Function at 0x140004080
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4a0]
sub rsp, 0x5a0
mov rax, qword [0x140031040]
xor rax, rsp
mov qword [rbp + 0x490], rax
mov r13, r8
mov r15, rdx
mov qword [rsp + 0x38], rdx
mov r14, rcx
mov qword [rsp + 0x70], rcx
call fcn.1400021cc
mov rcx, rax
test rax, rax
je 0x1400049bc
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
call fcn.1400021cc
mov rcx, rax
test rax, rax
je 0x1400049c7
mov rax, qword [rax]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x58], rdi
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x70]
call fcn.140021430
mov rsi, 0xffffffffffffffff
lea r12d, [rsi + 2]
test r15, r15
jne 0x1400042f4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
mov rdx, qword [r14 + 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004318
mov dword [rbp - 0x80], 0x80
mov dword [rbp - 0x7c], r12d
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x7c]
xor r8d, r8d
lea rdx, [0x14002bd18]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
test eax, eax
je 0x14000419b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140004318
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x70]
mov r14, rsi
nop dword [rax + rax]
inc r14
cmp word [rax + r14*2], 0
jne 0x1400041b0
test r14d, r14d
jne 0x140004222
lea rdx, [rbx - 0x18]
mov r14, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140004318
cmp dword [rdx + 0x10], 0
jge 0x1400041f1
cmp dword [rbx - 0xc], 0
jl 0x1400049d2
xor r14d, r14d
mov dword [rbx - 0x10], r14d
mov word [rbx], r14w
jmp 0x14000431b
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, r12d
jg 0x140004206
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rdi, qword [rsp + 0x58]
jmp 0x140004318
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x60], eax
lea r12, [rbp - 0x70]
sub r12, rbx
sar r12, 1
test r14d, r14d
js 0x1400049d2
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x140004260
mov edx, r14d
lea rcx, [rsp + 0x50]
call fcn.140001eb8
mov rbx, qword [rsp + 0x50]
movsxd r15, r14d
add r15, r15
mov eax, dword [rsp + 0x60]
cmp r12, rax
ja 0x1400042a3
lea rdx, [rbx + r12*2]
test r15, r15
je 0x1400042dc
test rdx, rdx
jne 0x14000428a
call fcn.14000ff48
mov dword [rax], 0x16
jmp 0x1400042d7
movsxd rax, dword [rbx - 0xc]
add rax, rax
cmp rax, r15
jb 0x1400042cc
mov r8, r15
mov rcx, rbx
call fcn.140020d90
jmp 0x1400042dc
movsxd r8, dword [rbx - 0xc]
add r8, r8
test r15, r15
je 0x1400042dc
mov rcx, rbx
cmp r8, r15
jb 0x1400042c5
mov r8, r15
lea rdx, [rbp - 0x70]
call fcn.140020d90
jmp 0x1400042dc
xor edx, edx
call fcn.140021430
call fcn.14000ff48
mov dword [rax], 0x22
call fcn.14000fe24
cmp r14d, dword [rbx - 0xc]
jg 0x1400049d2
mov dword [rbx - 0x10], r14d
xor r14d, r14d
mov word [r15 + rbx], r14w
jmp 0x14000431b
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [r15 + r8*2], 0
jne 0x140004300
mov rdx, r15
lea rcx, [rsp + 0x50]
call fcn.1400014c0
xor r14d, r14d
test r13, r13
jne 0x14000447d
mov word [rbp - 0x70], r14w
lea r8, [rbp - 0x70]
mov r13, qword [rsp + 0x70]
mov rcx, r13
call fcn.1400057f0
cmp al, 1
jne 0x14000449e
lea rax, [rbp - 0x70]
mov rbx, rsi
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140004350
test ebx, ebx
jne 0x1400043b8
lea rdx, [rdi - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14000449e
cmp dword [rdx + 0x10], 0
jge 0x14000438c
cmp dword [rdi - 0xc], 0
jl 0x1400049d2
mov dword [rdi - 0x10], r14d
mov word [rdi], r14w
