Function at 0x14007534c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov r12, rcx
mov rcx, qword [0x14016d090]
lea rbx, [0x14016d090]
lea r14, str.l_f_b
mov r15d, 1
cmp rcx, rbx
je 0x1400753a3
test byte [rcx + 0x1c], r15b
je 0x1400753a3
cmp byte [rcx + 0x19], 4
jb 0x1400753a3
mov rcx, qword [rcx + 0x10]
lea edx, [r15 + 0x18]
mov r8, r14
call fcn.140004968
xor r13d, r13d
test r12, r12
jne 0x1400753c3
lea r8, str.ppPerformanceSettings
mov edx, 0x11e
lea rcx, str.base_stor_blbengine_serviceperformancemanager.cpp
call fcn.140081b60
mov ecx, 0x18
mov dword [rbp + 0x50], r13d
mov dword [rbp + 0x58], r13d
mov qword [rbp - 0x20], r13
mov dword [rbp - 0x28], 4
mov qword [r12], r13
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
jne 0x140075425
mov rcx, qword [0x14016d090]
cmp rcx, rbx
je 0x14007541b
test byte [rcx + 0x1c], r15b
je 0x14007541b
cmp byte [rcx + 0x19], 2
jb 0x14007541b
lea edx, [rax + 0x1a]
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.140004968
mov rcx, qword [0x14016d090]
mov ebx, 0x8007000e
jmp 0x14007597f
xor eax, eax
lea r8, str.OverallPerformanceSetting
mov qword [rdi], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionWindows_Block_Level_Backup
lea rax, [rbp - 0x28]
mov dword [rdi + 4], r13d
mov qword [rsp + 0x30], rax
mov r9d, 0x10
lea rax, [rbp + 0x60]
mov qword [rdi + 0x10], r13
mov qword [rsp + 0x28], rax
mov rcx, 0xffffffff80000002
lea rax, [rbp + 0x50]
mov qword [rdi + 8], r13
or dword [rbp + 0x60], 0xffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
je 0x1400754bf
mov rcx, qword [0x14016d090]
cmp rcx, rbx
je 0x1400754ac
test byte [rcx + 0x1c], r15b
je 0x1400754ac
cmp byte [rcx + 0x19], 2
jb 0x1400754ac
mov edx, 0x1b
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.140004968
mov rcx, qword [0x14016d090]
movzx ebx, si
or ebx, 0x80070000
test esi, esi
cmovle ebx, esi
jmp 0x140075977
cmp dword [rbp + 0x50], 4
je 0x1400754dd
lea r8, str.dwType__REG_DWORD
mov edx, 0x147
lea rcx, str.base_stor_blbengine_serviceperformancemanager.cpp
call fcn.140081b60
mov ecx, dword [rbp + 0x60]
mov rdx, rdi
call fcn.140075b00
mov ebx, eax
test eax, eax
jns 0x140075536
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140075977
test byte [rcx + 0x1c], r15b
je 0x140075977
cmp byte [rcx + 0x19], 2
jb 0x140075977
mov rcx, qword [rcx + 0x10]
mov edx, 0x1c
mov r8, r14
call fcn.140004968
mov rcx, qword [0x14016d090]
jmp 0x140075977
mov eax, dword [rdi]
sub eax, r15d
cmp eax, 2
jbe 0x140075558
lea r8, str._pPerformanceSettings__m_eOverallPerformanceSettingType__BLB_PST_ALWAYS_FULL____pPerformanceSettings__m_eOverallPerformanceSettingType__BLB_PST_ALWAYS_INCREMENTAL____pPerformanceSettings__m_eOverallPerformanceSettingType__BLB_PST_CUSTOM_
mov edx, 0x152
lea rcx, str.base_stor_blbengine_serviceperformancemanager.cpp
call fcn.140081b60
lea rax, [rbp + 0x58]
mov r9d, 0x20
mov qword [rsp + 0x30], rax
lea r8, str.CustomPerformanceSettings
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], r13
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionWindows_Block_Level_Backup
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
je 0x1400755cb
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x1400754ac
test byte [rcx + 0x1c], r15b
je 0x1400754ac
cmp byte [rcx + 0x19], 2
jb 0x1400754ac
mov edx, 0x1d
jmp 0x140075499
cmp dword [rbp + 0x50], 7
je 0x1400755e9
lea r8, str.dwType__REG_MULTI_SZ
mov edx, 0x162
lea rcx, str.base_stor_blbengine_serviceperformancemanager.cpp
call fcn.140081b60
mov ecx, dword [rbp + 0x58]
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rbp - 0x20], rax
mov r14, rax
test rax, rax
jne 0x140075639
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x14007541b
test byte [rcx + 0x1c], r15b
je 0x14007541b
cmp byte [rcx + 0x19], 2
jb 0x14007541b
lea edx, [r14 + 0x1e]
lea r8, str.l_f_b
jmp 0x14007540b
mov r8d, dword [rbp + 0x58]
xor edx, edx
mov rcx, r14
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x58]
mov r9d, 0x20
mov qword [rsp + 0x30], rax
lea r8, str.CustomPerformanceSettings
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], r14
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionWindows_Block_Level_Backup
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
je 0x1400756c1
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x1400754ac
test byte [rcx + 0x1c], r15b
je 0x1400754ac
cmp byte [rcx + 0x19], 2
jb 0x1400754ac
mov edx, 0x1f
lea r8, str.l_f_b
jmp 0x14007549c
cmp dword [rbp + 0x50], 7
je 0x1400756df
lea r8, str.dwType__REG_MULTI_SZ
mov edx, 0x17e
lea rcx, str.base_stor_blbengine_serviceperformancemanager.cpp
call fcn.140081b60
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x14007572a
test byte [rcx + 0x1c], r15b
je 0x14007572a
cmp byte [rcx + 0x19], 4
jb 0x14007572a
mov r9d, dword [rbp + 0x58]
lea r8, str.l_f_b
mov rcx, qword [rcx + 0x10]
mov edx, 0x20
mov qword [rsp + 0x20], r14
call fcn.14000f75c
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
mov esi, dword [rbp + 0x58]
mov r15d, r13d
shr esi, 1
cmp esi, 2
jne 0x1400757b3
cmp rcx, rax
je 0x14007575b
test byte [rcx + 0x1c], 1
je 0x14007575b
cmp byte [rcx + 0x19], 4
jb 0x14007575b
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x1f]
lea r8, str.l_f_b
call fcn.140004968
mov ebx, r13d
mov qword [r12], rdi
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x1400757a0
test byte [rcx + 0x1c], 1
je 0x1400757a0
cmp byte [rcx + 0x19], 4
jb 0x1400757a0
mov rcx, qword [rcx + 0x10]
lea r8, str.l_f_b
mov edx, 0x28
call fcn.140004968
mov eax, ebx
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp dword [rdi], 3
je 0x1400757d7
lea r8, str.pPerformanceSettings__m_eOverallPerformanceSettingType__BLB_PST_CUSTOM
mov edx, 0x18e
lea rcx, str.base_stor_blbengine_serviceperformancemanager.cpp
call fcn.140081b60
mov rcx, qword [0x14016d090]
test esi, esi
je 0x1400757f5
lea rdx, [r14 + rsi*2]
mov eax, r13d
lea rdx, [rdx - 2]
cmp word [rdx], r13w
sete al
add r15d, eax
add esi, 0xffffffff
jne 0x1400757df
dec r15d
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140075828
test byte [rcx + 0x1c], 1
je 0x140075828
cmp byte [rcx + 0x19], 4
jb 0x140075828
mov rcx, qword [rcx + 0x10]
lea r8, str.l_f_b
mov edx, 0x22
mov r9d, r15d
call fcn.140004988
mov r12d, r15d
shl r12, 2
mov rcx, r12
mov esi, r15d
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
shl rsi, 4
mov rcx, rsi
mov qword [rdi + 0x10], rax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rcx, qword [rdi + 0x10]
mov qword [rdi + 8], rax
test rcx, rcx
je 0x140075ab8
test rax, rax
je 0x140075ab8
