Function at 0x140019620
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
lea rax, [0x140028ffe]
mov qword [rsp + 0x40], rax
lea rax, [0x14002902a]
mov qword [rsp + 0x48], rax
mov word [rsp + 0x50], 0
mov dword [rsp + 0x58], 1
lea rcx, [rsp + 0x88]
lea rdx, [rsp + 0x40]
call fcn.140019e00
add rdi, rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x50], 0
mov dword [rsp + 0x58], 1
lea rcx, [rsp + 0xa0]
lea rdi, [rsp + 0x40]
mov rdx, rdi
call fcn.140019e00
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], rdi
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001973c
movabs rax, 0x8000000000000000
mov qword [rsi], rax
cmp qword [rsp + 0xa0], 0
je 0x140019705
mov r8, qword [rsp + 0xa8]
mov rcx, qword [0x14002d0f0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x88], 0
je 0x140019727
mov r8, qword [rsp + 0x90]
mov rcx, qword [0x14002d0f0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x80], rsi
mov rdi, qword [rsp + 0x40]
mov dword [rsp + 0x64], 0x800
movzx eax, byte [0x14002d118]
mov edx, 0x800
xor ecx, ecx
call fcn.140016930
test rax, rax
je 0x140019b80
mov rsi, rax
mov qword [rsp + 0x68], 0x800
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0
mov r15, qword [rsp + 0xa8]
lea rbx, [rsp + 0x64]
mov r14, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea r12, [rsp + 0x40]
mov rbp, qword [sym.imp.oleaut32.dll_GetErrorInfo]
jmp 0x1400197b5
mov rsi, qword [rsp + 0x70]
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, r15
xor r8d, r8d
lea r9, [rsp + 0x3c]
call r14
test eax, eax
je 0x140019859
movzx r13d, ax
or r13d, 0x80070000
test eax, eax
cmovle r13d, eax
mov qword [rsp + 0x40], 0
xor ecx, ecx
mov rdx, r12
call rbp
mov rcx, qword [rsp + 0x40]
cmp r13d, 0x800700ea
jne 0x140019af2
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x78], rdx
mov r8d, dword [rsp + 0x64]
test r8, r8
jne 0x140019830
test rcx, rcx
je 0x1400197b0
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1400197b0
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rsi, rcx
lea rcx, [rsp + 0x68]
call fcn.140020ba0
mov rcx, rsi
test rcx, rcx
jne 0x140019828
jmp 0x1400197b0
mov eax, dword [rsp + 0x64]
mov qword [rsp + 0x78], rax
mov r8d, eax
shr r8d, 1
mov ebp, eax
and ebp, 0xfffffffe
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x50], 0
shr eax, 2
sub r8, rax
jne 0x140019b60
add rbp, rsi
xor r15d, r15d
lea r12, [rsp + 0x40]
mov rbx, rsi
test r15b, 1
jne 0x1400199a0
nop dword [rax]
cmp rbx, rbp
je 0x140019ac3
movzx eax, word [rbx]
add rbx, 2
mov ecx, eax
and ecx, 0xf800
cmp ecx, 0xd800
jne 0x1400199b7
movzx ecx, ax
cmp ecx, 0xdbff
ja 0x140019906
cmp rbx, rbp
je 0x140019906
movzx ecx, word [rbx]
add rbx, 2
mov edx, ecx
add edx, 0x2000
movzx edx, dx
mov r15b, 1
cmp edx, 0xfbff
ja 0x14001991c
mov r14d, ecx
jmp 0x140019909
xor r15d, r15d
mov dword [rsp + 0x3c], 0
mov r13d, 0xfffd
jmp 0x140019a23
movzx ecx, cx
and eax, 0x3ff
and ecx, 0x3ff
shl rax, 0x1a
movabs rdx, 0x100000000
add rax, rdx
shl ecx, 0x10
or rcx, rax
mov r13, rcx
shr r13, 0x10
mov dword [rsp + 0x3c], 0
shr rax, 0x20
je 0x140019a20
mov rax, rcx
shr rax, 0x22
or al, 0xf0
mov byte [rsp + 0x3c], al
mov rax, rcx
shr rax, 0x1c
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x3d], al
shr ecx, 0x16
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x3e], cl
xor r15d, r15d
lea rax, [rsp + 0x3f]
lea r12, [rsp + 0x40]
jmp 0x140019a47
mov eax, r14d
mov ecx, eax
and ecx, 0xf800
cmp ecx, 0xd800
je 0x1400198d4
movzx r13d, ax
shl eax, 0x10
cmp eax, 0x800000
jae 0x1400199f9
mov r15, qword [rsp + 0x50]
cmp r15, qword [rsp + 0x40]
jne 0x1400199d9
mov rcx, r12
call fcn.14001a620
mov rax, qword [rsp + 0x48]
mov byte [rax + r15], r13b
inc r15
mov qword [rsp + 0x50], r15
xor r15d, r15d
test r15b, 1
je 0x1400198b0
jmp 0x1400199a0
mov dword [rsp + 0x3c], 0
cmp eax, 0x8000000
jae 0x140019a20
shr eax, 0x16
or al, 0xc0
mov byte [rsp + 0x3c], al
xor r15d, r15d
lea rax, [rsp + 0x3d]
lea r12, [rsp + 0x3e]
jmp 0x140019a47
xor r15d, r15d
mov eax, r13d
shr eax, 0xc
or al, 0xe0
mov byte [rsp + 0x3c], al
mov eax, r13d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x3d], al
lea rax, [rsp + 0x3e]
lea r12, [rsp + 0x3f]
and r13b, 0x3f
or r13b, 0x80
mov byte [rax], r13b
lea rax, [rsp + 0x3c]
sub r12, rax
mov rax, qword [rsp + 0x40]
mov r13, qword [rsp + 0x50]
sub rax, r13
cmp rax, r12
jb 0x140019a9d
mov rcx, qword [rsp + 0x48]
add rcx, r13
lea rdx, [rsp + 0x3c]
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
add r13, r12
mov qword [rsp + 0x50], r13
lea r12, [rsp + 0x40]
test r15b, 1
je 0x1400198b0
jmp 0x1400199a0
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rsp + 0x40]
mov rdx, r13
mov r8, r12
call fcn.140020ba0
mov r13, qword [rsp + 0x50]
jmp 0x140019a6c
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x50]
nop word cs:[rax + rax]
mov rdx, r8
sub r8, 1
jb 0x140019b14
cmp byte [rcx + rdx - 1], 0
je 0x140019ae0
jmp 0x140019b16
movabs rax, 0x8000000000000000
mov rdx, qword [rsp + 0x80]
mov qword [rdx], rax
test rcx, rcx
je 0x140019b29
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x140019b29
xor edx, edx
mov r8, qword [rsp + 0x80]
mov qword [r8], rax
mov qword [r8 + 8], rcx
mov qword [r8 + 0x10], rdx
cmp qword [rsp + 0x68], 0
je 0x140019b43
mov rcx, qword [0x14002d0f0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsp + 0xa0], 0
jne 0x1400196ee
jmp 0x140019705
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0x40]
mov r9d, 1
xor edx, edx
call fcn.140020ba0
jmp 0x140019894
ud2