Function at 0x14000ce00
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push r12
lea rbp, [rsp - 0x5e8]
sub rsp, 0x6e8
mov rbx, rcx
xor edx, edx
lea rcx, [rbp - 0x40]
mov r8d, 0x208
call fcn.1400376d0
xor r12d, r12d
mov dword [rsp + 0x6c], 0x104
mov rdx, rbx
mov dword [rsp + 0x68], r12d
lea rcx, [rbp + 0x618]
mov dword [rbp + 0x620], r12d
mov qword [rbp + 0x618], r12
call fcn.14000c130
mov rsi, qword [rbp + 0x618]
lea rax, [rsp + 0x60]
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000ce9b
mov rcx, rsi
call fcn.140038520
xor eax, eax
add rsp, 0x6e8
pop r12
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x6c]
lea rax, [rbp - 0x68]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rdx, [rbp - 0x40]
lea rax, [rbp - 0x64]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x628]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14000d214
mov ecx, dword [rbp + 0x628]
inc ecx
mov qword [rsp + 0x710], rdi
add rcx, rcx
call fcn.140038534
mov qword [rsp + 0x78], rax
mov rdi, rax
test rax, rax
je 0x14000d20c
mov ecx, dword [rbp + 0x628]
mov dword [rbp + 0x620], ecx
cmp dword [rsp + 0x70], r12d
je 0x14000d204
mov rcx, qword [rsp + 0x60]
lea r9, [rbp + 0x620]
mov qword [rsp + 0x38], r12
mov r8, rax
mov qword [rsp + 0x30], r12
xor edx, edx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov dword [rbp + 0x620], 0x96
mov word [rax], r12w
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x14000d204
mov qword [rsp + 0x6e0], r13
lea rcx, [rbp + 0x1d0]
mov r13d, 1
xor edx, edx
mov r8d, 0x400
mov dword [rsp + 0x74], r13d
call fcn.1400376d0
lea rax, [rsp + 0x60]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000d1fc
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x618]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x74]
lea rax, [rbp + 0x1d0]
mov dword [rbp + 0x618], 0x400
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000d1fc
mov ecx, dword [rbp + 0x618]
mov qword [rsp + 0x6d8], r14
lea rcx, [rcx*4 + 2]
call fcn.140038534
mov r14, rax
test rax, rax
je 0x14000d1f4
mov ecx, dword [rbp + 0x618]
mov rbx, r12
mov word [rax], r12w
test rcx, rcx
je 0x14000d09f
sub rcx, rbx
mov rax, 0xffffffffffffffff
movzx r9d, byte [rbp + rcx + 0x1cf]
nop word [rax + rax]
cmp word [r14 + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x14000d070
lea rcx, [r14 + rax*2]
mov edx, 3
lea r8, [0x140072a18]
call fcn.14000f4c0
mov ecx, dword [rbp + 0x618]
inc rbx
cmp rbx, rcx
jb 0x14000d053
mov rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], r12w
jne 0x14000d0a6
cmp rax, 8
jb 0x14000d1ec
mov rcx, rax
shr rcx, 3
mov qword [rbp - 0x58], rcx
cmp r13, rcx
ja 0x14000d1ec
mov qword [rsp + 0x6d0], r15
lea r15, [r14 - 0x10]
lea r15, [r15 + rax*2]
nop
xor eax, eax
lea rcx, [rbp - 0x80]
xorps xmm0, xmm0
mov word [rbp - 0x70], ax
mov rdx, r15
movups xmmword [rbp - 0x80], xmm0
lea r8d, [rax + 8]
call fcn.14003fda4
mov rcx, 0xffffffffffffffff
mov word [rbp - 0x70], r12w
nop dword [rax]
inc rcx
cmp word [rsi + rcx*2], r12w
jne 0x14000d110
lea rdx, [rbp - 0x80]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], r12w
jne 0x14000d125
add rcx, rax
lea rcx, [rcx*2 + 2]
call fcn.140038534
mov rdi, rax
test rax, rax
je 0x14000d1c9
mov word [rax], r12w
lea rcx, [rax - 2]
cmp word [rcx + 2], r12w
lea rcx, [rcx + 2]
jne 0x14000d153
xor edx, edx
movzx eax, word [rsi + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x14000d160
lea rcx, [rdi - 2]
cmp word [rcx + 2], r12w
lea rcx, [rcx + 2]
jne 0x14000d175
lea r8, [rbp - 0x80]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x14000d190
mov rcx, rdi
call fcn.14000b8c0
mov rcx, rdi
mov rbx, rax
call fcn.140038520
mov rcx, rbx
call fcn.140020290
test al, al
jne 0x14000d1dc
mov rcx, rbx
call fcn.140038520
inc r13
sub r15, 0x10
cmp r13, qword [rbp - 0x58]
jbe 0x14000d0e0
jmp 0x14000d1df
mov r12, rbx
mov rdi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x6d0]
mov rcx, r14
call fcn.140038520
mov r14, qword [rsp + 0x6d8]
mov r13, qword [rsp + 0x6e0]
mov rcx, rdi
call fcn.140038520
mov rdi, qword [rsp + 0x710]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call fcn.140038520
mov rax, r12
add rsp, 0x6e8
pop r12
pop rsi
pop rbx
pop rbp
ret