Function at 0x140004af0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r14d, r14d
lea rsi, str.NfsClnt
lea rax, [0x140004ea0]
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], r14
mov qword [rbp + 0x48], r14
mov dword [rbp + 0x40], r14d
lea r15d, [r14 + 1]
mov qword [0x14001af30], r14
lea rax, [0x140015420]
mov qword [0x14001af38], r15
lea rbx, [0x14001af20]
mov qword [0x14001af10], rax
mov qword [0x140019138], rbx
lea rdi, [0x14001af10]
mov qword [0x14001af20], r14
mov r8, qword [rdi]
lea rax, [rbx + 8]
mov qword [rsp + 0x38], rax
lea rcx, [0x1400048d0]
mov qword [rsp + 0x30], r14
lea rax, [rbp - 0x30]
mov qword [rbp - 0x30], r8
lea rdi, [rdi + 8]
mov qword [rbp - 0x28], r14
mov r9d, r15d
mov qword [rsp + 0x28], r14
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov qword [rbx + 0x20], r8
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
nop dword [rax + rax]
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140004b68
xor edx, edx
lea rcx, [0x140019878]
mov r8d, 0x1048
call sub.msvcrt.dll_memset
movdqa xmm0, xmmword [0x140016750]
lea rcx, [0x140019880]
or rbx, 0xffffffffffffffff
mov rdx, rsi
movdqu xmmword [0x140019898], xmm0
mov qword [0x140019890], rbx
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea rax, [rbp + 0x48]
mov qword [0x1400198a8], rbx
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [0x1400198b8], rbx
lea rdx, str.SOFTWAREMicrosoftClientForNFSCurrentVersionDefault
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov sil, 2
lea rbx, [0x140015db8]
test eax, eax
jne 0x140004cd7
mov rcx, qword [rbp + 0x48]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.LoggingLevel
lea rax, reloc.WS2_32.dll_closesocket
mov dword [rbp + 0x40], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
lea rdi, [0x140019138]
test eax, eax
jne 0x140004ca2
cmp dword [reloc.WS2_32.dll_closesocket], 3
jbe 0x140004cc5
mov dword [reloc.WS2_32.dll_closesocket], 3
jmp 0x140004cc5
mov rcx, qword [0x140019138]
cmp rcx, rdi
je 0x140004cc5
test byte [rcx + 0x1c], sil
je 0x140004cc5
mov rcx, qword [rcx + 0x10]
mov edx, recvfrom
mov r8, rbx
call fcn.140001008
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x140004d01
mov rcx, qword [0x140019138]
lea rdi, [0x140019138]
cmp rcx, rdi
je 0x140004d01
test byte [rcx + 0x1c], sil
je 0x140004d01
mov rcx, qword [rcx + 0x10]
mov edx, reloc.WS2_32.dll_recv
mov r8, rbx
call fcn.140001008
lea r9, [0x14001a8e0]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400152c0]
call qword [sym.imp.ADVAPI32.dll_EventRegister]
nop dword [rax + rax]
test eax, eax
jne 0x140004d3b
mov rcx, qword [0x140019138]
cmp rcx, rdi
je 0x140004d5e
test byte [rcx + 0x1c], 8
je 0x140004d5e
lea edx, [rax + 0x11]
jmp 0x140004d52
mov rcx, qword [0x140019138]
cmp rcx, rdi
je 0x140004d5e
test byte [rcx + 0x1c], sil
je 0x140004d5e
mov edx, reloc.WS2_32.dll_select
mov rcx, qword [rcx + 0x10]
mov r8, rbx
call fcn.140001008
cmp dword [reloc.WS2_32.dll_closesocket], 3
lea r9, [0x14001abf0]
mov rbx, qword [0x14001a8e0]
lea rcx, [0x140019880]
setne sil
mov r8, rbx
mov dl, sil
call fcn.140012498
test eax, eax
js 0x140004e49
lea r9, [0x14001a970]
mov r8, rbx
mov dl, sil
lea rcx, [0x140019880]
call fcn.140012498
test eax, eax
js 0x140004e49
call fcn.140004968
lea rcx, [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
nop dword [rax + rax]
test eax, eax
jne 0x140004de6
mov r9d, 0xb1
lea r8, str.base_fs_remotefs_nfs4client_nfsclientdaccess.c
xor edx, edx
lea rcx, [0x140015340]
call fcn.1400050a0
mov rcx, qword [0x14001a8e0]
test rcx, rcx
je 0x140004e05
call qword [sym.imp.ADVAPI32.dll_EventUnregister]
nop dword [rax + rax]
mov qword [0x14001a8e0], r14
xor eax, eax
lock cmpxchg dword [0x14001abf0], r15d
jne 0x140004e20
lea rcx, [0x14001abf0]
call fcn.140012568
jmp 0x140004e27
mov qword [0x14001ae20], r14
xor eax, eax
lock cmpxchg dword [0x14001a970], r15d
jne 0x140004e42
lea rcx, [0x14001a970]
call fcn.140012568
jmp 0x140004e49
mov qword [0x14001aba0], r14
mov rbx, qword [0x140019138]
cmp rbx, rdi
je 0x140004e7f
jmp 0x140004e73
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140004e70
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
nop dword [rax + rax]
mov qword [rbx + 8], r14
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140004e57
mov qword [0x140019138], rdi
mov rbx, qword [rsp + 0xa0]
xor eax, eax
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret