Function at 0x14001a054
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x438]
sub rsp, 0x500
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
mov rdi, r8
mov qword [rsp + 0x58], r8
mov rsi, rdx
mov qword [rsp + 0x38], rdx
mov r12, rcx
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x60], rdx
mov r9d, dword [0x1401aad80]
lea r8d, [r9 + 2]
lea eax, [r9 + 1]
imul r8d, eax
imul r8d, r9d
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub r8d, edx
xor r15d, r15d
cmp r8d, 0xd
jne 0x14001a10e
mov edx, r15d
lea r8, [rbp - 0x50]
mov eax, dword [r8]
lea ecx, [rax + rax*2]
shl ecx, 4
add r9d, ecx
inc edx
lea r8, [r8 + 4]
movsxd rax, edx
cmp rax, 0xc0
jb 0x14001a0ea
mov dword [0x1401aad80], r9d
mov al, byte [0x1401aad84]
neg al
sbb r13, r13
mov ecx, r9d
imul ecx, r9d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0xa
jne 0x14001a1b1
mov r10d, r15d
lea r8, [rbp + 0x70]
mov bl, r9b
sub bl, r10b
mov r11d, 1
lea r14d, [r11 + 8]
mov rdi, r15
mov eax, r9d
cdq
idiv r11d
mov dword [rsp + 0x30], edx
mov r15d, 1
mov esi, edx
mov eax, r9d
cdq
idiv r15d
mov ecx, eax
mov al, sil
imul cl
mov cl, al
mov al, bl
imul cl
mov byte [r8 + rdi], al
inc r15d
inc rdi
cmp rdi, 9
jl 0x14001a168
inc r11d
add r8, 9
dec r14
mov r15d, 0
jne 0x14001a152
inc r10d
cmp r10d, 0xb
jl 0x14001a142
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x58]
lea rcx, [0x1401a29a8]
mov rax, qword [0x1401a29a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x50], r15
mov r9d, dword [0x1401aad80]
lea r8d, [r9 + 2]
lea ecx, [r9 + 1]
imul r8d, ecx
imul r8d, r9d
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub r8d, edx
cmp r8d, 0xb
jne 0x14001a26a
mov ecx, r9d
imul ecx, r9d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0xf
jne 0x14001a255
lea ecx, [r8 - 0xa]
cmp r9d, ecx
jle 0x14001a24f
mov eax, r9d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r9d
jl 0x14001a240
mov dword [0x1401aad80], ecx
mov edx, 0xca
lea r8d, [rdx + 1]
lea rcx, str._d__d_n
call fcn.1400be234
lea rdx, [0x14013ae08]
lea rcx, [rsp + 0x78]
call fcn.140002df8
nop
mov r8, rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x68]
call fcn.14000de60
nop
lea r8, [0x1401ab268]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14000de60
nop
lea r8, [0x14013ad98]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140019018
nop
mov r8, r12
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14000de60
nop
mov r9d, 0x20019
mov r8, qword [rax]
lea rdx, [r13 - 0x7ffffffe]
lea rcx, [rsp + 0x40]
call fcn.140019dc4
test eax, eax
setne bl
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
or r14d, 0xffffffff
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x14001a30d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x14001a32e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x14001a34f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x14001a371
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x14001a392
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14001a3f8
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14001a3ab
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], r15d
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x14001a3d2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x14001a3f3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x14001a5bc
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x60], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov rdx, qword [rsi]
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001a546
cmp dword [rsp + 0x58], 4
jne 0x14001a546
mov eax, r15d
test eax, eax
jne 0x14001a546
test rbx, rbx
je 0x14001a466
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r15
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], r15d
mov eax, dword [rsp + 0x30]
mov dword [rdi], eax
mov r8d, dword [0x1401aad80]
lea r9d, [r8 + 1]
mov ecx, r9d
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xf
jne 0x14001a4c4
test r8d, r8d
je 0x14001a4ba
dec r8d
je 0x14001a4b1
mov dword [0x1401aad80], r9d
jmp 0x14001a4c4
mov dword [0x1401aad80], r15d
jmp 0x14001a4c4
mov dword [0x1401aad80], 2
test rbx, rbx
je 0x14001a4d7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], r15d
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x14001a4fe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x14001a51f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov ecx, r14d
lock xadd dword [rdx + 0x10], ecx
add ecx, r14d
test ecx, ecx
jg 0x14001a53f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, 1
jmp 0x14001a5dd
test rbx, rbx
je 0x14001a55c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r15
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], r15d
test rbx, rbx
je 0x14001a574
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], r15d
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x14001a59b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x14001a5bc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x14001a5db
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.1400bd920
mov rbx, qword [rsp + 0x558]
add rsp, 0x500
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret