Function at 0x140009ddc
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb08]
sub rsp, 0xbe0
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rbp + 0xad0], rax
and qword [rbp + 0x90], 0
and qword [rsp + 0x50], 0
lea rax, [0x140001958]
xorps xmm0, xmm0
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rax
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rbp + 0xb0], rax
lea rax, [0x140001988]
lea rcx, [0x140001978]
mov qword [rbp + 0xc0], rax
lea rax, [0x140001998]
lea rsi, [0x140001b70]
mov qword [rbp + 0xc8], rax
lea rax, [0x1400019c0]
mov qword [rbp + 0xb8], rcx
mov qword [rbp + 0xd0], rax
lea rax, [0x1400019d0]
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0xd8], rax
lea rax, [0x1400019e0]
lea r13, [0x140001a60]
mov qword [rbp + 0xe0], rax
lea rax, [0x1400019f0]
lea r12, [0x140001a78]
mov qword [rbp + 0xe8], rax
lea rax, [0x140001a00]
lea r15, [0x140001af0]
mov qword [rbp + 0xf0], rax
lea rax, [0x140001a10]
lea r14, [0x140001b00]
mov qword [rbp + 0xf8], rax
lea rax, [0x140001a20]
lea rdi, [0x140001b18]
mov qword [rbp + 0x100], rax
lea rax, [0x140001a30]
lea rbx, [0x140001b48]
mov qword [rbp + 0x108], rax
lea rax, [0x140001a40]
lea r11, [0x140001b90]
mov qword [rbp + 0x110], rax
lea rax, [0x140001a50]
lea r10, [0x140001bb0]
mov qword [rbp + 0x118], rax
lea rax, [0x140001aa0]
lea r9, [0x140001bd8]
mov qword [rbp + 0x138], rax
lea rax, [0x140001ab0]
lea r8, [0x140001bf8]
mov qword [rbp + 0x140], rax
lea rax, [0x140001ac8]
lea rdx, [0x140001c10]
mov qword [rbp + 0x148], rax
lea rax, [0x140001ae0]
lea rcx, [0x140001c20]
mov qword [rbp + 0x150], rax
lea rax, [0x140001c40]
mov qword [rbp + 0x120], r13
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
lea rax, [0x140001978]
mov qword [rbp + 0x128], r12
mov qword [rsp + 0x78], rax
mov qword [rbp + 0x158], r15
mov qword [rbp + 0x160], r14
lea rax, [0x140001c58]
mov qword [rbp + 0x168], rdi
mov qword [rbp + 0x170], rbx
mov qword [rbp + 0x178], rsi
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x188], rsi
mov qword [rbp + 0x190], r11
mov qword [rbp + 0x198], r10
mov qword [rbp + 0x1a0], r9
mov qword [rbp + 0x1a8], r8
mov qword [rbp + 0x1b0], rdx
mov qword [rbp + 0x1b8], rcx
mov qword [rbp - 0x80], rax
lea rax, [0x140001c78]
mov qword [rbp + 0x30], rbx
mov qword [rbp - 0x78], rax
lea rax, [0x1400019c0]
mov ebx, 3
mov qword [rbp - 0x70], rax
lea rax, [0x1400019d0]
mov qword [rbp + 0x18], r15
mov qword [rbp - 0x68], rax
lea rax, [0x1400019e0]
xor r15d, r15d
mov qword [rbp - 0x60], rax
lea rax, [0x1400019f0]
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x58], rax
lea rax, [0x140001a00]
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x50], rax
lea rax, [0x140001a10]
mov qword [rbp + 0x38], rsi
mov qword [rbp - 0x48], rax
lea rax, [0x140001a20]
mov qword [rbp + 0x40], rsi
mov qword [rbp - 0x40], rax
lea rax, [0x140001a30]
mov qword [rbp + 0x48], rsi
mov qword [rbp - 0x38], rax
lea rax, [0x140001a40]
mov qword [rbp + 0x20], r14
mov qword [rbp - 0x30], rax
lea rax, [0x140001a50]
mov qword [rbp + 0x28], rdi
mov qword [rbp - 0x28], rax
lea rax, [0x140001978]
mov qword [rbp + 0x50], r11
mov qword [rbp - 0x10], rax
lea rax, [0x140001ca8]
mov qword [rbp + 0x58], r10
mov qword [rbp - 8], rax
lea rax, [0x140001cc0]
mov qword [rbp + 0x60], r9
mov qword [rbp], rax
lea rax, [0x140001cd8]
mov qword [rbp + 0x68], r8
mov qword [rbp + 8], rax
lea rax, [0x140001ce8]
mov qword [rbp + 0x70], rdx
mov qword [rbp + 0x78], rcx
mov esi, r15d
lea r12d, [rbx + 0x3d]
mov qword [rbp + 0x10], rax
lea r13d, [rbx + 0x1d]
lea r9, [0x1400018e0]
lea r8, [0x140001cf8]
lea rcx, [rbp + 0x2d0]
mov edx, 0x400
mov dword [rsp + 0x20], ebx
call fcn.140009684
lea rax, [rsp + 0x38]
lea rdx, [rbp + 0x2d0]
mov r14b, 1
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov dil, r14b
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000a29f
lea rcx, [rbp + 0x1c0]
mov r8, r12
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1c0]
lea rdx, [0x140001d08]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000a224
mov eax, dword [rsp + 0x30]
add eax, 0xfffffffe
cmp eax, 0x3d
ja 0x14000a224
mov rdx, qword [rbp + rsi + 0x98]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14000a224
cmp ebx, 8
jne 0x14000a221
lea rdx, [0x140001d28]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14000a224
mov r14b, r15b
lea rcx, [rbp + 0x1c0]
mov r8, r12
xor edx, edx
mov dword [rsp + 0x30], r12d
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, [0x140001d38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1c0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000a294
mov eax, dword [rsp + 0x30]
add eax, 0xfffffffe
cmp eax, 0x3d
ja 0x14000a294
mov rdx, qword [rsp + rsi + 0x58]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
movzx edi, dil
test eax, eax
cmovne edi, r15d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [0x140001d58]
lea rcx, [rbp + 0x250]
mov r9d, ebx
mov rdx, r12
call fcn.140009684
test r14b, r14b
je 0x14000a2fa
lea r9, [rbp + 0x200]
lea r8, [rbp + 0x250]
lea rcx, [0x140004bf0]
mov dword [rsp + 0x20], r13d
call fcn.140010290
test eax, eax
js 0x14000a2fa
lea r9, [rbp + 0x200]
lea r8, [rbp + 0x250]
lea rcx, [0x140004bf0]
call fcn.140010334
test dil, dil
je 0x14000a33c
lea r9, [rbp + 0x200]
lea r8, [rbp + 0x250]
lea rcx, [0x140004c18]
mov dword [rsp + 0x20], r13d
call fcn.140010290
test eax, eax
js 0x14000a33c
lea r9, [rbp + 0x200]
lea r8, [rbp + 0x250]
lea rcx, [0x140004c18]
call fcn.140010334
inc ebx
add rsi, 8
cmp ebx, 0x28
jl 0x14000a13f
mov rcx, qword [rbp + 0xad0]
xor rcx, rsp
call fcn.14002ad70
lea r11, [rsp + 0xbe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret