Function at 0x14001fa70
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov r13, rdx
mov rbp, rcx
lea r14, [0x14020515c]
mov qword [rsp + 0x20], r14
lea r9, str.Server
mov r8, qword [rdx]
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x60]
call fcn.1400258e0
nop
mov rdx, qword [rsp + 0x60]
mov r8d, dword [rdx - 0x10]
or esi, 0xffffffff
test r8d, r8d
je 0x14001fb35
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp + 0x3b8]
sub rbx, 0x18
cmp rcx, rbx
je 0x14001fbfb
cmp dword [rbx + 0x10], 0
jl 0x14001fb24
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14001fb24
call fcn.140001840
mov r12, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14001fb13
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r12 + 0x18]
mov qword [rbp + 0x3b8], rax
jmp 0x14001fbfb
lea rcx, [rbp + 0x3b8]
call fcn.1400016b0
jmp 0x14001fbfb
lea rcx, [rbp + 0x158]
lea rdx, [rsp + 0x40]
call fcn.14001ce20
nop
mov rbx, qword [rsp + 0x40]
mov r8d, dword [rbx - 0x10]
test r8d, r8d
je 0x14001fbbc
lea rcx, [rbx - 0x18]
mov rdi, qword [rbp + 0x3b8]
sub rdi, 0x18
cmp rcx, rdi
je 0x14001fbe1
cmp dword [rdi + 0x10], 0
jl 0x14001fbab
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14001fbab
call fcn.140001840
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14001fb99
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rbp + 0x3b8], rax
mov rbx, qword [rsp + 0x40]
jmp 0x14001fbe1
mov rdx, rbx
lea rcx, [rbp + 0x3b8]
call fcn.1400016b0
jmp 0x14001fbe1
mov ecx, 0x96
call fcn.1400402fc
test rax, rax
je 0x14001fbe1
lea rcx, [rbp + 0x3b8]
mov r8d, 0x96
mov rdx, rax
call fcn.1400054e0
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001fbfb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsp + 0x20], r14
lea r9, str.ReportsPath
mov r8, qword [r13]
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x58]
call fcn.1400258e0
nop
mov rdx, qword [rsp + 0x58]
mov r8d, dword [rdx - 0x10]
test r8d, r8d
je 0x14001fc95
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp + 0x3c0]
sub rbx, 0x18
cmp rcx, rbx
je 0x14001fd5b
cmp dword [rbx + 0x10], 0
jl 0x14001fc84
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14001fc84
call fcn.140001840
mov r12, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14001fc73
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r12 + 0x18]
mov qword [rbp + 0x3c0], rax
jmp 0x14001fd5b
lea rcx, [rbp + 0x3c0]
call fcn.1400016b0
jmp 0x14001fd5b
lea rcx, [rbp + 0x158]
lea rdx, [rsp + 0x48]
call fcn.14001ce60
nop
mov rbx, qword [rsp + 0x48]
mov r8d, dword [rbx - 0x10]
test r8d, r8d
je 0x14001fd1c
lea rcx, [rbx - 0x18]
mov rdi, qword [rbp + 0x3c0]
sub rdi, 0x18
cmp rcx, rdi
je 0x14001fd41
cmp dword [rdi + 0x10], 0
jl 0x14001fd0b
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14001fd0b
call fcn.140001840
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14001fcf9
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rbp + 0x3c0], rax
mov rbx, qword [rsp + 0x48]
jmp 0x14001fd41
mov rdx, rbx
lea rcx, [rbp + 0x3c0]
call fcn.1400016b0
jmp 0x14001fd41
mov ecx, 0x97
call fcn.1400402fc
test rax, rax
je 0x14001fd41
lea rcx, [rbp + 0x3c0]
mov r8d, 0x97
mov rdx, rax
call fcn.1400054e0
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001fd5b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp + 0x378]
mov rdx, qword [r13]
mov rcx, 0xffffffff80000001
call fcn.140025680
mov rbx, rax
test rax, rax
je 0x14001fdd9
mov dword [rsp + 0xb0], 4
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9d, 0xffff
lea r8, str.LullTime
xor edx, edx
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x14001fdd0
mov edi, dword [rsp + 0xc0]
jmp 0x14001fdd9
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0x378], edi
call fcn.14002dca4
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14001fdfe
mov ecx, 0x80004005
call fcn.140001900
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov ecx, VarBstrFromDisp
call fcn.1400402fc
test rax, rax
je 0x14001fe37
mov r8d, VarBstrFromDisp
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400054e0
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.14017edac
mov dword [rbp + 0x360], eax
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001fe60
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001fe80
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001fea0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x14001febc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x70
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret