Function at 0x140091c4c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xc0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r15, r8
mov rbx, rdx
mov r13, rcx
lea rsi, [0x1400cf018]
mov rcx, qword [0x1400cf018]
cmp rcx, rsi
je 0x140091cba
test byte [rcx + 0x1c], 1
je 0x140091cba
cmp byte [rcx + 0x19], 5
jb 0x140091cba
mov rax, qword [r8 + 0x10]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.14008f60c
and qword [rbp - 0x71], 0
and dword [rbp - 0x69], 0
and dword [rbp - 0x65], 0
lea rdx, [rbp - 0x71]
mov rcx, r13
call fcn.14008f940
mov edi, eax
mov r10, qword [0x1400cf018]
cmp r10, rsi
je 0x140091d0e
test byte [r10 + 0x1c], 2
je 0x140091d0e
cmp byte [r10 + 0x19], 4
jb 0x140091d0e
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400b9878]
mov rcx, qword [r10 + 0x10]
call fcn.1400035c4
mov r10, qword [0x1400cf018]
and qword [rbp - 0x51], 0
and dword [rbp - 0x49], 0
and dword [rbp - 0x45], 0
lea rcx, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0Server_Settings
lea r8, [0x14000a980]
test edi, edi
jne 0x140091e2d
xor ebx, ebx
mov qword [rbp - 9], rbx
and qword [rbp - 1], rbx
and qword [rbp + 7], rbx
and qword [rbp - 0x39], rbx
mov rax, qword [r13]
lea rdx, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0MAC_Access_Control
cmp qword [rax + 0x58], r8
cmovne rdx, rcx
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140091d89
mov rbx, qword [rbp - 0x39]
mov qword [rbp - 9], rbx
mov r10, qword [0x1400cf018]
cmp r10, rsi
je 0x140091dc2
test byte [r10 + 0x1c], 2
je 0x140091dc2
cmp byte [r10 + 0x19], 4
jb 0x140091dc2
mov edx, SysStringByteLen
mov r9d, edi
lea r8, [0x1400b9878]
mov rcx, qword [r10 + 0x10]
call fcn.1400035c4
mov r10, qword [0x1400cf018]
test edi, edi
jne 0x140091e0e
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 9]
call fcn.14008b4c4
mov edi, eax
mov r10, qword [0x1400cf018]
cmp r10, rsi
je 0x140091e0e
test byte [r10 + 0x1c], 2
je 0x140091e0e
cmp byte [r10 + 0x19], 4
jb 0x140091e0e
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400b9878]
mov rcx, qword [r10 + 0x10]
call fcn.1400035c4
mov r10, qword [0x1400cf018]
test rbx, rbx
je 0x140091e29
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov r10, qword [0x1400cf018]
mov rbx, qword [rbp + 0x67]
xor r14d, r14d
cmp dword [rbp - 0x69], r14d
jle 0x14009243d
xor r12d, r12d
and dword [rbp + 0x77], 0
test r14d, r14d
js 0x1400924b3
cmp r14d, dword [rbp - 0x69]
jge 0x1400924b3
mov rax, qword [rbp - 0x71]
lea r8, [rbp + 0x77]
mov rdx, qword [rax + r12*8]
mov rcx, r13
call fcn.140090b3c
mov edi, eax
mov r10, qword [0x1400cf018]
cmp r10, rsi
je 0x140091ea3
test byte [r10 + 0x1c], 2
je 0x140091ea3
cmp byte [r10 + 0x19], 4
jb 0x140091ea3
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400b9878]
mov rcx, qword [r10 + 0x10]
call fcn.1400035c4
mov r10, qword [0x1400cf018]
test edi, edi
jne 0x140091eff
cmp dword [rbp + 0x77], 1
jne 0x140091eff
cmp r10, rsi
je 0x140092391
test byte [r10 + 0x1c], 2
je 0x140092391
cmp byte [r10 + 0x19], 4
jb 0x140092391
cmp r14d, dword [rbp - 0x69]
jge 0x1400924be
mov edx, reloc.OLEAUT32.dll_SysStringByteLen
mov rax, qword [rbp - 0x71]
mov r9, qword [rax + r12*8]
lea r8, [0x1400b9878]
mov rcx, qword [r10 + 0x10]
call fcn.14000351c
mov r10, qword [0x1400cf018]
jmp 0x140092391
and dword [rbp - 0x61], 0
cmp r14d, dword [rbp - 0x69]
jge 0x140092542
mov rax, qword [rbp - 0x71]
lea r9, [rbp - 0x61]
lea r8, str.DefaultAuthorization
mov rdx, qword [rax + r12*8]
mov rcx, r13
call fcn.140090de0
test eax, eax
jne 0x140091f6c
cmp dword [rbp - 0x61], 1
jne 0x140091f6c
mov r10, qword [0x1400cf018]
cmp r10, rsi
je 0x140092391
test byte [r10 + 0x1c], 2
je 0x140092391
cmp byte [r10 + 0x19], 4
jb 0x140092391
cmp r14d, dword [rbp - 0x69]
jge 0x1400924c9
mov edx, 0x95
jmp 0x140091edb
cmp r14d, dword [rbp - 0x69]
jge 0x140092537
mov rsi, qword [rbp - 0x71]
xor ecx, ecx
xor r11d, r11d
cmp dword [rbx + 8], ecx
jle 0x140091fcd
movsxd rbx, dword [rbx + 8]
mov r10, qword [rbp + 0x67]
mov r10, qword [r10]
cmp qword [rsi + r12*8], 0
je 0x1400924d4
mov rax, qword [r10]
mov r9, qword [rsi + r12*8]
sub r9, rax
movzx r8d, word [rax]
movzx edx, word [rax + r9]
sub r8d, edx
jne 0x140091fba
add rax, 2
test edx, edx
jne 0x140091fa4
test r8d, r8d
je 0x140091fd0
inc ecx
inc r11
add r10, 8
cmp r11, rbx
jl 0x140091f8f
or ecx, 0xffffffff
cmp ecx, 0xffffffff
je 0x140092020
mov r10, qword [0x1400cf018]
lea rax, [0x1400cf018]
cmp r10, rax
je 0x14009238a
test byte [r10 + 0x1c], 2
je 0x14009238a
cmp byte [r10 + 0x19], 4
jb 0x14009238a
mov edx, 0x96
mov r9, qword [rsi + r12*8]
lea r8, [0x1400b9878]
mov rcx, qword [r10 + 0x10]
call fcn.14000351c
jmp 0x140092383
cmp qword [r15 + 0x10], 0
je 0x140092153
mov rax, qword [0x1400d1e50]
lea rcx, [0x1400d1e50]
mov rax, qword [rax + 0x18]
call qword [str._E_n_]
add rax, 0x18
mov qword [rbp - 0x31], rax
cmp r14d, dword [rbp - 0x69]
jge 0x1400924ea
mov rax, qword [rbp - 0x71]
lea r9, [rbp - 0x31]
lea r8, str.NetworkInterface
mov rdx, qword [rax + r12*8]
mov rcx, r13
call fcn.140090fc4
mov rbx, qword [rbp - 0x31]
test eax, eax
jne 0x140092132
cmp dword [rbx - 0x10], eax
je 0x140092132
mov rax, qword [r15]
jmp 0x1400920b2
mov rcx, qword [rax + 0x10]
mov r9, rbx
sub r9, rcx
movzx r8d, word [rcx]
movzx edx, word [rcx + r9]
sub r8d, edx
jne 0x1400920aa
add rcx, 2
test edx, edx
jne 0x140092094
test r8d, r8d
je 0x1400920b7
mov rax, qword [rax]
test rax, rax
jne 0x14009208a
test rax, rax
jne 0x140092132
mov rcx, qword [0x1400cf018]
lea rsi, [0x1400cf018]
cmp rcx, rsi
je 0x140092108
test byte [rcx + 0x1c], 2
je 0x140092108
cmp byte [rcx + 0x19], 4
jb 0x140092108
cmp r14d, dword [rbp - 0x69]
jge 0x1400924df
mov rax, qword [rbp - 0x71]
mov edx, 0x97
mov qword [rsp + 0x20], rbx
mov r9, qword [rax + r12*8]
lea r8, [0x1400b9878]
mov rcx, qword [rcx + 0x10]
call fcn.14000aa4c
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140091ef3
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [str._E_n_]
jmp 0x140091ef3
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140092153
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [str._E_n_]
xor esi, esi
xor r15d, r15d
cmp dword [rbp - 0x49], esi
jle 0x140092347
xor ebx, ebx
mov qword [rbp - 0x21], rbx
and qword [rbp - 0x19], rbx
and qword [rbp - 0x11], rbx
mov rax, qword [r13]
lea rdx, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0MAC_Access_Control
lea rcx, [0x14000a980]
cmp qword [rax + 0x58], rcx
lea rax, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0Server_Settings
cmovne rdx, rax
lea rcx, [rbp - 0x59]
call fcn.140004b44
nop
lea r8d, [rbx + 1]
lea rdx, [0x1400ae120]
lea rcx, [rbp - 0x59]
call fcn.140004550
test r15, r15
js 0x140092516
cmp esi, dword [rbp - 0x49]
jge 0x140092516
mov rax, qword [rbp - 0x51]
mov rdx, qword [rax + r15*8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x59]
call fcn.140004550
and qword [rbp - 0x29], rbx
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, qword [rbp - 0x59]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140092210
mov rbx, qword [rbp - 0x29]
mov qword [rbp - 0x21], rbx
mov rcx, qword [0x1400cf018]
lea rax, [0x1400cf018]
cmp rcx, rax
je 0x140092247
test byte [rcx + 0x1c], 2
je 0x140092247
cmp byte [rcx + 0x19], 4
jb 0x140092247
mov edx, 0x98
mov r9d, edi
lea r8, [0x1400b9878]
mov rcx, qword [rcx + 0x10]
call fcn.1400035c4
test edi, edi
jne 0x1400922fe
and dword [rbp - 0x5d], edi
test r12, r12
js 0x14009250b
cmp r14d, dword [rbp - 0x69]
jge 0x14009250b
mov rax, qword [rbp - 0x71]
mov dword [rbp - 0x41], 4
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x5d]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x3d]
xor r8d, r8d
mov rdx, qword [rax + r12*8]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x1400922af
mov eax, dword [rbp - 0x3d]
sub eax, 4
neg eax
sbb edi, edi
and edi, 0xd
mov rcx, qword [0x1400cf018]
lea rax, [0x1400cf018]
cmp rcx, rax
je 0x1400922f4
test byte [rcx + 0x1c], 2
je 0x1400922f4
cmp byte [rcx + 0x19], 4
jb 0x1400922f4
mov edx, 0x99
mov r9d, edi
lea r8, [0x1400b9878]
mov rcx, qword [rcx + 0x10]
call fcn.1400035c4
mov rcx, qword [0x1400cf018]
lea rax, [0x1400cf018]
cmp dword [rbp - 0x5d], 0
jne 0x1400923aa
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140092324
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [str._E_n_]
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140092339
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
inc esi
inc r15
cmp esi, dword [rbp - 0x49]
jl 0x140092161
cmp r14d, dword [rbp - 0x69]
jge 0x14009252c
mov rdx, qword [rbp - 0x71]
mov rdx, qword [rdx + r12*8]
mov rcx, r13
call fcn.14008fd48
cmp r14d, dword [rbp - 0x69]
jge 0x140092521
movsxd rcx, r14d
mov rax, qword [rbp - 0x71]
lea rdx, [rax + rcx*8]
mov rcx, qword [rbp + 0x7f]
call fcn.140014e50
mov r15, qword [rbp + 0x6f]
mov r10, qword [0x1400cf018]
lea rsi, [0x1400cf018]
inc r14d
inc r12
cmp r14d, dword [rbp - 0x69]
jge 0x14009243d
mov rbx, qword [rbp + 0x67]
jmp 0x140091e3d
cmp rcx, rax
je 0x1400923f9
test byte [rcx + 0x1c], 2
je 0x1400923f9
cmp byte [rcx + 0x19], 4
jb 0x1400923f9
cmp esi, dword [rbp - 0x49]
jge 0x140092500
mov rax, qword [rbp - 0x51]
mov r8, qword [rax + r15*8]
cmp r14d, dword [rbp - 0x69]
jge 0x1400924f5
mov rax, qword [rbp - 0x71]
mov edx, 0x9a
mov qword [rsp + 0x20], r8
mov r9, qword [rax + r12*8]
lea r8, [0x1400b9878]
mov rcx, qword [rcx + 0x10]
call fcn.14000aa4c
nop
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14009241f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [str._E_n_]
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14009237f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x14009237f
cmp r10, rsi
je 0x140092482
test byte [r10 + 0x1c], 1
je 0x140092482
movzx edx, byte [r10 + 0x19]
mov eax, edi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x140092482
mov rax, qword [rbp + 0x7f]
mov eax, dword [rax + 8]
mov edx, 0x9b
mov dword [rsp + 0x20], eax
mov r9d, edi
lea r8, [0x1400b9878]
mov rcx, qword [r10 + 0x10]
call fcn.1400054e0
nop
lea rcx, [rbp - 0x51]
call fcn.140014dc8
nop
lea rcx, [rbp - 0x71]
call fcn.140014dc8
mov eax, edi
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0x80004005
call fcn.140005068
nop
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
nop
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
nop
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3
mov ecx, 0xc000008c
call fcn.14000504c
int3