Function at 0x140027fa0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x3c8]
sub rsp, 0x4b0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14007b658]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov dword [0x1400890e4], 0x34
xor r14d, r14d
mov dword [0x140089124], 0x340036
mov word [0x140089128], r14w
lea edx, [r14 + 0x52]
lea rcx, [0x14008da10]
call fcn.14000a780
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140002940
nop
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov esi, r14d
mov ecx, 0x20000
call fcn.140009a50
mov rdi, rax
test rax, rax
je 0x14002804b
xor edx, edx
mov r8d, 0x20000
mov rcx, rax
call fcn.14003f490
jmp 0x14002804e
mov rdi, r14
mov edx, 0x12
lea rcx, [0x140088768]
call fcn.14000a780
mov rcx, rax
call fcn.14000fc20
mov rbx, rax
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140086b88], rax
mov r15d, 1
test rax, rax
je 0x14002810b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x52534d42
call rax
mov ebx, eax
cmp eax, 0x16
jbe 0x1400280cd
mov r10, qword [0x140086b88]
mov r9d, eax
mov r8, rdi
xor edx, edx
mov ecx, 0x52534d42
call r10
cmp eax, 0x16
jbe 0x1400280cd
cmp eax, ebx
cmove esi, r15d
mov rax, qword [0x140086b88]
mov r9d, ebx
xor r8d, r8d
mov edx, 0x324d5054
mov ecx, 0x41435049
call rax
test eax, eax
je 0x140028107
mov edx, 0x53
lea rcx, [0x14008da10]
call fcn.14000a780
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.14000a730
test esi, esi
jne 0x140028121
call fcn.14001f2f0
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.14001fb00
test eax, eax
je 0x14002812d
lea rcx, [rdi + 8]
mov edx, dword [rdi + 4]
call fcn.140017860
mov rcx, rdi
call fcn.14003d894
lea rcx, [rsp + 0x60]
call fcn.14000a6c0
nop
mov edx, 0x13
lea rcx, [0x140088768]
call fcn.14000a780
mov rcx, rax
call fcn.14000fc20
mov rbx, rax
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140086b90], rax
call fcn.140017330
call fcn.14002b6c0
test eax, eax
jne 0x1400281b1
xor r9d, r9d
xor r8d, r8d
lea rdx, str.00000000_0000_0000_0000_000000000000
lea rcx, [0x140055950]
call qword [0x140086b90]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e6
jmp 0x1400281b4
cmp eax, 2
jne 0x140028341
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x60]
call fcn.14003f490
mov dword [rsp + 0x58], 0x100
mov edx, 0x200
lea rcx, [rbp - 0x60]
call fcn.140015420
mov rbx, qword [0x140086b90]
test rbx, rbx
je 0x14002830f
mov edx, 0x4c
lea rcx, [0x140088710]
call fcn.14000a780
mov rcx, rax
call fcn.140009de0
mov r9d, dword [rsp + 0x58]
lea r8, [rbp - 0x60]
lea rdx, str.8BE4DF61_93CA_11D2_AA0D_00E098032B8C
mov rcx, rax
call rbx
test eax, eax
jne 0x14002830f
mov qword [rsp + 0x38], r14
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x1a0]
call fcn.14003f490
mov edx, 0x5e
lea rcx, [0x140088710]
call fcn.14000a780
mov rcx, rax
call fcn.140009de0
mov qword [rsp + 0x20], rax
lea r9, [0x1400898a4]
lea r8, [0x1400573a0]
mov edx, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.14000e0c0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x1a0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002830f
mov dword [rsp + 0x5c], r14d
mov dword [rsp + 0x58], 8
lea edx, [rax + 0x4a]
lea rcx, [0x140088710]
call fcn.14000a780
mov rcx, rax
call fcn.140009de0
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x5c]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140028304
cmp dword [rsp + 0x5c], 1
jne 0x140028304
mov word [rbp - 0x60], r15w
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x14008da10]
cmp word [rbp - 0x60], 0
je 0x14002833a
mov edx, 0x4a
call fcn.14000a780
mov rdx, rax
lea r8, [rbp - 0x80]
lea rcx, [rsp + 0x38]
call fcn.14000a200
jmp 0x140028356
mov edx, 0x4b
jmp 0x140028322
lea r8, [rbp - 0x80]
lea rdx, str.Legacy
lea rcx, [rsp + 0x38]
call fcn.140015650
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14000a6e0
lea rcx, [rsp + 0x38]
call fcn.140002990
lea rcx, [rsp + 0x60]
call fcn.140009de0
mov rdx, rax
mov r8, 0xffffffffffffffff
lea rcx, [0x140088de4]
call fcn.140016490
nop
lea rcx, [rsp + 0x60]
call fcn.140002990
nop
lea rcx, [rbp - 0x80]
call fcn.140002990
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.14003da20
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret