Function at 0x140013170
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push r12
push r13
lea rbp, [rsp - 0x118]
sub rsp, 0x218
mov rax, qword [0x140228058]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov eax, dword [0x140228cd8]
xor ebx, ebx
mov r8, qword [0x14023f580]
mov r12, rcx
lea r13d, [rax - 1]
test r8, r8
je 0x1400131df
mov rax, qword [0x14023f308]
test rax, rax
je 0x1400131d2
test r8, r8
je 0x1400131d2
mov rcx, qword [0x14023f308]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x140228cd8]
mov qword [0x14023f580], rbx
mov r8d, eax
mov rax, qword [0x14023f308]
shl r8, 4
test rax, rax
je 0x140013207
mov rcx, qword [0x14023f308]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [0x14023f580], rbx
test rbx, rbx
je 0x14001363d
mov r8d, dword [0x140228cd8]
xor edx, edx
shl r8, 4
mov rcx, rbx
mov qword [rsp + 0x248], rsi
call fcn.14015cb20
movabs rax, 0x1c1b0de9bf1d0000
mov esi, 1
mov qword [rbx], rax
movabs rax, 0x1c1b0de9bf800000
mov qword [rbx + 8], rax
test r13d, r13d
jle 0x140013635
mov qword [rsp + 0x250], rdi
mov qword [rsp + 0x258], r14
lea r14d, [rsi + 0xf]
mov qword [rsp + 0x210], r15
mov r15d, esi
nop dword [rax]
xor edx, edx
mov dword [rsp + 0x30], VariantTimeToDosDateTime
lea rcx, [rbp - 0x30]
lea r8d, [rdx + 0x50]
call fcn.14015cb20
movups xmm0, xmmword [str.MgLowerRange]
lea rdx, [0x1401d519c]
xor eax, eax
movsd xmm1, qword [0x1401d5170]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
mov r8d, esi
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
movzx eax, word [0x1401d5178]
mov word [rbp - 0x58], ax
xor eax, eax
mov qword [rbp - 0x56], rax
mov qword [rbp - 0x4e], rax
mov qword [rbp - 0x46], rax
mov qword [rbp - 0x3e], rax
mov word [rbp - 0x36], ax
movzx eax, word [0x1401d5198]
movups xmmword [rbp - 0x70], xmm0
mov word [rsp + 0x68], ax
xor eax, eax
movups xmm0, xmmword [str.MgUpperRange]
mov qword [rsp + 0x6a], rax
movsd qword [rbp - 0x60], xmm1
movsd xmm1, qword [0x1401d5190]
mov qword [rsp + 0x72], rax
mov qword [rsp + 0x7a], rax
mov qword [rbp - 0x7e], rax
mov word [rbp - 0x76], ax
movups xmmword [rsp + 0x50], xmm0
movsd qword [rsp + 0x60], xmm1
call fcn.140013d60
lea rcx, [rbp - 0x70]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140013340
lea r8, [rsp + 0x38]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140013360
lea rcx, [rsp + 0x50]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140013380
lea r8, [rsp + 0x38]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1400133a0
lea rcx, [rsp + 0x50]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400133c0
add eax, eax
lea r9, [rsp + 0x30]
mov dword [rsp + 0x34], eax
lea rdx, [rbp - 0x70]
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, r12
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001360a
cmp dword [rsp + 0x30], 1
jne 0x14001360a
xor edx, edx
lea r8d, [rax + 0x64]
lea rcx, [rbp + 0x20]
call fcn.14015cb20
lea rax, [rbp - 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140013425
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x20]
call fcn.14016ade0
mov rdi, qword [0x14023f580]
lea r11, [rbp + 0x20]
add rdi, r14
mov ebx, 7
mov qword [rdi], 0
nop word [rax + rax]
xor r9b, r9b
mov r10d, SafeArrayUnlock
xor r8d, r8d
nop dword [rax]
movzx ecx, byte [r11 + r8]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140013481
sub cl, 0x30
jmp 0x140013495
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x14001348d
sub cl, 0x37
jmp 0x140013495
cmp cl, 0x61
jl 0x1400134bc
sub cl, 0x57
movzx edx, r10b
mov eax, r10d
movzx ecx, cl
inc r8
imul edx, ecx
add r9b, dl
cdq
and edx, 0xf
lea r10d, [rdx + rax]
sar r10d, 4
cmp r8, 2
jl 0x140013470
jmp 0x1400134bf
xor r9b, r9b
mov byte [rbx + rdi], r9b
add r11, 2
dec rbx
cmp rbx, 1
jg 0x140013460
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rbp - 0x30]
mov rcx, r12
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400135f3
cmp dword [rsp + 0x30], 1
jne 0x1400135f3
xor edx, edx
lea r8d, [rax + 0x64]
lea rcx, [rbp + 0x90]
call fcn.14015cb20
lea rax, [rbp - 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140013530
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x90]
call fcn.14016ade0
mov rax, qword [0x14023f580]
lea r11, [rbp + 0x90]
lea rdi, [rax + r14]
mov ebx, 7
mov qword [rdi + 8], 0
nop word [rax + rax]
xor r9b, r9b
mov r10d, SafeArrayUnlock
xor r8d, r8d
nop dword [rax]
movzx eax, byte [r11 + r8]
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x140013591
sub al, 0x30
jmp 0x1400135a3
lea ecx, [rax - 0x41]
cmp cl, 5
ja 0x14001359d
sub al, 0x37
jmp 0x1400135a3
cmp al, 0x61
jl 0x1400135ca
sub al, 0x57
movzx ecx, al
inc r8
movzx edx, r10b
mov eax, r10d
imul edx, ecx
add r9b, dl
cdq
and edx, 0xf
add eax, edx
sar eax, 4
mov r10d, eax
cmp r8, 2
jl 0x140013580
jmp 0x1400135cd
xor r9b, r9b
mov byte [rbx + rdi + 8], r9b
add r11, 2
dec rbx
cmp rbx, 1
jg 0x140013570
inc esi
inc r15
add r14, 0x10
cmp esi, r13d
jle 0x140013280
jmp 0x14001361d
mov rax, qword [0x14023f580]
add r15, r15
xor ebx, ebx
mov qword [rax + r15*8], rbx
mov qword [rax + r15*8 + 8], rbx
jmp 0x14001361d
mov rax, qword [0x14023f580]
movsxd rcx, esi
add rcx, rcx
xor ebx, ebx
mov qword [rax + rcx*8], rbx
mov r14, qword [rsp + 0x258]
mov rdi, qword [rsp + 0x250]
mov r15, qword [rsp + 0x210]
mov rsi, qword [rsp + 0x248]
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.14013df50
add rsp, 0x218
pop r13
pop r12
pop rbx
pop rbp
ret