Function at 0x140036e58
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0x90
mov qword [rbp + 0x2f], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov r15, rcx
mov dword [rbp - 1], 4
mov r10d, dword [0x14018cd80]
lea r11d, [r10 + 2]
lea eax, [r10 + 1]
imul r11d, eax
imul r11d, r10d
mov eax, 0x66666667
imul r11d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r11d, eax
cmp r11d, 0x11
jne 0x140036ef8
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
and dword [rbp - 0x11], 0
lea rcx, [0x1401849a8]
mov rax, qword [0x1401849a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 9], rax
mov rsi, qword [rbp + 0x7f]
mov rax, qword [rsi]
or r12d, 0xffffffff
cmp dword [rax - 0x10], 0
je 0x140036f67
lea r8, [0x14011dcd0]
mov rdx, rsi
lea rcx, [rbp + 0x27]
call fcn.140016a58
nop
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.140001d7c
nop
mov rdx, qword [rbp + 0x27]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140036f67
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x1401849a8]
mov rax, qword [0x1401849a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 7], rax
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp + 0x1f]
call fcn.140035b44
nop
mov r8, rax
lea rdx, [rbp - 9]
lea rcx, [rbp + 0x17]
call fcn.14000cfa0
nop
mov rdx, rax
lea rcx, [rbp + 7]
call fcn.140001d7c
nop
mov rdx, qword [rbp + 0x17]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140036fcf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x1f]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140036fef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rbp + 7]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140037079
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140037032
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140037053
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140037072
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x140037124
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 3]
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov ecx, dword [rbp - 0x11]
mov dword [r15], ecx
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x1400370c0
cmp dword [rbp + 3], 4
jne 0x1400370c0
mov dil, 1
jmp 0x1400370c3
xor dil, dil
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x1400370e0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140037101
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov ecx, r12d
lock xadd dword [rdx + 0x10], ecx
add ecx, r12d
test ecx, ecx
jg 0x140037121
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, dil
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret