Function at 0x140065200
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x618
mov rax, qword [0x140100140]
xor rax, rsp
mov qword [rsp + 0x600], rax
mov dword [rsp + 0x30], 0
mov eax, 4
mov eax, eax
mov ecx, dword [0x1401031c0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x140102ae0], eax
jle 0x140065279
lea rcx, [0x140102ae0]
call fcn.140097b60
cmp dword [0x140102ae0], 0xffffffff
jne 0x140065279
lea rcx, [0x1400cd4d0]
call fcn.140097adc
lea rcx, [0x140102ae0]
call fcn.140097af4
nop
lea rcx, [0x140100048]
call fcn.14003bab0
movzx eax, al
test eax, eax
jne 0x1400652b8
lea rdx, [0x140100048]
mov rcx, qword [rsp + 0x620]
call fcn.140020230
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x620]
jmp 0x140065981
lea rcx, [rsp + 0x3b8]
call fcn.140020a60
nop
lea rcx, [rsp + 0x188]
call fcn.14006de00
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x3b8]
call fcn.140025570
lea rcx, [rsp + 0x188]
call fcn.140002090
nop
jmp 0x1400652fa
mov dword [rsp + 0x3b0], 0x200
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x60], rax
lea rdx, str.TDZIybXFlsemZS3ZVhkWeG9KENm98KBXhdfQVdKYVn9VxbFRI2QnoDBX3wb9eF1BOU1dWTYlVvrVEhfPcgZftfA8rG_siFuf4M7YaBUqZeKVr7nbfo_hhinHKL94azYf18P4gXVZjl_86par4kqH6iyV3wD46Hk5GpumNP7mJyoHmQ_89
mov rcx, qword [rsp + 0x60]
call fcn.140001b80
mov qword [rsp + 0x68], rax
mov r8d, 0x11
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x208]
call fcn.14006cf50
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x30]
or eax, 2
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x78]
call fcn.140033350
mov rdx, rax
lea rcx, [rsp + 0x3b8]
call fcn.140004bb0
movzx eax, al
test eax, eax
jne 0x14006553e
lea rax, [rsp + 0x2c8]
mov qword [rsp + 0x80], rax
lea rdx, str.elRaRNUVnBZjlRbQ2JVaMGtlXT1BL3ZmkBocFFRxAXxyXUGYETRlB5HZ0J5OYwUEhJUt60FQcngEHYqKJA0S8ORcqUWJGYherrgzK1L7a0fU56q_5WDEpSaxMEk5dctR10lROEHq4UP9qn00FS8i2_AKun2P31TA66zT3JQ_89
mov rcx, qword [rsp + 0x80]
call fcn.140001b80
mov qword [rsp + 0x88], rax
mov r8d, 0x11
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x1e8]
call fcn.14006cf50
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x98], rax
mov eax, dword [rsp + 0x30]
or eax, 4
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x98]
call fcn.140033350
mov rdx, rax
lea rcx, [rsp + 0x3b8]
call fcn.140004bb0
movzx eax, al
test eax, eax
jne 0x14006553e
lea rax, [rsp + 0x2e8]
mov qword [rsp + 0xa0], rax
lea rdx, str.Qk9pVUUNwCbTV0FTHl4YU0tBpb3Zy1f1lhdc0BdYBVl8sSUhjaZnFfWRnJiIWWFz3QEAFIRHxJiSGN73cV9Gkcn8kTnC1F_6JsWQRezLV9e5TqNr3LEfNH6AUWWmCDRdjdyaO1HmDPpujU67jYJxO5TvPF6LsTgNhGwjjM9u45XBZ5idHfadn4EbN5kis_89
mov rcx, qword [rsp + 0xa0]
call fcn.140001b80
mov qword [rsp + 0xa8], rax
mov r8d, 0x11
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0x1c8]
call fcn.14006cf50
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], rax
mov eax, dword [rsp + 0x30]
or eax, 8
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0xb8]
call fcn.140033350
mov rdx, rax
lea rcx, [rsp + 0x3b8]
call fcn.140004bb0
movzx eax, al
test eax, eax
jne 0x14006553e
lea rax, [rsp + 0x308]
mov qword [rsp + 0xc0], rax
lea rdx, str.RGNW2Z2d3jOUs4EdlBkgY3hSwR3gCCJRAhmITF_GDRUwBFiIlmVRQBvPgJOvECEh0MRQNlfjAWeIiUUFAEMAiUp7yhnNaQC4V7xS0ctgI8P3O9V3nEC94jdMRA202MttQLRXHgoAff_ncE1T4PxWH4HnWIsq78GOrlwUYk1PGyB2cSRG46Aa_vVsJ4xgbL2D5oKSy_METDfmVeQ_N2wke9cu0vwANjNGzYI_89
mov rcx, qword [rsp + 0xc0]
call fcn.140001b80
mov qword [rsp + 0xc8], rax
mov r8d, 0x11
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x1a8]
call fcn.14006cf50
mov qword [rsp + 0xd0], rax
mov eax, dword [rsp + 0x30]
or eax, 0x10
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0xd0]
call fcn.140033350
mov rdx, rax
lea rcx, [rsp + 0x3b8]
call fcn.140004bb0
movzx eax, al
test eax, eax
jne 0x14006553e
lea rcx, [rsp + 0x3b8]
call fcn.140041020
cmp rax, 0x24
jne 0x14006553e
mov dword [rsp + 0x38], 0
jmp 0x140065546
mov dword [rsp + 0x38], 1
movzx eax, byte [rsp + 0x38]
mov byte [rsp + 0x34], al
mov eax, dword [rsp + 0x30]
and eax, 0x10
test eax, eax
je 0x14006556d
and dword [rsp + 0x30], 0xffffffef
lea rcx, [rsp + 0x1a8]
call fcn.140002090
nop
mov eax, dword [rsp + 0x30]
and eax, 8
test eax, eax
je 0x14006558b
and dword [rsp + 0x30], 0xfffffff7
lea rcx, [rsp + 0x1c8]
call fcn.140002090
nop
mov eax, dword [rsp + 0x30]
and eax, 4
test eax, eax
je 0x1400655a9
and dword [rsp + 0x30], 0xfffffffb
lea rcx, [rsp + 0x1e8]
call fcn.140002090
nop
mov eax, dword [rsp + 0x30]
and eax, 2
test eax, eax
je 0x1400655c7
and dword [rsp + 0x30], 0xfffffffd
lea rcx, [rsp + 0x208]
call fcn.140002090
nop
movzx eax, byte [rsp + 0x34]
test eax, eax
je 0x1400658f3
lea rax, [rsp + 0x328]
mov qword [rsp + 0xd8], rax
lea rdx, str.Q0lupMXpZRZ0JQoeHRwYOGxPsQ2YQRBihlpLRg1BBww1AHRNKAAzws8ADcVDLUMDOKRMtcNwoV5AFAVAZgfwEF4Gvhg8CEcIKqcyZTuvG5Qbj4fJB9vTtcl26xApA0wb4PrdNjp50UlySHUgbcCIbqREs50ip42KK9jvEiUKNyzoHRRXXQ_79
mov rcx, qword [rsp + 0xd8]
call fcn.140020c10
mov qword [rsp + 0xe0], rax
mov r8d, 0x11
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x100]
call fcn.14006cb70
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xf0], rax
mov rcx, qword [rsp + 0xf0]
call fcn.14000d520
mov rdx, rax
lea rcx, [rsp + 0x228]
call fcn.140020c10
mov qword [rsp + 0xf8], rax
mov rcx, qword [rsp + 0xf8]
call fcn.140033370
lea rcx, [rsp + 0x3a8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x101
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rcx, [rsp + 0x228]
call fcn.140024820
nop
lea rcx, [rsp + 0x100]
call fcn.140023f20
nop
lea rax, [rsp + 0x348]
mov qword [rsp + 0x108], rax
lea rdx, str.RXBa9cU9VMUVJzZZ2tM4bGpXIb0IItETkZ6Jjs0DFQYOBDw2M8I4cqanb_1XmPaHQET6XFhHZ4KYCUKy8pErVIByJOBmODm1P9I10_49
mov rcx, qword [rsp + 0x108]
call fcn.140020c10
mov qword [rsp + 0x110], rax
mov r8d, 0x11
mov rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0x140]
call fcn.14006cb70
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x120], rax
mov rcx, qword [rsp + 0x120]
call fcn.14000d520
mov rdx, rax
lea rcx, [rsp + 0x248]
call fcn.140020c10
mov qword [rsp + 0x128], rax
mov rcx, qword [rsp + 0x128]
call fcn.140033370
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x3a8]
mov qword [rsp + 0x138], rax
lea rax, [rsp + 0x3b0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x400]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3d8]
xor r8d, r8d
mov rdx, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140065799
mov dword [rsp + 0x3c], 1
jmp 0x1400657a1
mov dword [rsp + 0x3c], 0
movzx eax, byte [rsp + 0x3c]
mov byte [rsp + 0x35], al
lea rcx, [rsp + 0x248]
call fcn.140024820
nop
lea rcx, [rsp + 0x140]
call fcn.140023f20
movzx eax, byte [rsp + 0x35]
test eax, eax
je 0x140065862
lea rax, [rsp + 0x368]
mov qword [rsp + 0x148], rax
lea rdx, str.U1NUURUxxDcGpaVRU5nsek9OZOE1jLY2R1GfEFAhWnd1cfldK7Yn4IvfWNgZHV8JQV1aKanVzV0p_8fgh9cY2MMBFsQetK2CEcz8uC3BWQJ2jsLltZfCgfYbtnp1qI9XDhK5EfMcA5a0e83CLBkwKISGboFAyzrhqIc67oar2m7FLsuC0Z4vSFVHzuwA_FTqnp1s0Rtf1fmWe4ixBVzpXcWGrAQ_89
mov rcx, qword [rsp + 0x148]
call fcn.140001b80
mov qword [rsp + 0x150], rax
mov r8d, 0x11
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0x268]
call fcn.14006cf50
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x160], rax
mov rcx, qword [rsp + 0x160]
call fcn.140033350
mov rdx, rax
lea rcx, [rsp + 0x3b8]
call fcn.140025690
nop
lea rcx, [rsp + 0x268]
call fcn.140002090
nop
jmp 0x1400658e4
lea rdx, [rsp + 0x400]
lea rcx, [rsp + 0x3e0]
call fcn.140020c10
nop
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x3e0]
call fcn.1400698a0
mov rax, qword [rax]
mov qword [rsp + 0x168], rax
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x3e0]
call fcn.140067d80
mov rax, qword [rax]
mov qword [rsp + 0x170], rax
mov r8, qword [rsp + 0x168]
mov rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0x3b8]
call fcn.1400609c0
nop
lea rcx, [rsp + 0x3e0]
call fcn.140024820
nop
mov rcx, qword [rsp + 0x3a8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rax, [rsp + 0x388]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x3b8]
mov rcx, qword [rsp + 0x40]
call fcn.140020230
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x288]
call fcn.140070740
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
lea rcx, [0x140100048]
call fcn.140025570
lea rcx, [rsp + 0x288]
call fcn.140002090
nop
lea rdx, [0x140100048]
mov rcx, qword [rsp + 0x620]
call fcn.140020230
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x3b8]
call fcn.140002090
mov rax, qword [rsp + 0x620]
mov rcx, qword [rsp + 0x600]
xor rcx, rsp
call fcn.140097cf0
add rsp, 0x618
ret