jmp 0x14000449e
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400043a1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
jmp 0x14000449e
mov r12d, dword [rdi - 0x10]
lea r15, [rbp - 0x70]
sub r15, rdi
sar r15, 1
test ebx, ebx
js 0x1400049d2
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x1400043f0
mov edx, ebx
lea rcx, [rsp + 0x58]
call fcn.140001eb8
mov rdi, qword [rsp + 0x58]
movsxd r14, ebx
add r14, r14
cmp r15, r12
ja 0x14000442f
lea rdx, [rdi + r15*2]
test r14, r14
je 0x140004468
test rdx, rdx
jne 0x140004416
call fcn.14000ff48
mov dword [rax], 0x16
jmp 0x140004463
movsxd rax, dword [rdi - 0xc]
add rax, rax
cmp rax, r14
jb 0x140004458
mov r8, r14
mov rcx, rdi
call fcn.140020d90
jmp 0x140004468
movsxd r8, dword [rdi - 0xc]
add r8, r8
test r14, r14
je 0x140004468
mov rcx, rdi
cmp r8, r14
jb 0x140004451
mov r8, r14
lea rdx, [rbp - 0x70]
call fcn.140020d90
jmp 0x140004468
xor edx, edx
call fcn.140021430
call fcn.14000ff48
mov dword [rax], 0x22
call fcn.14000fe24
cmp ebx, dword [rdi - 0xc]
jg 0x1400049d2
mov dword [rdi - 0x10], ebx
xor eax, eax
mov word [r14 + rdi], ax
jmp 0x14000449e
mov r8, rsi
inc r8
cmp word [r13 + r8*2], 0
jne 0x140004480
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.1400014c0
mov r13, qword [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.140002900
lea rcx, [rsp + 0x58]
call fcn.140002a00
mov rbx, qword [rsp + 0x58]
cmp dword [rbx - 0x10], 0
jne 0x1400044d9
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004839
mov rcx, qword [rdx]
jmp 0x140004832
lea rcx, [rsp + 0x50]
call fcn.140002900
lea rcx, [rsp + 0x50]
call fcn.140002a00
mov rax, qword [rsp + 0x50]
cmp dword [rax - 0x10], 0
jne 0x140004517
lea rdx, [0x14002bd20]
mov r8, rsi
inc r8
cmp word [rdx + r8*2], 0
jne 0x140004502
lea rcx, [rsp + 0x50]
call fcn.1400014c0
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x90]
call fcn.140021430
lea r8, [0x14002b910]
mov edx, 0x200
lea rcx, [rbp + 0x90]
call fcn.14000f9cc
lea r12, [rbx - 0x18]
mov rcx, r12
call fcn.1400013dc
lea rdi, [rax + 0x18]
mov qword [rsp + 0x78], rdi
movsxd rbx, dword [rax + 8]
test ebx, ebx
js 0x1400049b1
mov r15d, 1
mov ecx, r15d
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, ebx
or eax, ecx
jge 0x14000458a
mov edx, ebx
lea rcx, [rsp + 0x78]
call fcn.140001eb8
mov rdi, qword [rsp + 0x78]
lea eax, [rbx + 1]
movsxd rdx, eax
mov rcx, rdi
call fcn.140014a54
cmp ebx, dword [rdi - 0xc]
jg 0x1400049b1
mov dword [rdi - 0x10], ebx
xor r14d, r14d
mov word [rdi + rbx*2], r14w
call fcn.1400021cc
mov rcx, rax
test rax, rax
je 0x1400049dd
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
mov word [rbp - 0x70], r14w
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
mov rdx, qword [r13 + 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004639
mov dword [rsp + 0x60], 0x80
mov dword [rbp - 0x78], r15d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x78]
xor r8d, r8d
lea rdx, [0x14002bc58]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x70]
mov r14, rsi
inc r14
cmp word [rax + r14*2], 0
jne 0x140004640
test r14d, r14d
jne 0x1400046af
lea rdx, [rbx - 0x18]
mov r14, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140004780
cmp dword [rdx + 0x10], 0
jge 0x14000467e
cmp dword [rbx - 0xc], 0
jl 0x1400049a6
xor eax, eax
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x140004780
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004693
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov rdi, qword [rsp + 0x78]
jmp 0x140004780
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x30], eax
lea r13, [rbp - 0x70]
sub r13, rbx
sar r13, 1
test r14d, r14d
js 0x1400049a6
sub r15d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, r15d
jge 0x1400046ea
mov edx, r14d
lea rcx, [rsp + 0x68]
call fcn.140001eb8
mov rbx, qword [rsp + 0x68]
movsxd r15, r14d
add r15, r15
mov eax, dword [rsp + 0x30]
cmp r13, rax
ja 0x14000472d
lea rdx, [rbx + r13*2]
test r15, r15
je 0x140004766
test rdx, rdx
jne 0x140004714
call fcn.14000ff48
mov dword [rax], 0x16
jmp 0x140004761
movsxd rax, dword [rbx - 0xc]
add rax, rax
cmp rax, r15
jb 0x140004756
mov r8, r15
mov rcx, rbx
call fcn.140020d90
jmp 0x140004766
movsxd r8, dword [rbx - 0xc]
add r8, r8
test r15, r15
je 0x140004766
mov rcx, rbx
cmp r8, r15
jb 0x14000474f
mov r8, r15
lea rdx, [rbp - 0x70]
call fcn.140020d90
jmp 0x140004766
xor edx, edx
call fcn.140021430
call fcn.14000ff48
mov dword [rax], 0x22
call fcn.14000fe24
cmp r14d, dword [rbx - 0xc]
jg 0x1400049a6
mov dword [rbx - 0x10], r14d
xor eax, eax
mov word [r15 + rbx], ax
mov r13, qword [rsp + 0x70]
lea rcx, [rsp + 0x68]
call fcn.140002900
lea rcx, [rsp + 0x68]
call fcn.140002a00
mov rbx, qword [rsp + 0x68]
cmp dword [rbx - 0x10], 0
jne 0x140004884
lea r9, [0x14002bd18]
mov r8, qword [r13 + 0x20]
call fcn.140005ee0
lea r9, [0x14002bc4c]
mov r8, qword [r13 + 0x20]
call fcn.140005ee0
lea r9, [0x14002bc58]
mov r8, qword [r13 + 0x20]
call fcn.140005ee0
lea r9, [0x14002b8b8]
mov r8, qword [r13 + 0x20]
call fcn.140005ee0
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400047fe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000481d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov eax, esi
lock xadd dword [r12 + 0x10], eax
sub eax, 1
jg 0x140004839
mov rcx, qword [r12]
mov rdx, r12
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140004855
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, 0xe
mov rcx, qword [rbp + 0x490]
xor rcx, rsp
call fcn.140009320
mov rbx, qword [rsp + 0x5f8]
add rsp, 0x5a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400021cc
nop
mov rcx, rax
test rax, rax
je 0x1400049e8
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
lea r9, [0x14002bc70]
lea r8, [rbp + 0x90]
lea rdx, [0x14002bd38]
lea rcx, [rsp + 0x70]
call fcn.1400025a0
mov byte [r13 + 0x30], 0
mov rbx, qword [rsp + 0x70]
mov rdx, rbx
mov rcx, r13
call fcn.140004a00
cmp dword [r13 + 0x18], 1
jne 0x14000490a
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x14000490a
mov r8, rdi
mov rcx, r13
call fcn.1400056e0
mov r8, rdi
mov rcx, r13
call fcn.1400056e0
mov edi, dword [r13 + 0x18]
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004928
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004947
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004966
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov eax, esi
lock xadd dword [r12 + 0x10], eax
sub eax, 1
jg 0x140004982
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14000499f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, edi
jmp 0x14000485a
mov ecx, 0x80070057
call fcn.140001fa4
nop
mov ecx, 0x80070057
call fcn.140001fa4
nop
mov ecx, 0x80004005
call fcn.140001fa4
nop
mov ecx, 0x80004005
call fcn.140001fa4
nop
mov ecx, 0x80070057
call fcn.140001fa4
nop
mov ecx, 0x80004005
call fcn.140001fa4
nop
mov ecx, 0x80004005
call fcn.140001fa4
int3