Function at 0x14000f6a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xd00]
sub rsp, 0xe00
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0xe40], rbx
mov rax, qword [0x140030030]
xor rax, rsp
mov qword [rbp + 0xcf0], rax
mov r15, rdx
mov r14, rcx
xor edi, edi
mov word [rbp + 0x90], di
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x92]
call fcn.140014ee0
mov esi, edi
mov rcx, qword [r14]
test rcx, rcx
je 0x14000f83b
mov dword [rsp + 0x60], 0x208
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
xor r8d, r8d
lea rdx, str.FileName
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000f83b
mov eax, dword [rsp + 0x64]
dec eax
cmp eax, 1
ja 0x14000f83b
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14000f776
test al, 1
jne 0x14000f83b
shr rax, 1
cmp word [rbp + rax*2 + 0x8e], si
je 0x14000f77d
jmp 0x14000f83b
mov word [rbp + 0x90], di
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0x90]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], si
jne 0x14000f792
inc ebx
mov r9d, 0x80
lea r8, [rsp + 0x78]
mov edx, ebx
lea rcx, [rsp + 0x70]
call fcn.14000e240
movsxd rdx, ebx
add rdx, rdx
mov r9, rdx
lea r8, [rbp + 0x90]
mov rcx, qword [rsp + 0x70]
call fcn.140012db8
test eax, eax
je 0x14000f807
cmp eax, 0xc
je 0x14000f7fc
cmp eax, 0x16
je 0x14000f7f1
cmp eax, 0x22
je 0x14000f7f1
cmp eax, 0x50
je 0x14000f807
mov ecx, 0x80004005
call fcn.14000d5a0
int3
mov ecx, 0x80070057
call fcn.14000d5a0
int3
mov ecx, 0x8007000e
call fcn.14000d5a0
nop
or r9, 0xffffffffffffffff
mov r8, qword [rsp + 0x70]
mov edx, 0x104
mov rcx, r15
call fcn.140014584
nop
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x14000fcd6
call fcn.140012b08
jmp 0x14000fcd6
mov r8d, 0x104
lea rdx, [rbp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov word [rbp + 0x8d0], di
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x8d2]
call fcn.140014ee0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0x90]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], si
jne 0x14000f880
inc ebx
mov r9d, 0x80
lea r8, [rsp + 0x78]
mov edx, ebx
lea rcx, [rsp + 0x70]
call fcn.14000e240
movsxd rdx, ebx
add rdx, rdx
mov r9, rdx
lea r8, [rbp + 0x90]
mov rcx, qword [rsp + 0x70]
call fcn.140012db8
test eax, eax
je 0x14000f8f5
cmp eax, 0xc
je 0x14000f8ea
cmp eax, 0x16
je 0x14000f8df
cmp eax, 0x22
je 0x14000f8df
cmp eax, 0x50
je 0x14000f8f5
mov ecx, 0x80004005
call fcn.14000d5a0
int3
mov ecx, 0x80070057
call fcn.14000d5a0
int3
mov ecx, 0x8007000e
call fcn.14000d5a0
nop
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], 0x100
lea rax, [rbp + 0x8d0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call fcn.140013a04
nop
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x14000f940
call fcn.140012b08
call fcn.14000fd10
mov rcx, rax
mov r8d, 0x104
lea rdx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov word [rbp + 0x80], di
xor eax, eax
mov dword [rbp + 0x82], eax
mov word [rbp + 0x86], ax
mov word [rbp + 0x4b0], di
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x4b2]
call fcn.140014ee0
mov word [rbp + 0xae0], di
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0xae2]
call fcn.140014ee0
mov word [rbp + 0x6c0], di
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x6c2]
call fcn.140014ee0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0x90]
or rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000f9e0
inc ebx
mov r9d, 0x80
lea r8, [rsp + 0x78]
mov edx, ebx
lea rcx, [rsp + 0x70]
call fcn.14000e240
movsxd rdx, ebx
add rdx, rdx
mov r9, rdx
lea r8, [rbp + 0x90]
mov rcx, qword [rsp + 0x70]
call fcn.140012db8
test eax, eax
je 0x14000fa56
cmp eax, 0xc
je 0x14000fa4b
cmp eax, 0x16
je 0x14000fa40
cmp eax, 0x22
je 0x14000fa40
cmp eax, 0x50
je 0x14000fa56
mov ecx, 0x80004005
call fcn.14000d5a0
int3
mov ecx, 0x80070057
call fcn.14000d5a0
int3
mov ecx, 0x8007000e
call fcn.14000d5a0
nop
mov qword [rsp + 0x40], 0x100
lea rax, [rbp + 0x6c0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x100
lea rax, [rbp + 0xae0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x100
lea r9, [rbp + 0x4b0]
mov r8d, 3
lea rdx, [rbp + 0x80]
mov rcx, qword [rsp + 0x70]
call fcn.140013a04
nop
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x14000fabc
call fcn.140012b08
mov word [rbp + 0x2a0], di
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x2a2]
call fcn.140014ee0
mov rcx, qword [r14]
test rcx, rcx
je 0x14000fc30
mov dword [rsp + 0x60], 0x208
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
xor r8d, r8d
lea rdx, str.TracePath
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000fc30
mov eax, dword [rsp + 0x64]
dec eax
cmp eax, 1
ja 0x14000fc30
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14000fb50
test al, 1
jne 0x14000fc30
shr rax, 1
cmp word [rbp + rax*2 + 0x8e], 0
je 0x14000fb57
jmp 0x14000fc30
mov word [rbp + 0x90], di
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0x90]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000fb70
inc ebx
mov r9d, 0x80
lea r8, [rsp + 0x78]
mov edx, ebx
lea rcx, [rsp + 0x70]
call fcn.14000e240
movsxd rdx, ebx
add rdx, rdx
mov r9, rdx
lea r8, [rbp + 0x90]
mov rcx, qword [rsp + 0x70]
call fcn.140012db8
test eax, eax
je 0x14000fbe6
cmp eax, 0xc
je 0x14000fbdb
cmp eax, 0x16
je 0x14000fbd0
cmp eax, 0x22
je 0x14000fbd0
cmp eax, 0x50
je 0x14000fbe6
mov ecx, 0x80004005
call fcn.14000d5a0
int3
mov ecx, 0x80070057
call fcn.14000d5a0
int3
mov ecx, 0x8007000e
call fcn.14000d5a0
nop
mov r8, qword [rsp + 0x70]
mov edx, 0x104
lea rcx, [rbp + 0x2a0]
call fcn.140012e94
nop
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x14000fc11
call fcn.140012b08
lea rcx, [rbp + 0x2a0]
call fcn.140010900
mov edx, 0x104
lea rcx, [rbp + 0x2a0]
call fcn.14000f330
jmp 0x14000fc6a
lea rax, [rbp + 0x4b0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, str._s_s
or r8, 0xffffffffffffffff
mov edx, 0x104
lea rcx, [rbp + 0x2a0]
call fcn.140014a80
mov esi, eax
test eax, eax
js 0x14000fcd6
call fcn.14000f690
mov rbx, rax
call fcn.14000fd20
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x48], eax
lea rax, str..x64
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x6c0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xae0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x8d0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x20], rax
lea r9, str._s_s._s_s_s._u_s.trc3
or r8, 0xffffffffffffffff
mov edx, 0x104
mov rcx, r15
call fcn.140014a80
mov esi, eax
test esi, esi
setns al
mov rcx, qword [rbp + 0xcf0]
xor rcx, rsp
call fcn.140013760
mov rbx, qword [rsp + 0xe40]
add rsp, 0xe00
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret