test r14, r14
je 0x14000fe17
shr rdi, 1
lea r12d, [rsi + 0x5c]
mov edx, 0x104
movzx r15d, word [r14 + rdi*2 - 2]
lea rax, [rdi + 1]
cmp r15w, r12w
cmove rax, rdi
add rax, 9
cmp rax, rdx
jae 0x14000fe0c
mov r9, rdi
lea rcx, [r13 + 0x6c]
mov r8, r14
call fcn.140001838
cmp r15w, r12w
je 0x14000fdeb
mov word [r13 + rdi*2 + 0x6a], r12w
lea rcx, [r13 + 0x276]
lea rdx, [r13 + 0x6c]
call fcn.1400017f8
lea rdx, [rsp + 0x30]
call fcn.14000174c
mov edi, 1
jmp 0x14000fe21
mov ecx, 0x6f
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, esi
jmp 0x14000fe21
mov edi, dword [rbp + 0x208]
mov rcx, qword [rbp + 0x218]
test rcx, rcx
je 0x14000fe33
call qword [sym.imp.ntdll.dll_NtClose]
test r14, r14
je 0x14000fe47
mov rcx, qword [r13 + 0x10]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
add rsp, 0x2b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret