Function at 0x1400152c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1401730f8]
xor rax, rsp
mov qword [rbp], rax
mov r14, r9
mov rsi, r8
mov r12, rdx
mov r15, rcx
xor r13d, r13d
mov edi, r13d
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x48], r13d
mov qword [rsp + 0x50], r13
mov ebx, 0x200
cmp byte [rcx + 0xb8], r13b
cmovne ebx, r13d
lea rdx, [rcx + 0x20]
cmp qword [rdx + 0x18], 8
jb 0x14001532f
mov rdx, qword [rdx]
or ebx, 0x20019
mov qword [rsp + 0x30], r13
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140015371
mov dword [rsp + 0x48], r13d
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x40], rdi
and ebx, 0x300
mov dword [rsp + 0x48], ebx
lea rbx, [r15 + 0x70]
cmp qword [rbx + 0x18], 8
jb 0x140015381
mov rdx, qword [rbx]
jmp 0x140015384
mov rdx, rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r13
mov r9, r12
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r8d, eax
test eax, eax
je 0x1400153e2
cmp eax, 0xea
je 0x1400153e2
cmp qword [rbx + 0x18], 8
jb 0x1400153b5
mov rbx, qword [rbx]
lea rax, str.RegistryProvider.cpp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0x6c
mov r9, rbx
lea rdx, str.Evaluate_registry_value_condition:_unexpected_error_0x_08x_querying_registry_value__s
lea rcx, [rsp + 0x30]
call fcn.14000b8a0
jmp 0x14001554e
add dword [rsi], 2
mov ecx, dword [rsi]
call fcn.1400b321c
mov rcx, qword [r14]
mov qword [r14], rax
test rcx, rcx
je 0x140015401
mov edx, 1
call fcn.1400b3214
mov rcx, qword [r14]
test rcx, rcx
jne 0x1400154e0
cmp byte [0x140173b48], cl
jne 0x140015421
cmp byte [0x14017bbb1], cl
je 0x1400154d9
lea rsi, [0x140102478]
mov qword [rbp - 0x50], rsi
lea rbx, [0x1401025f8]
mov qword [rbp - 0x10], rbx
xor r9d, r9d
lea rdx, str.RegistryProvider.cpp
lea rcx, [rbp - 0x50]
call fcn.140006ab0
nop
mov qword [rsp + 0x60], rsi
mov qword [rbp - 0x60], rbx
xor r9d, r9d
lea rdx, str.Evaluate_registry_value_condition:_unable_to_allocate_memory_for_reg_value
lea rcx, [rsp + 0x60]
call fcn.140006ab0
nop
cmp byte [0x140173b48], 0
je 0x140015492
cmp byte [0x14017bbb1], 0
jne 0x140015484
call fcn.140099320
test al, al
je 0x14001548b
mov byte [0x14017bbb1], 1
mov byte [0x140173b48], 0
cmp byte [0x14017bbb1], 0
je 0x1400154c5
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rcx, qword [rsp + 0x68]
mov r8d, 0x5c
call fcn.140099810
nop
lea rcx, [rsp + 0x60]
call fcn.140004280
nop
lea rcx, [rbp - 0x50]
call fcn.140004280
mov ebx, 0x8007000e
jmp 0x140015551
mov r8d, dword [rsi]
xor edx, edx
call fcn.1400b52d0
mov rax, qword [r14]
cmp qword [rbx + 0x18], 8
jb 0x1400154f7
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
mov r9, r12
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x14001554e
jle 0x140015524
movzx ebx, ax
or ebx, 0x80070000
lea rax, str.RegistryProvider.cpp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0x66
mov r8d, ebx
lea rdx, str.Evaluate_registry_condition:_error__x_querying_reg_value
lea rcx, [rsp + 0x30]
call fcn.14000b8a0
jmp 0x140015551
mov ebx, r13d
test rdi, rdi
je 0x140015564
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r13
mov eax, ebx
mov dword [rsp + 0x48], r13d
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1400b31f0
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret