Function at 0x14008dbc4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x188]
sub rsp, 0x288
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1401740c0]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov qword [rsp + 0x68], r9
mov rbx, r8
mov qword [rbp - 0x30], rbx
mov rax, rdx
mov qword [rsp + 0x60], rdx
mov qword [rbp - 0x80], rcx
mov qword [rbp + 0x60], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
xor edx, edx
mov qword [rbp + 0x20], rdx
mov qword [rsp + 0x78], rdx
test rax, rax
jne 0x14008defa
lea r8d, [rax + 0x13]
lea rdx, [rbp + 0x48]
mov rcx, rbx
call fcn.140069b8c
lea rdx, str.HKEY_LOCAL_MACHINE_
mov rcx, qword [rax]
call fcn.1400bdac4
test eax, eax
sete dil
mov rcx, qword [rbp + 0x48]
add rcx, 0xfffffffffffffff4
or rsi, 0xffffffffffffffff
cmp rcx, qword [0x140174010]
je 0x14008dc7c
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x14008dc7c
mov rcx, qword [rbp + 0x48]
add rcx, 0xfffffffffffffff4
call fcn.1400b0230
test dil, dil
mov edi, send
je 0x14008dc91
mov qword [rsp + 0x78], 0xffffffff80000002
jmp 0x14008dcf6
mov r8d, edi
lea rdx, [rbp + 0x28]
mov rcx, rbx
call fcn.140069b8c
lea rdx, str.HKEY_CURRENT_USER_
mov rcx, qword [rax]
call fcn.1400bdac4
test eax, eax
sete dil
mov rcx, qword [rbp + 0x28]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140174010]
je 0x14008dcdf
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x14008dcdf
mov rcx, qword [rbp + 0x28]
add rcx, 0xfffffffffffffff4
call fcn.1400b0230
test dil, dil
je 0x14008debe
mov qword [rsp + 0x78], 0xffffffff80000001
mov edi, send
mov r9d, edi
xor r8d, r8d
lea rdx, [rbp - 0x18]
mov rcx, rbx
call fcn.140069d3c
nop
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp + 0x10]
call fcn.14006ba5c
mov qword [rbp - 0x40], rax
lea r8d, [rdi + 1]
lea rdx, [rbp + 0x30]
mov rcx, rbx
call fcn.140069d14
nop
mov rdx, rax
mov rcx, rbx
call fcn.140067f7c
nop
mov rcx, qword [rbp + 0x30]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140174010]
je 0x14008dd61
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x14008dd61
mov rcx, qword [rbp + 0x30]
add rcx, 0xfffffffffffffff4
call fcn.1400b0230
mov rdx, qword [rbp - 0x40]
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
call fcn.1400213ac
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x14008dd93
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test rax, rax
je 0x14008dd93
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test rax, rax
jne 0x14008de06
mov ecx, 0x90
call fcn.1400b01ec
mov qword [rsp + 0x70], rax
xor ecx, ecx
test rax, rax
je 0x14008ddc2
lea rdx, [0x1401249e8]
mov rcx, rax
call fcn.140021638
mov rbx, rax
jmp 0x14008ddc5
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
call fcn.140021074
xor edi, edi
test rbx, rbx
je 0x14008ddf0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test rax, rax
je 0x14008ddf0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
jmp 0x14008ddf3
mov rax, rdi
mov r8, qword [rbp - 0x40]
lea rdx, str.name
mov rcx, rax
call fcn.1400219cc
lea rax, [rbp - 0x28]
mov qword [rsp + 0x70], rax
mov rcx, qword [rbp - 0x30]
mov rdi, qword [rcx]
xor ecx, ecx
cmp dword [rdi - 0xc], ecx
jl 0x14008de27
mov qword [rbp - 0x28], rdi
lock inc dword [rdi - 0xc]
jmp 0x14008de53
mov rax, qword [0x140174018]
mov qword [rbp - 0x28], rax
test rdi, rdi
jne 0x14008de3b
mov eax, ecx
jmp 0x14008de44
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rdi
mov edx, eax
lea rcx, [rbp - 0x28]
call fcn.1400670f0
nop
xor edi, edi
test rbx, rbx
je 0x14008de73
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test rax, rax
je 0x14008de73
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
jmp 0x14008de76
mov rax, rdi
mov r9, rax
lea r8, [rbp - 0x28]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x80]
call fcn.14008dbc4
nop
mov rcx, qword [rbp - 0x18]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140174010]
je 0x14008e91f
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x14008e91f
mov rcx, qword [rbp - 0x18]
add rcx, 0xfffffffffffffff4
jmp 0x14008e919
lea rcx, [rbp + 0x10]
call fcn.140067f00
nop
mov rcx, qword [rbx]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140174010]
je 0x14008def0
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x14008def0
mov rcx, qword [rbx]
sub rcx, 0xc
call fcn.1400b0230
mov eax, 1
jmp 0x14008e957
mov rcx, qword [r8]
or rsi, 0xffffffffffffffff
cmp dword [rcx - 8], edx
jle 0x14008df18
lea edx, [rsi + 0x5d]
call fcn.1400b2680
mov rdi, rax
xor edx, edx
test rax, rax
jne 0x14008df1c
mov edi, esi
jmp 0x14008df22
sub rdi, qword [rbx]
sar rdi, 1
mov rbx, qword [rbx]
cmp dword [rbx - 0xc], edx
jl 0x14008df34
mov qword [rbp - 0x38], rbx
lock inc dword [rbx - 0xc]
jmp 0x14008df60
mov rax, qword [0x140174018]
mov qword [rbp - 0x38], rax
test rbx, rbx
jne 0x14008df48
mov eax, edx
jmp 0x14008df51
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
mov edx, eax
lea rcx, [rbp - 0x38]
call fcn.1400670f0
nop
test edi, edi
jle 0x14008dfaf
mov r9d, edi
xor r8d, r8d
lea rdx, [rbp + 0x38]
mov rcx, qword [rbp - 0x30]
call fcn.140069d3c
nop
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.140067f7c
nop
mov rcx, qword [rbp + 0x38]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140174010]
je 0x14008dfaf
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x14008dfaf
mov rcx, qword [rbp + 0x38]
add rcx, 0xfffffffffffffff4
call fcn.1400b0230
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp + 0x10]
call fcn.14006ba5c
mov qword [rsp + 0x70], rax
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400213ac
mov rbx, rax
mov qword [rbp - 0x40], rax
xor eax, eax
test rbx, rbx
je 0x14008dff3
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x28]
test rax, rax
je 0x14008dff3
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test rax, rax
jne 0x14008e067
mov ecx, 0x90
call fcn.1400b01ec
mov qword [rbp - 0x40], rax
xor ecx, ecx
test rax, rax
je 0x14008e021
lea rdx, [0x1401249e8]
mov rcx, rax
call fcn.140021638
mov rbx, rax
jmp 0x14008e024
mov rbx, rcx
mov qword [rbp - 0x40], rbx
mov rdx, rbx
mov rcx, qword [rsp + 0x68]
call fcn.140021074
xor eax, eax
test rbx, rbx
je 0x14008e053
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test rax, rax
je 0x14008e053
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
mov r8, qword [rsp + 0x70]
lea rdx, str.name
mov rcx, rax
call fcn.1400219cc
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x80000000
xor r8d, r8d
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008e87e
test edi, edi
jle 0x14008e168
lea r8d, [rdi + 1]
lea rdx, [rbp + 0x40]
mov rdi, qword [rbp - 0x30]
mov rcx, rdi
call fcn.140069d14
nop
mov rdx, rax
mov rcx, rdi
call fcn.140067f7c
nop
mov rcx, qword [rbp + 0x40]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140174010]
je 0x14008e0e4
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x14008e0e4
mov rcx, qword [rbp + 0x40]
add rcx, 0xfffffffffffffff4
call fcn.1400b0230
lea rax, [rbp - 0x20]
mov qword [rsp + 0x70], rax
mov rdi, qword [rdi]
xor eax, eax
cmp dword [rdi - 0xc], eax
jl 0x14008e101
mov qword [rbp - 0x20], rdi
lock inc dword [rdi - 0xc]
jmp 0x14008e12b
mov rax, qword [0x140174018]
mov qword [rbp - 0x20], rax
xor eax, eax
test rdi, rdi
je 0x14008e11c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rdi
mov edx, eax
lea rcx, [rbp - 0x20]
call fcn.1400670f0
nop
xor edi, edi
test rbx, rbx
je 0x14008e14b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test rax, rax
je 0x14008e14b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
jmp 0x14008e14e
mov rax, rdi
mov r9, rax
lea r8, [rbp - 0x20]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x80]
call fcn.14008dbc4
jmp 0x14008e871
xor edi, edi
mov dword [rbp - 0x64], edi
mov dword [rbp - 0x68], edi
mov dword [rbp - 0x48], edi
mov dword [rbp - 0x60], edi
mov dword [rbp - 0x5c], edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14008e871
xor eax, eax
cmp dword [rbp - 0x64], eax
jle 0x14008e297
mov ecx, dword [rbp - 0x68]
inc ecx
mov eax, 2
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400b0228
mov qword [rsp + 0x68], rax
mov ecx, dword [rbp - 0x68]
inc ecx
mov dword [rbp - 0x10], ecx
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x10]
mov r8, rax
mov edx, edi
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14008e280
lea rax, [rbp + 0x50]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x68]
lea rcx, [rbp + 0x50]
call fcn.140067e3c
mov qword [rsp + 0x70], rax
xor eax, eax
test rbx, rbx
je 0x14008e26a
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x28]
test rax, rax
je 0x14008e26a
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x28]
nop
mov r9, rax
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x80]
call fcn.14008dbc4
mov rcx, qword [rsp + 0x68]
call fcn.1400b0230
inc edi
cmp edi, dword [rbp - 0x64]
jl 0x14008e1db
xor eax, eax
mov edi, eax
mov dword [rbp - 0x44], eax
cmp dword [rbp - 0x48], eax
jle 0x14008e871
mov ecx, dword [rbp - 0x60]
inc ecx
mov eax, 2
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400b0228
mov qword [rsp + 0x68], rax
mov ecx, dword [rbp - 0x5c]
call fcn.1400b0228
mov qword [rbp - 0x80], rax
mov ecx, dword [rbp - 0x60]
inc ecx
mov dword [rbp + 8], ecx
mov ecx, dword [rbp - 0x5c]
mov dword [rbp - 0x78], ecx
xor edx, edx
mov dword [rbp - 0x58], edx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 8]
mov r8, qword [rsp + 0x68]
mov edx, edi
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor edi, edi
test eax, eax
jne 0x14008e84b
test rbx, rbx
je 0x14008e33d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test rax, rax
je 0x14008e33d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
mov rdi, rax
mov rdx, qword [rsp + 0x68]
lea rcx, [rbp + 0x10]
call fcn.14006ba5c
mov rdx, rax
mov rcx, rdi
call fcn.1400213ac
mov rdi, rax
mov qword [rbp - 0x70], rax
xor eax, eax
test rdi, rdi
je 0x14008e37b
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
test rax, rax
je 0x14008e37b
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
test rax, rax
jne 0x14008e3e0
mov ecx, 0x90
call fcn.1400b01ec
mov qword [rbp + 0x68], rax
xor ecx, ecx
test rax, rax
je 0x14008e3ab
lea rdx, [0x1401249ec]
mov rcx, rax
call fcn.140021638
mov rdi, rax
xor ecx, ecx
jmp 0x14008e3ae
mov rdi, rcx
mov qword [rbp - 0x70], rdi
test rbx, rbx
je 0x14008e3d2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
xor ecx, ecx
test rax, rax
je 0x14008e3d2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
jmp 0x14008e3d5
mov rax, rcx
mov rdx, rdi
mov rcx, rax
call fcn.140021074
xor eax, eax
test rdi, rdi
je 0x14008e3fe
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
test rax, rax
je 0x14008e3fe
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x68]
lea rcx, [rbp + 0x10]
call fcn.14006ba5c
mov r8, rax
lea rdx, str.name
mov rcx, qword [rsp + 0x60]
call fcn.1400219cc
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp + 0xf0]
call fcn.1400b1c70
mov r9d, dword [rbp - 0x58]
cmp r9d, 3
jne 0x14008e44c
lea rax, str.REG_BINARY
jmp 0x14008e4b6
cmp r9d, 4
jne 0x14008e45b
lea rax, str.REG_DWORD
jmp 0x14008e4b6
cmp r9d, 2
jne 0x14008e46a
lea rax, str.REG_EXPAND_SZ
jmp 0x14008e4b6
cmp r9d, 7
jne 0x14008e479
lea rax, str.REG_MULTI_SZ
jmp 0x14008e4b6
cmp r9d, 0xb
jne 0x14008e488
lea rax, str.REG_QWORD
jmp 0x14008e4b6
cmp r9d, 1
jne 0x14008e497
lea rax, str.REG_SZ
jmp 0x14008e4b6
lea r8, str.Unknown_type__0x_08x_
mov edx, 0x80
lea rcx, [rbp + 0xf0]
call fcn.140095180
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x60], rax
xor eax, eax
test rdi, rdi
je 0x14008e4d9
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
test rax, rax
je 0x14008e4d9
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
mov r8, qword [rsp + 0x60]
lea rdx, str.type
mov rcx, rax
call fcn.1400219cc
mov ecx, dword [rbp - 0x58]
cmp ecx, 3
jne 0x14008e620
mov qword [rbp + 0x90], reloc.WS2_32.dll_ntohs
xor eax, eax
mov qword [rbp + 0x88], rax
mov byte [rbp + 0x78], al
mov dword [rbp - 0x50], eax
cmp dword [rbp - 0x78], eax
jle 0x14008e5bc
mov rbx, qword [rbp - 0x80]
mov esi, eax
xor edi, edi
movzx r9d, byte [rbx]
lea r8, [0x140124a68]
mov edx, 0xa
lea rcx, [rbp + 0x98]
call fcn.140095180
cmp byte [rbp + 0x98], dil
jne 0x14008e54e
mov rax, rdi
jmp 0x14008e55a
lea rcx, [rbp + 0x98]
call fcn.1400d9890
mov r8, rax
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0x78]
call fcn.14006bd9c
mov eax, dword [rbp - 0x78]
cmp esi, eax
jge 0x14008e596
lea rcx, [0x14014dfb8]
call fcn.1400d9890
mov r8, rax
lea rdx, [0x14014dfb8]
lea rcx, [rbp + 0x78]
call fcn.14006bd9c
mov eax, dword [rbp - 0x78]
inc esi
inc rbx
cmp esi, eax
jl 0x14008e524
cmp qword [rbp + 0x90], 0x10
mov rbx, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x70]
mov rsi, 0xffffffffffffffff
mov rax, qword [rbp + 0x78]
jae 0x14008e5c0
lea rax, [rbp + 0x78]
mov qword [rsp + 0x60], rax
xor eax, eax
test rdi, rdi
je 0x14008e5e3
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
test rax, rax
je 0x14008e5e3
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
mov r8, qword [rsp + 0x60]
lea rdx, str.value
mov rcx, rax
call fcn.1400219cc
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x14008e84b
inc rdx
mov r8d, 1
mov rcx, qword [rbp + 0x78]
call fcn.140067584
jmp 0x14008e84b
cmp ecx, 4
jne 0x14008e685
xor edx, edx
lea r8d, [rcx + 0x3c]
lea rcx, [rbp + 0xb0]
call fcn.1400b1c70
mov rax, qword [rbp - 0x80]
mov r9d, dword [rax]
mov dword [rsp + 0x20], r9d
lea r8, str.0x_08x___lu_
mov edx, reloc.OLEAUT32.dll_VarI4FromDisp
lea rcx, [rbp + 0xb0]
call fcn.140095180
xor eax, eax
test rdi, rdi
je 0x14008e679
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
test rax, rax
je 0x14008e679
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
lea r8, [rbp + 0xb0]
jmp 0x14008e83c
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x14008e807
cmp ecx, 7
jne 0x14008e84b
xor r8d, r8d
mov edx, r8d
mov dword [rbp - 0x50], edx
mov ecx, r8d
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x70], rax
mov dword [rbp - 0x70], ecx
cmp word [rax], r8w
jne 0x14008e7fc
mov eax, ecx
sub eax, edx
mov dword [rsp + 0x60], eax
mov rsi, qword [0x140174018]
mov qword [rbp - 8], rsi
je 0x14008e70d
mov edx, eax
lea rcx, [rbp - 8]
call fcn.140067064
mov rsi, qword [rbp - 8]
test eax, eax
je 0x14008e70d
movsxd rcx, dword [rsp + 0x60]
mov r9, rcx
add r9, r9
movsxd rax, dword [rbp - 0x50]
mov rdx, qword [rbp - 0x80]
lea r8, [rdx + rax*2]
lea eax, [rcx + 1]
movsxd rdx, eax
add rdx, rdx
mov rcx, rsi
call fcn.140067c20
nop
mov rdx, rsi
lea rcx, [rbp + 0x10]
call fcn.14006ba5c
mov qword [rbp - 0x50], rax
mov ecx, 0x90
call fcn.1400b01ec
mov qword [rbp + 0x70], rax
xor ecx, ecx
test rax, rax
je 0x14008e74a
lea rdx, [0x140124a80]
mov rcx, rax
call fcn.140021638
mov qword [rsp + 0x60], rax
xor ecx, ecx
jmp 0x14008e74f
mov qword [rsp + 0x60], rcx
test rdi, rdi
je 0x14008e76f
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
xor ecx, ecx
test rax, rax
je 0x14008e76f
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
jmp 0x14008e772
mov rax, rcx
mov rdx, qword [rsp + 0x60]
mov rcx, rax
call fcn.140021074
mov rcx, qword [rsp + 0x60]
xor eax, eax
test rcx, rcx
je 0x14008e7a1
mov rax, qword [rcx]
call qword [rax + 0x28]
test rax, rax
je 0x14008e7a1
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov r8, qword [rbp - 0x50]
lea rdx, str.value
mov rcx, rax
call fcn.1400219cc
mov edx, dword [rbp - 0x70]
inc edx
mov dword [rbp - 0x50], edx
lea rcx, [rsi - 0xc]
or rsi, 0xffffffffffffffff
xor r8d, r8d
cmp rcx, qword [0x140174010]
je 0x14008e7e7
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x14008e7e7
call fcn.1400b0230
mov edx, dword [rbp - 0x50]
xor r8d, r8d
mov rax, qword [rsp + 0x70]
cmp word [rax], r8w
jne 0x14008e7f9
cmp word [rax + 2], r8w
je 0x14008e84b
mov ecx, dword [rbp - 0x70]
inc ecx
add rax, 2
jmp 0x14008e6aa
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp + 0x10]
call fcn.14006ba5c
mov qword [rsp + 0x70], rax
xor eax, eax
test rdi, rdi
je 0x14008e837
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x28]
test rax, rax
je 0x14008e837
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x28]
mov r8, qword [rsp + 0x70]
lea rdx, str.value
mov rcx, rax
call fcn.1400219cc
mov rcx, qword [rsp + 0x68]
call fcn.1400b0230
mov rcx, qword [rbp - 0x80]
call fcn.1400b0230
mov eax, dword [rbp - 0x44]
inc eax
mov dword [rbp - 0x44], eax
cmp eax, dword [rbp - 0x48]
mov edi, eax
jl 0x14008e2a5
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14008e8fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp]
call fcn.140068980
nop
mov rdx, qword [rbp]
lea rcx, [rbp + 0x10]
call fcn.14006ba5c
mov rdi, rax
xor eax, eax
test rbx, rbx
je 0x14008e8be
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x28]
test rax, rax
je 0x14008e8be
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x28]
mov r8, rdi
lea rdx, str.error
mov rcx, rax
call fcn.1400219cc
nop
mov rcx, qword [rbp]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140174010]
je 0x14008e8fc
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x14008e8fc
mov rcx, qword [rbp]
add rcx, 0xfffffffffffffff4
call fcn.1400b0230
nop
mov rcx, qword [rbp - 0x38]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140174010]
je 0x14008e91f
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x14008e91f
call fcn.1400b0230
nop
lea rcx, [rbp + 0x10]
call fcn.140067f00
nop
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rcx]
add rdx, 0xfffffffffffffff4
cmp rdx, qword [0x140174010]
je 0x14008e955
mov eax, esi
lock xadd dword [rdx], eax
add eax, esi
test eax, eax
jg 0x14008e955
mov rcx, qword [rcx]
sub rcx, 0xc
call fcn.1400b0230
xor eax, eax
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400b0730
add rsp, 0x288
pop rdi
pop rsi
pop rbx
pop rbp
ret