Function at 0x140011f40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x14004f678]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r14, rdx
mov rsi, rcx
xor edi, edi
mov dword [rbp - 0x71], edi
mov dword [rbp - 0x75], edi
lea rax, [rbp - 0x75]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x71]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140011f9c
mov ecx, eax
jmp 0x140012103
mov ecx, dword [rbp - 0x71]
lea eax, [rcx - 1]
test eax, 0xfffffffa
jne 0x1400120fe
cmp ecx, 5
je 0x1400120fe
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea rcx, vtable.std::_Func_impl_no_alloc_class_std::_Binder_struct_std::_Unforced__int____cdecl___void____ptr64__unsigned_long_int__void____ptr64___void____ptr64__int__struct_std::_Ph_1__const____ptr64___int__wchar_t____ptr64_.0
mov qword [rbp - 0x59], rcx
mov rcx, qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp - 0x51], rcx
movzx ecx, byte [rbp - 0x79]
mov byte [rbp - 0x49], cl
mov dword [rbp - 0x45], edi
mov qword [rbp - 0x41], rax
lea rax, [rbp - 0x59]
mov qword [rbp - 0x21], rax
mov ebx, dword [rbp - 0x75]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, ebx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rbp + 0x1f], rdi
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140012050
lea rax, [rbp - 0x59]
cmp rcx, rax
jne 0x140012045
mov r8, qword [rcx]
lea rdx, [rbp - 0x19]
call qword [r8 + 8]
mov qword [rbp + 0x1f], rax
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140012050
mov rax, qword [rcx]
lea rdx, [rbp - 0x59]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140012049
mov qword [rbp + 0x1f], rcx
mov rcx, rdi
mov qword [rbp - 0x21], rcx
mov qword [rbp + 0x27], rbx
test rcx, rcx
je 0x14001206d
mov rax, qword [rcx]
lea rdx, [rbp - 0x59]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rbx, qword [rbp + 0x27]
test rbx, rbx
jne 0x1400120bf
lea ecx, [rbx + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x27]
test rcx, rcx
je 0x14001209f
mov qword [rbp - 0x69], rcx
mov rcx, qword [rbp + 0x1f]
test rcx, rcx
je 0x14001212f
mov rax, qword [rcx]
lea rdx, [rbp - 0x69]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x1f]
test rcx, rcx
je 0x1400120ba
mov r8, qword [rcx]
lea rax, [rbp - 0x19]
cmp rcx, rax
setne dl
call qword [r8 + 0x20]
nop
mov rax, rdi
jmp 0x14001210b
lea rax, [rbp - 0x75]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x71]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x14001207b
mov rax, qword [rbp + 0x27]
mov rcx, rdi
mov qword [rbp + 0x27], rcx
mov rdi, rax
jmp 0x14001207f
mov ecx, 0x65e
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400153e0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140014ea8
nop
int3