Function at 0x140138360
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x860
mov rax, qword [0x1403d5798]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x48], rcx
mov rsi, qword [rsp + 0x8b0]
test r9, r9
je 0x14013846f
mov qword [rsp + 0x28], r9
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x50]
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x140138424
call fcn.140141030
test rax, rax
je 0x1401385fe
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [r14], rax
lea rax, [rsp + 0x50]
cmp rax, 0x10000
lea rax, [rsp + 0x50]
jae 0x140138404
movzx edx, ax
mov rcx, r14
call fcn.14012a490
jmp 0x1401385dd
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140138410
lea rdx, [rsp + 0x50]
jmp 0x1401385d1
call fcn.140141030
test rax, rax
je 0x1401385fe
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [r14], rax
test rsi, rsi
je 0x1401385cc
cmp rsi, 0x10000
jb 0x1401385ab
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140138460
jmp 0x1401385ce
call fcn.140141030
mov rcx, rax
test rax, rax
je 0x140138609
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov r9, rbx
mov r8, qword [0x1403dd160]
lea rdx, [0x1403060a0]
lea rcx, [rsp + 0x30]
call fcn.14012b980
lea r8, [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
xor ebp, ebp
test eax, eax
sete bpl
lea rdx, [rbx - 0x18]
mov rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401384ec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebp, ebp
je 0x140138583
mov dword [rsp + 0x30], 0x800
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140138583
cmp dword [rsp + 0x38], 1
jne 0x140138583
call fcn.140141030
mov rcx, rax
test rax, rax
je 0x140138614
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r14], rax
lea rax, [rsp + 0x50]
cmp rax, 0x10000
lea rax, [rsp + 0x50]
jb 0x1401383f4
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140138572
lea rdx, [rsp + 0x50]
jmp 0x1401385d1
call fcn.140141030
mov rcx, rax
test rax, rax
je 0x1401385fe
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r14], rax
test rsi, rsi
je 0x1401385cc
cmp rsi, 0x10000
jae 0x1401385c0
movzx edx, si
mov rcx, r14
call fcn.14012a490
jmp 0x1401385dd
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1401385c0
jmp 0x1401385ce
xor ebx, ebx
mov rdx, rsi
mov r8d, ebx
mov rcx, r14
call fcn.14012a7b0
nop
mov rax, r14
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.140169a70
add rsp, 0x860
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.140129930
int3
mov ecx, 0x80004005
call fcn.140129930
int3
mov ecx, 0x80004005
call fcn.140129930
int3