Function at 0x1400774e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov r12, rcx
mov rcx, qword [0x1401720a0]
lea rbx, [0x1401720a0]
lea r14, str.l_f_b
mov r15d, 1
cmp rcx, rbx
je 0x140077537
test byte [rcx + 0x1c], r15b
je 0x140077537
cmp byte [rcx + 0x19], 4
jb 0x140077537
mov rcx, qword [rcx + 0x10]
lea edx, [r15 + 0x18]
mov r8, r14
call fcn.140004b74
xor r13d, r13d
test r12, r12
jne 0x140077557
lea r8, str.ppPerformanceSettings
mov edx, 0x11e
lea rcx, str.base_stor_blbengine_serviceperformancemanager.cpp
call fcn.14008410c
mov ecx, 0x18
mov dword [rbp + 0x50], r13d
mov dword [rbp + 0x58], r13d
mov qword [rbp - 0x20], r13
mov dword [rbp - 0x28], 4
mov qword [r12], r13
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
jne 0x1400775b9
mov rcx, qword [0x1401720a0]
cmp rcx, rbx
je 0x1400775af
test byte [rcx + 0x1c], r15b
je 0x1400775af
cmp byte [rcx + 0x19], 2
jb 0x1400775af
lea edx, [rax + 0x1a]
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.140004b74
mov rcx, qword [0x1401720a0]
mov ebx, 0x8007000e
jmp 0x140077b13
xor eax, eax
lea r8, str.OverallPerformanceSetting
mov qword [rdi], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionWindows_Block_Level_Backup
lea rax, [rbp - 0x28]
mov dword [rdi + 4], r13d
mov qword [rsp + 0x30], rax
mov r9d, 0x10
lea rax, [rbp + 0x60]
mov qword [rdi + 0x10], r13
mov qword [rsp + 0x28], rax
mov rcx, 0xffffffff80000002
lea rax, [rbp + 0x50]
mov qword [rdi + 8], r13
or dword [rbp + 0x60], 0xffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
je 0x140077653
mov rcx, qword [0x1401720a0]
cmp rcx, rbx
je 0x140077640
test byte [rcx + 0x1c], r15b
je 0x140077640
cmp byte [rcx + 0x19], 2
jb 0x140077640
mov edx, 0x1b
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.140004b74
mov rcx, qword [0x1401720a0]
movzx ebx, si
or ebx, 0x80070000
test esi, esi
cmovle ebx, esi
jmp 0x140077b0b
cmp dword [rbp + 0x50], 4
je 0x140077671
lea r8, str.dwType__REG_DWORD
mov edx, 0x147
lea rcx, str.base_stor_blbengine_serviceperformancemanager.cpp
call fcn.14008410c
mov ecx, dword [rbp + 0x60]
mov rdx, rdi
call fcn.140077c98
mov ebx, eax
test eax, eax
jns 0x1400776ca
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x140077b0b
test byte [rcx + 0x1c], r15b
je 0x140077b0b
cmp byte [rcx + 0x19], 2
jb 0x140077b0b
mov rcx, qword [rcx + 0x10]
mov edx, 0x1c
mov r8, r14
call fcn.140004b74
mov rcx, qword [0x1401720a0]
jmp 0x140077b0b
mov eax, dword [rdi]
sub eax, r15d
cmp eax, 2
jbe 0x1400776ec
lea r8, str._pPerformanceSettings__m_eOverallPerformanceSettingType__BLB_PST_ALWAYS_FULL____pPerformanceSettings__m_eOverallPerformanceSettingType__BLB_PST_ALWAYS_INCREMENTAL____pPerformanceSettings__m_eOverallPerformanceSettingType__BLB_PST_CUSTOM_
mov edx, 0x152
lea rcx, str.base_stor_blbengine_serviceperformancemanager.cpp
call fcn.14008410c
lea rax, [rbp + 0x58]
mov r9d, 0x20
mov qword [rsp + 0x30], rax
lea r8, str.CustomPerformanceSettings
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], r13
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionWindows_Block_Level_Backup
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
je 0x14007775f
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x140077640
test byte [rcx + 0x1c], r15b
je 0x140077640
cmp byte [rcx + 0x19], 2
jb 0x140077640
mov edx, 0x1d
jmp 0x14007762d
cmp dword [rbp + 0x50], 7
je 0x14007777d
lea r8, str.dwType__REG_MULTI_SZ
mov edx, 0x162
lea rcx, str.base_stor_blbengine_serviceperformancemanager.cpp
call fcn.14008410c
mov ecx, dword [rbp + 0x58]
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rbp - 0x20], rax
mov r14, rax
test rax, rax
jne 0x1400777cd
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400775af
test byte [rcx + 0x1c], r15b
je 0x1400775af
cmp byte [rcx + 0x19], 2
jb 0x1400775af
lea edx, [r14 + 0x1e]
lea r8, str.l_f_b
jmp 0x14007759f
mov r8d, dword [rbp + 0x58]
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x58]
mov r9d, 0x20
mov qword [rsp + 0x30], rax
lea r8, str.CustomPerformanceSettings
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], r14
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionWindows_Block_Level_Backup
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
je 0x140077855
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x140077640
test byte [rcx + 0x1c], r15b
je 0x140077640
cmp byte [rcx + 0x19], 2
jb 0x140077640
mov edx, 0x1f
lea r8, str.l_f_b
jmp 0x140077630
cmp dword [rbp + 0x50], 7
je 0x140077873
lea r8, str.dwType__REG_MULTI_SZ
mov edx, 0x17e
lea rcx, str.base_stor_blbengine_serviceperformancemanager.cpp
call fcn.14008410c
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400778be
test byte [rcx + 0x1c], r15b
je 0x1400778be
cmp byte [rcx + 0x19], 4
jb 0x1400778be
mov r9d, dword [rbp + 0x58]
lea r8, str.l_f_b
mov rcx, qword [rcx + 0x10]
mov edx, 0x20
mov qword [rsp + 0x20], r14
call fcn.1400100f0
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
mov esi, dword [rbp + 0x58]
mov r15d, r13d
shr esi, 1
cmp esi, 2
jne 0x140077947
cmp rcx, rax
je 0x1400778ef
test byte [rcx + 0x1c], 1
je 0x1400778ef
cmp byte [rcx + 0x19], 4
jb 0x1400778ef
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x1f]
lea r8, str.l_f_b
call fcn.140004b74
mov ebx, r13d
mov qword [r12], rdi
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x140077934
test byte [rcx + 0x1c], 1
je 0x140077934
cmp byte [rcx + 0x19], 4
jb 0x140077934
mov rcx, qword [rcx + 0x10]
lea r8, str.l_f_b
mov edx, 0x28
call fcn.140004b74
mov eax, ebx
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp dword [rdi], 3
je 0x14007796b
lea r8, str.pPerformanceSettings__m_eOverallPerformanceSettingType__BLB_PST_CUSTOM
mov edx, 0x18e
lea rcx, str.base_stor_blbengine_serviceperformancemanager.cpp
call fcn.14008410c
mov rcx, qword [0x1401720a0]
test esi, esi
je 0x140077989
lea rdx, [r14 + rsi*2]
mov eax, r13d
lea rdx, [rdx - 2]
cmp word [rdx], r13w
sete al
add r15d, eax
add esi, 0xffffffff
jne 0x140077973
dec r15d
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400779bc
test byte [rcx + 0x1c], 1
je 0x1400779bc
cmp byte [rcx + 0x19], 4
jb 0x1400779bc
mov rcx, qword [rcx + 0x10]
lea r8, str.l_f_b
mov edx, 0x22
mov r9d, r15d
call fcn.140004b98
mov r12d, r15d
shl r12, 2
mov rcx, r12
mov esi, r15d
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
shl rsi, 4
mov rcx, rsi
mov qword [rdi + 0x10], rax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rcx, qword [rdi + 0x10]
mov qword [rdi + 8], rax
test rcx, rcx
je 0x140077c4c
test rax, rax
je 0x140077c4c
mov r8, r12
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, qword [rdi + 8]
mov r8, rsi
xor edx, edx
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [rdi + 4], r15d
test r15d, r15d
je 0x140077c40
mov r12d, eax
or rsi, 0xffffffffffffffff
inc rsi
cmp word [r14 + rsi*2], ax
jne 0x140077a28
test esi, esi
jne 0x140077a4e
lea r8, str.dwLengthOfCurrentLine___0
mov edx, 0x1b4
lea rcx, str.base_stor_blbengine_serviceperformancemanager.cpp
call fcn.14008410c
mov edx, 0x2c
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcschr]
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x140077bf8
mov word [rbx], ax
mov rcx, r14
mov edx, r13d
shl rdx, 4
add rdx, qword [rdi + 8]
call qword [sym.imp.RPCRT4.dll_UuidFromStringW]
test eax, eax
jne 0x140077bbf
lea rcx, [rbx + 2]
lea r8d, [rax + 0xa]
lea rdx, [rbp - 0x18]
call qword [sym.imp.msvcrt.dll_wcstoul]
mov rcx, qword [rdi + 0x10]
mov edx, r13d
mov dword [rbp - 0x24], eax
lea rdx, [rcx + rdx*4]
mov ecx, eax
call fcn.140077c98
mov ebx, eax
test eax, eax
js 0x140077b76
mov rax, qword [rdi + 0x10]
mov ecx, dword [rax + r12]
dec ecx
cmp ecx, 1
jbe 0x140077ae1
lea r8, str._pPerformanceSettings__m_rgePerformanceSettingType_i___BLB_PST_ALWAYS_FULL____pPerformanceSettings__m_rgePerformanceSettingType_i___BLB_PST_ALWAYS_INCREMENTAL_
mov edx, 0x1d6
lea rcx, str.base_stor_blbengine_serviceperformancemanager.cpp
call fcn.14008410c
lea eax, [rsi + 1]
inc r13d
add r12, 4
lea r14, [r14 + rax*2]
mov eax, 0
cmp r13d, r15d
jb 0x140077a24
mov rcx, qword [0x1401720a0]
xor r13d, r13d
mov r12, qword [rbp + 0x48]
test ebx, ebx
jns 0x1400778f2
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x140077b43
test byte [rcx + 0x1c], 1
je 0x140077b43
cmp byte [rcx + 0x19], 2
jb 0x140077b43
mov rcx, qword [rcx + 0x10]
lea r8, str.l_f_b
mov edx, 0x27
mov r9d, ebx
call fcn.140004b98
test rdi, rdi
je 0x1400778f6
mov rcx, qword [rdi + 8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rdi + 0x10]
mov qword [rdi + 8], r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rdi
mov qword [rdi + 0x10], r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x1400778f6
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x140077b04
test byte [rcx + 0x1c], 1
je 0x140077b04
cmp byte [rcx + 0x19], 2
jb 0x140077b04
mov r9d, dword [rbp - 0x24]
lea r8, str.l_f_b
mov rcx, qword [rcx + 0x10]
mov edx, 0x26
call fcn.140004b98
jmp 0x140077afd
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x140077c33
test byte [rcx + 0x1c], 1
je 0x140077c33
cmp byte [rcx + 0x19], 2
jb 0x140077c33
mov rcx, qword [rcx + 0x10]
lea r8, str.l_f_b
mov edx, 0x25
mov r9, r14
call fcn.140005afc
jmp 0x140077c2c
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x140077c33
test byte [rcx + 0x1c], 1
je 0x140077c33
cmp byte [rcx + 0x19], 2
jb 0x140077c33
mov rcx, qword [rcx + 0x10]
lea r8, str.l_f_b
mov edx, 0x24
call fcn.140004b74
mov rcx, qword [0x1401720a0]
mov ebx, 0x80780098
xor r13d, r13d
jmp 0x140077b13
mov rcx, qword [0x1401720a0]
jmp 0x140077b07
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x140077c87
test byte [rcx + 0x1c], 1
je 0x140077c87
cmp byte [rcx + 0x19], 2
jb 0x140077c87
mov rcx, qword [rcx + 0x10]
lea r8, str.l_f_b
mov edx, 0x23
call fcn.140004b74
mov rcx, qword [0x1401720a0]
mov ebx, 0x8007000e
jmp 0x140077b07