mov r8, r12
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, qword [rdi + 8]
mov r8, rsi
xor edx, edx
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [rdi + 4], r15d
test r15d, r15d
je 0x140075aac
mov r12d, eax
or rsi, 0xffffffffffffffff
inc rsi
cmp word [r14 + rsi*2], ax
jne 0x140075894
test esi, esi
jne 0x1400758ba
lea r8, str.dwLengthOfCurrentLine___0
mov edx, 0x1b4
lea rcx, str.base_stor_blbengine_serviceperformancemanager.cpp
call fcn.140081b60
mov edx, 0x2c
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcschr]
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x140075a64
mov word [rbx], ax
mov rcx, r14
mov edx, r13d
shl rdx, 4
add rdx, qword [rdi + 8]
call qword [sym.imp.RPCRT4.dll_UuidFromStringW]
test eax, eax
jne 0x140075a2b
lea rcx, [rbx + 2]
lea r8d, [rax + 0xa]
lea rdx, [rbp - 0x18]
call qword [sym.imp.msvcrt.dll_wcstoul]
mov rcx, qword [rdi + 0x10]
mov edx, r13d
mov dword [rbp - 0x24], eax
lea rdx, [rcx + rdx*4]
mov ecx, eax
call fcn.140075b00
mov ebx, eax
test eax, eax
js 0x1400759e2
mov rax, qword [rdi + 0x10]
mov ecx, dword [rax + r12]
dec ecx
cmp ecx, 1
jbe 0x14007594d
lea r8, str._pPerformanceSettings__m_rgePerformanceSettingType_i___BLB_PST_ALWAYS_FULL____pPerformanceSettings__m_rgePerformanceSettingType_i___BLB_PST_ALWAYS_INCREMENTAL_
mov edx, 0x1d6
lea rcx, str.base_stor_blbengine_serviceperformancemanager.cpp
call fcn.140081b60
lea eax, [rsi + 1]
inc r13d
add r12, 4
lea r14, [r14 + rax*2]
mov eax, 0
cmp r13d, r15d
jb 0x140075890
mov rcx, qword [0x14016d090]
xor r13d, r13d
mov r12, qword [rbp + 0x48]
test ebx, ebx
jns 0x14007575e
lea rax, [0x14016d090]
cmp rcx, rax
je 0x1400759af
test byte [rcx + 0x1c], 1
je 0x1400759af
cmp byte [rcx + 0x19], 2
jb 0x1400759af
mov rcx, qword [rcx + 0x10]
lea r8, str.l_f_b
mov edx, 0x27
mov r9d, ebx
call fcn.140004988
test rdi, rdi
je 0x140075762
mov rcx, qword [rdi + 8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rdi + 0x10]
mov qword [rdi + 8], r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rdi
mov qword [rdi + 0x10], r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x140075762
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140075970
test byte [rcx + 0x1c], 1
je 0x140075970
cmp byte [rcx + 0x19], 2
jb 0x140075970
mov r9d, dword [rbp - 0x24]
lea r8, str.l_f_b
mov rcx, qword [rcx + 0x10]
mov edx, 0x26
call fcn.140004988
jmp 0x140075969
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140075a9f
test byte [rcx + 0x1c], 1
je 0x140075a9f
cmp byte [rcx + 0x19], 2
jb 0x140075a9f
mov rcx, qword [rcx + 0x10]
lea r8, str.l_f_b
mov edx, 0x25
mov r9, r14
call fcn.140005868
jmp 0x140075a98
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140075a9f
test byte [rcx + 0x1c], 1
je 0x140075a9f
cmp byte [rcx + 0x19], 2
jb 0x140075a9f
mov rcx, qword [rcx + 0x10]
lea r8, str.l_f_b
mov edx, 0x24
call fcn.140004968
mov rcx, qword [0x14016d090]
mov ebx, 0x80780098
xor r13d, r13d
jmp 0x14007597f
mov rcx, qword [0x14016d090]
jmp 0x140075973
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140075af3
test byte [rcx + 0x1c], 1
je 0x140075af3
cmp byte [rcx + 0x19], 2
jb 0x140075af3
mov rcx, qword [rcx + 0x10]
lea r8, str.l_f_b
mov edx, 0x23
call fcn.140004968
mov rcx, qword [0x14016d090]
mov ebx, 0x8007000e
jmp 0x140075973