Function at 0x140009b00
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
lea rbp, [rax - 0x338]
sub rsp, 0x420
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400710e0]
xor rax, rsp
mov qword [rbp + 0x310], rax
mov r12, rcx
xor r13d, r13d
mov esi, r13d
mov ebx, r13d
mov dword [rsp + 0x30], ebx
nop dword [rax]
mov byte [rbp + 0x200], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x201]
call fcn.140026b30
lea r8, [rbp + 0x200]
mov edx, ebx
mov ecx, dword [r12 + 0x20]
call fcn.14003a540
mov byte [rbp + 0xf0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0xf1]
call fcn.140026b30
mov r8d, 1
lea rdx, str.Property_u
lea rcx, [rbp + 0xf0]
call fcn.14000c2c0
mov byte [rbp - 0x20], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp - 0x1f]
call fcn.140026b30
xor dil, dil
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x200]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140009e32
mov dword [rsp + 0x34], r13d
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rbp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [rsp + 0x34]
test edx, edx
je 0x140009c70
cmp edx, 0x104
jae 0x140009c70
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rbp + 0xf0]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete dil
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test dil, dil
je 0x140009e32
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
mov ecx, r13d
setns cl
test ecx, ecx
je 0x140009e9a
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
cmp rcx, rax
je 0x140009ce1
cmp edi, 0x80
jle 0x140009cda
movsxd rdx, edi
mov r8d, 1
call fcn.140025010
test rax, rax
je 0x140009e42
jmp 0x140009cf6
call fcn.140024614
jmp 0x140009d06
cmp edi, 0x80
jle 0x140009d06
movsxd rcx, edi
mov edx, 1
call fcn.140024654
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140009e4d
jmp 0x140009d10
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
movsxd rdx, edi
mov r9, rdx
lea r8, [rbp - 0x20]
mov rcx, rax
call fcn.1400246c0
test eax, eax
je 0x140009d4a
cmp eax, 0xc
je 0x140009e6e
cmp eax, 0x16
je 0x140009e63
cmp eax, 0x22
je 0x140009e63
cmp eax, 0x50
jne 0x140009e58
mov rcx, qword [rsp + 0x50]
call fcn.140009870
movzx edi, al
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
cmp rcx, rax
je 0x140009d6b
call fcn.140024614
test dil, dil
je 0x140009e32
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.14000bed0
mov r11, rax
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x20]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x20]
mov rcx, r11
call fcn.140002720
mov ebx, dword [rsp + 0x30]
cmp ebx, esi
je 0x140009e30
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [rax + 1]
lea r8, [rsp + 0x58]
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140008250
movsxd rdx, edi
mov r9, rdx
lea r8, [rbp - 0x20]
mov rcx, qword [rsp + 0x50]
call fcn.1400246c0
test eax, eax
je 0x140009e0b
cmp eax, 0xc
je 0x140009e8f
cmp eax, 0x16
je 0x140009e84
cmp eax, 0x22
je 0x140009e84
cmp eax, 0x50
jne 0x140009e79
mov r8d, esi
mov rdx, qword [rsp + 0x50]
mov rcx, r12
call fcn.14000a710
nop
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
cmp rcx, rax
je 0x140009e30
call fcn.140024614
inc esi
inc ebx
mov dword [rsp + 0x30], ebx
cmp ebx, 9
ja 0x140009ea5
jmp 0x140009b50
mov ecx, 0x8007000e
call fcn.1400050a0
int3
mov ecx, 0x8007000e
call fcn.1400050a0
int3
mov ecx, 0x80004005
call fcn.1400050a0
int3
mov ecx, 0x80070057
call fcn.1400050a0
int3
mov ecx, 0x8007000e
call fcn.1400050a0
int3
mov ecx, 0x80004005
call fcn.1400050a0
int3
mov ecx, 0x80070057
call fcn.1400050a0
int3
mov ecx, 0x8007000e
call fcn.1400050a0
int3
mov ecx, 0x80070057
call fcn.1400050a0
int3
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.140023ca0
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rbp
ret