Function at 0x140003ae0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1fa0]
mov eax, 0x20a0
call fcn.14003a390
sub rsp, rax
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rbp + 0x1f90], rax
mov r15, r8
xor r12d, r12d
mov r14d, r12d
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 9
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [0x14007e028]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140003dff
mov esi, r12d
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp - 0x70]
call fcn.14005af20
mov dword [rsp + 0x70], 0x1000
mov dword [rsp + 0x6c], r12d
mov qword [rsp + 0x78], r12
mov dword [rsp + 0x68], 8
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x70]
mov edx, esi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x140003bdb
cmp eax, 0xea
jne 0x140003dff
inc esi
jmp 0x140003b64
call fcn.140002ed0
test rax, rax
je 0x140003e2d
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x70]
cmp rax, 0x10000
lea rax, [rbp - 0x70]
jae 0x140003c1a
movzx edx, ax
lea rcx, [rsp + 0x60]
call fcn.140001fa0
jmp 0x140003c3b
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140003c21
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x60]
call fcn.140002210
nop
mov rbx, qword [rsp + 0x60]
movsxd rdi, dword [rbx - 0x10]
test edi, edi
js 0x140003e4e
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140003c6e
mov edx, edi
lea rcx, [rsp + 0x60]
call fcn.140002b40
mov rbx, qword [rsp + 0x60]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.140041228
cmp edi, dword [rbx - 0xc]
jg 0x140003e4e
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], r12w
mov r10, qword [r15]
mov rdx, qword [r10 + 8]
mov r9, r10
cmp byte [rdx + 0x19], 0
jne 0x140003ce6
nop dword [rax]
mov rax, qword [rdx + 0x20]
mov r8, rbx
sub r8, rax
nop word [rax + rax]
movzx ecx, word [rax]
cmp cx, word [rax + r8]
jne 0x140003cc8
add rax, 2
test cx, cx
jne 0x140003cb0
mov eax, r12d
jmp 0x140003ccd
sbb eax, eax
or eax, 1
shr eax, 0x1f
test al, al
je 0x140003cda
mov rdx, qword [rdx + 0x10]
jmp 0x140003ce0
mov r9, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
je 0x140003ca0
cmp byte [r9 + 0x19], 0
jne 0x140003d37
mov rdx, qword [r9 + 0x20]
test rdx, rdx
je 0x140003e38
mov rax, rbx
sub rdx, rbx
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140003d17
add rax, 2
test cx, cx
jne 0x140003d00
mov eax, r12d
jmp 0x140003d1c
sbb eax, eax
or eax, 1
shr eax, 0x1f
test al, al
jne 0x140003d37
cmp r9, r10
je 0x140003d37
mov rax, qword [rsp + 0x78]
cmp qword [r9 + 0x28], rax
je 0x140003dd8
call fcn.140002ed0
test rax, rax
je 0x140003e43
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x70]
cmp rax, 0x10000
lea rax, [rbp - 0x70]
jae 0x140003d76
movzx edx, ax
lea rcx, [rsp + 0x50]
call fcn.140001fa0
jmp 0x140003d9a
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140003d80
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.140002210
nop
lea rdx, [rsp + 0x50]
mov rcx, r15
call fcn.1400045f0
mov rcx, qword [rsp + 0x78]
mov qword [rax], rcx
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140003dd0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
inc r14
mov rbx, qword [rsp + 0x60]
inc esi
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140003b64
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x140003b64
mov rax, r14
mov rcx, qword [rbp + 0x1f90]
xor rcx, rsp
call fcn.1400398f0
lea r11, [rsp + 0x20a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
int3
mov ecx, 0x80004005
call fcn.140002c40
int3
mov ecx, 0x80070057
call fcn.140002c40
int3