Function at 0x1400048d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x418]
sub rsp, 0x4e0
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
movaps xmmword [rax - 0x48], xmm6
mov rax, qword [0x1400a2160]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
mov r13, rdx
mov qword [rbp - 0x80], rdx
mov r15, rcx
xor esi, esi
mov dword [rsp + 0x78], esi
mov word [rbp - 0x40], si
xor edx, edx
mov r8d, 0x3fe
lea rcx, [rbp - 0x3e]
call sub.MSVCR120.dll_memset
mov dword [rsp + 0x40], 0x400
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea rcx, [rsp + 0x50]
call fcn.140003ac0
mov qword [rsp + 0x50], rax
mov r12d, esi
mov dword [rsp + 0x40], 0x400
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x40]
xor edx, edx
mov rcx, qword [r15 + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x140004b96
lea ebx, [rsi + 2]
movss xmm6, dword [0x140041c94]
xor r13d, r13d
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], r13
mov word [rbp - 0x60], r13w
cmp word [rbp - 0x40], 0
jne 0x1400049bd
mov r8, r13
jmp 0x1400049d0
lea rax, [rbp - 0x40]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400049c5
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x60]
call fcn.140001c80
nop
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x44], r13d
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x70]
xor r8d, r8d
mov rcx, qword [r15 + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [r15 + 8], eax
test eax, eax
jne 0x140004af9
mov dword [rsp + 0x60], r13d
mov esi, dword [rsp + 0x44]
mov eax, dword [rsp + 0x64]
cmp esi, eax
jle 0x140004abd
mov edi, eax
cmp eax, 2
cmovl edi, ebx
cmp edi, esi
jge 0x140004a63
nop dword [rax]
movd xmm0, edi
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm6
cvttss2si edi, xmm0
cmp edi, esi
jl 0x140004a50
cmp edi, eax
jle 0x140004abd
movsxd rbx, edi
mov rcx, rbx
call fcn.140038c68
mov r14, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.MSVCR120.dll_memset
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140004aad
movsxd rax, dword [rsp + 0x60]
test eax, eax
je 0x140004aa8
mov r8, rax
mov rdx, rcx
mov rcx, r14
call sub.MSVCR120.dll_memcpy
mov rcx, qword [rsp + 0x68]
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x64], edi
mov ebx, 2
jmp 0x140004ac2
mov r14, qword [rsp + 0x68]
mov dword [rsp + 0x60], esi
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x70]
xor r8d, r8d
mov rcx, qword [r15 + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [r15 + 8], eax
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x50]
call fcn.140002560
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.140002a70
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140004b3b
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x60], r13
cmp qword [rbp - 0x48], 8
jb 0x140004b50
mov rcx, qword [rbp - 0x60]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_
inc r12d
mov dword [rsp + 0x40], 0x400
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x40]
mov edx, r12d
mov rcx, qword [r15 + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x1400049a0
mov r13, qword [rbp - 0x80]
xor esi, esi
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
mov rcx, r13
call fcn.140002ee0
nop
mov rax, qword [rsp + 0x50]
mov rbx, qword [rax + 8]
mov rdi, rbx
cmp byte [rbx + 0x19], 0
jne 0x140004c21
nop dword [rax + rax]
mov rdx, qword [rdi + 0x10]
lea rcx, [rsp + 0x50]
call fcn.140003c30
mov rdi, qword [rdi]
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x140004be3
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x40], 0
cmp qword [rbx + 0x38], 8
jb 0x140004bfb
mov rcx, qword [rbx + 0x20]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rbx + 0x38], 7
mov qword [rbx + 0x30], rsi
mov word [rbx + 0x20], si
mov rcx, rbx
call sub.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_
mov rbx, rdi
cmp byte [rdi + 0x19], 0
je 0x140004bc0
mov rax, qword [rsp + 0x50]
mov qword [rax + 8], rax
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x10], rcx
mov qword [rsp + 0x58], rsi
mov rcx, qword [rsp + 0x50]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_
mov rax, r13
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.140038f10
mov rbx, qword [rsp + 0x530]
movaps xmm6, xmmword [rsp + 0x4d0]
add rsp, 0x4e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret