Function at 0x140049f60
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r13, r9
mov rsi, r8
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x14018a040]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [0x14019bca8], 0
je 0x14004a2ff
mov qword [rsp + 0x40], rsi
xorps xmm0, xmm0
lea rcx, [rsp + 0x50]
movaps xmmword [rcx], xmm0
mov rdx, rdi
call sub.ntdll.dll_RtlInitUnicodeString
mov dword [rsp + 0x4c], 0x18
mov ecx, 0x18
call fcn.1400b5178
test rax, rax
je 0x14004a1be
mov rdi, rax
mov byte [rax], 0
cmp rax, 0xffffffffffffffff
je 0x14004a1be
mov byte [rdi + 1], 0
cmp rdi, 0xfffffffffffffffe
je 0x14004a1be
mov byte [rdi + 2], 0
cmp rdi, 0xfffffffffffffffd
je 0x14004a1be
mov byte [rdi + 3], 0
cmp rdi, 0xfffffffffffffffc
je 0x14004a1be
mov byte [rdi + 4], 0
cmp rdi, 0xfffffffffffffffb
je 0x14004a1be
mov byte [rdi + 5], 0
cmp rdi, 0xfffffffffffffffa
je 0x14004a1be
mov byte [rdi + 6], 0
cmp rdi, 0xfffffffffffffff9
je 0x14004a1be
mov byte [rdi + 7], 0
cmp rdi, 0xfffffffffffffff8
je 0x14004a1be
mov byte [rdi + 8], 0
cmp rdi, 0xfffffffffffffff7
je 0x14004a1be
mov byte [rdi + 9], 0
cmp rdi, 0xfffffffffffffff6
je 0x14004a1be
mov byte [rdi + 0xa], 0
cmp rdi, 0xfffffffffffffff5
je 0x14004a1be
mov byte [rdi + 0xb], 0
cmp rdi, 0xfffffffffffffff4
je 0x14004a1be
mov byte [rdi + 0xc], 0
cmp rdi, 0xfffffffffffffff3
je 0x14004a1be
mov byte [rdi + 0xd], 0
cmp rdi, 0xfffffffffffffff2
je 0x14004a1be
mov byte [rdi + 0xe], 0
cmp rdi, 0xfffffffffffffff1
je 0x14004a1be
mov byte [rdi + 0xf], 0
cmp rdi, 0xfffffffffffffff0
je 0x14004a1be
mov byte [rdi + 0x10], 0
cmp rdi, 0xffffffffffffffef
je 0x14004a1be
mov byte [rdi + 0x11], 0
cmp rdi, 0xffffffffffffffee
je 0x14004a1be
mov byte [rdi + 0x12], 0
cmp rdi, 0xffffffffffffffed
je 0x14004a1be
mov byte [rdi + 0x13], 0
cmp rdi, 0xffffffffffffffec
je 0x14004a1be
mov byte [rdi + 0x14], 0
cmp rdi, 0xffffffffffffffeb
je 0x14004a1be
mov byte [rdi + 0x15], 0
cmp rdi, 0xffffffffffffffea
je 0x14004a1be
mov byte [rdi + 0x16], 0
cmp rdi, 0xffffffffffffffe9
je 0x14004a1be
mov rsi, rdi
add rsi, 0x18
mov byte [rdi + 0x17], 0
xor ebx, ebx
lea r8, [rsp + 0x4c]
lea rdx, [rsp + 0x50]
mov r12, rsi
mov ebp, dword [rsp + 0x4c]
mov r15, r12
sub r15, rdi
mov rax, rbp
sub rax, r15
ja 0x14004a1d7
jb 0x14004a310
mov eax, dword [rsp + 0x4c]
mov r15, r8
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], eax
mov rcx, r14
mov rbp, rdx
mov r8d, 1
mov r9, rdi
call sub.ntdll.dll_NtQueryValueKey
cmp eax, 0x80000005
je 0x14004a1c4
cmp eax, 0xc0000023
je 0x14004a1c4
test eax, eax
js 0x14004a1c0
mov eax, dword [rdi + 4]
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov r9d, dword [rdi + 0xc]
test r9, r9
je 0x14004a204
mov edx, dword [rdi + 8]
add rdx, rdi
lea r8, [rdx + r9]
mov rcx, r13
call fcn.14002fa10
mov sil, 1
test rdi, rdi
je 0x14004a2b9
mov rax, r12
sub rax, rdi
dec r12
cmp rax, r12
jbe 0x14004a2b1
ud2
xor esi, esi
jmp 0x14004a1a3
inc ebx
cmp ebx, 5
mov r8, r15
mov rdx, rbp
jne 0x14004a129
jmp 0x14004a1c0
mov rcx, rsi
sub rcx, r12
cmp rcx, rax
jb 0x14004a269
lea rcx, [r12 + rax]
test r12, r12
je 0x14004a1be
mov byte [r12], 0
inc r12
dec rax
jne 0x14004a1ea
mov r12, rcx
jmp 0x14004a145
mov rax, qword [r13]
mov rcx, qword [r13 + 8]
mov rdx, rcx
sub rdx, rax
dec rcx
cmp rdx, rcx
ja 0x14004a1be
mov qword [r13 + 8], rax
jmp 0x14004a1a0
mov rcx, r13
mov rdx, rdi
mov r8, r15
call fcn.1400e6940
jmp 0x14004a245
cmp r15, 3
jne 0x14004a220
mov al, byte [rdi + 2]
mov byte [r13 + 2], al
movzx eax, word [rdi]
mov word [r13], ax
test rdi, rdi
je 0x14004a252
mov rcx, rdi
call fcn.1400b51b4
mov rdi, r13
mov r13, qword [rsp + 0x38]
lea r8, [rsp + 0x4c]
lea rdx, [rsp + 0x50]
jmp 0x14004a145
mov qword [rsp + 0x38], r13
sub rsi, rdi
lea r12, [rsi + rsi]
cmp r12, rbp
cmovbe r12, rbp
movabs rax, 0x3fffffffffffffff
cmp rsi, rax
movabs rax, 0x7fffffffffffffff
cmovae r12, rax
mov rcx, r12
call fcn.1400b5178
mov r13, rax
mov rsi, r12
add rsi, rax
lea r12, [rax + rbp]
mov rax, r15
jmp 0x14004a2e3
mov rcx, rdi
call fcn.1400b51b4
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
cmp rcx, qword [0x14018a040]
je 0x14004a2d0
call fcn.1400b64a0
int3
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r13
add rcx, rax
je 0x14004a1be
mov byte [rcx], 0
inc rax
cmp rbp, rax
jne 0x14004a2e3
jmp 0x14004a230
call fcn.1400495f0
test al, al
jne 0x140049f98
xor esi, esi
jmp 0x14004a2b9
add rbp, rdi
mov rax, r12
sub rax, rbp
dec r12
cmp rax, r12
ja 0x14004a1be
mov rcx, rdx
mov r12, rbp
mov rdx, rcx
jmp 0x14004a145