Function at 0x140012ab0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5e8]
sub rsp, 0x6e8
mov rbx, rcx
xor edx, edx
lea rcx, [rbp - 0x30]
mov r8d, 0x208
call fcn.1400452a0
xor r13d, r13d
mov dword [rsp + 0x74], 0x104
mov rdx, rbx
mov dword [rsp + 0x70], r13d
lea rcx, [rbp + 0x628]
mov qword [rbp - 0x80], r13
mov r12d, r13d
mov dword [rsp + 0x60], r13d
mov qword [rbp + 0x628], r13
call fcn.140011c30
mov r14, qword [rbp + 0x628]
lea rax, [rsp + 0x68]
mov rdx, r14
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140012b86
test r14, r14
je 0x140012b72
mov r15, 0xffffffffffffffff
nop word [rax + rax]
cmp word [r14 + r15*2 + 2], r12w
lea r15, [r15 + 1]
jne 0x140012b50
lea r8, [r15 + r15]
xor edx, edx
mov rcx, r14
call fcn.1400452a0
mov rcx, r14
call fcn.1400462d0
xor eax, eax
add rsp, 0x6e8
pop r15
pop r14
pop r13
pop r12
pop rbx
pop rbp
ret
mov rcx, qword [rsp + 0x68]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x74]
lea rax, [rbp - 0x60]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rdx, [rbp - 0x30]
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x638]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140012f87
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x140012f87
mov qword [rsp + 0x6e0], rdi
mov r15, 0xffffffffffffffff
mov edi, r13d
mov qword [rsp + 0x720], rsi
mov dword [rbp + 0x630], r13d
nop
mov ecx, dword [rbp + 0x638]
inc ecx
add rcx, rcx
call fcn.1400462e4
mov qword [rbp - 0x48], rax
mov rbx, rax
test rax, rax
je 0x140012f77
mov ecx, dword [rbp + 0x638]
lea r9, [rsp + 0x60]
inc ecx
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x60], ecx
mov r8, rax
mov word [rax], r13w
mov edx, edi
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140012f37
xor edx, edx
mov dword [rsp + 0x78], 1
mov r8d, 0x400
lea rcx, [rbp + 0x1e0]
call fcn.1400452a0
lea rax, [rsp + 0x68]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140012f37
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x628]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x78]
lea rax, [rbp + 0x1e0]
mov dword [rbp + 0x628], 0x400
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140012f37
mov ecx, dword [rbp + 0x628]
lea rcx, [rcx*4 + 2]
call fcn.1400462e4
mov rsi, rax
test rax, rax
je 0x140012f37
mov word [rax], r13w
mov rbx, r13
mov ecx, dword [rbp + 0x628]
test rcx, rcx
je 0x140012d7f
nop dword [rax]
sub rcx, rbx
mov rax, r15
movzx r9d, byte [rbp + rcx + 0x1df]
nop
cmp word [rsi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140012d50
lea rcx, [rsi + rax*2]
mov edx, 3
lea r8, [0x140083b10]
call fcn.1400159a0
mov ecx, dword [rbp + 0x628]
inc rbx
cmp rbx, rcx
jb 0x140012d40
mov rax, r15
inc rax
cmp word [rsi + rax*2], 0
jne 0x140012d82
cmp rax, 8
jb 0x140012f10
mov rcx, rax
mov r12d, 1
shr rcx, 3
mov qword [rbp - 0x50], rcx
cmp r12, rcx
ja 0x140012f0c
lea r13, [rsi - 0x10]
xor ebx, ebx
lea r13, [r13 + rax*2]
nop dword [rax + rax]
xor eax, eax
lea rcx, [rbp - 0x78]
xorps xmm0, xmm0
mov word [rbp - 0x68], ax
mov rdx, r13
movups xmmword [rbp - 0x78], xmm0
lea r8d, [rax + 8]
call fcn.14004dff0
mov rcx, r15
mov word [rbp - 0x68], bx
inc rcx
cmp word [r14 + rcx*2], 0
jne 0x140012de4
lea rdx, [rbp - 0x78]
mov rax, r15
inc rax
cmp word [rdx + rax*2], 0
jne 0x140012df6
add rcx, rax
lea rcx, [rcx*2 + 2]
call fcn.1400462e4
mov rdi, rax
test rax, rax
je 0x140012ef2
mov word [rax], bx
lea rcx, [rax - 2]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140012e23
xor edx, edx
movzx eax, word [r14 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140012e30
lea rax, [rdi - 2]
nop word [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140012e50
lea r8, [rbp - 0x78]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x140012e70
mov rcx, rdi
call fcn.140011340
mov rbx, rax
mov r8, r15
inc r8
cmp word [rdi + r8*2], 0
jne 0x140012e90
add r8, r8
xor edx, edx
mov rcx, rdi
call fcn.1400452a0
mov rcx, rdi
call fcn.1400462d0
mov rcx, rbx
call fcn.14002aee0
test al, al
jne 0x140012fa7
test rbx, rbx
je 0x140012ef0
mov r8, r15
nop dword [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140012ed0
add r8, r8
xor edx, edx
mov rcx, rbx
call fcn.1400452a0
mov rcx, rbx
call fcn.1400462d0
xor ebx, ebx
inc r12
sub r13, 0x10
cmp r12, qword [rbp - 0x50]
jbe 0x140012dc0
mov edi, dword [rbp + 0x630]
xor r13d, r13d
mov r12, qword [rbp - 0x80]
mov r8, r15
inc r8
cmp word [rsi + r8*2], 0
jne 0x140012f13
add r8, r8
xor edx, edx
mov rcx, rsi
call fcn.1400452a0
mov rcx, rsi
call fcn.1400462d0
mov rbx, qword [rbp - 0x48]
mov r8, r15
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140012f40
add r8, r8
xor edx, edx
mov rcx, rbx
call fcn.1400452a0
mov rcx, rbx
call fcn.1400462d0
test r12, r12
jne 0x140012f77
inc edi
mov dword [rbp + 0x630], edi
cmp edi, dword [rsp + 0x64]
jb 0x140012c20
mov rsi, qword [rsp + 0x720]
mov rdi, qword [rsp + 0x6e0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, r12
add rsp, 0x6e8
pop r15
pop r14
pop r13
pop r12
pop rbx
pop rbp
ret
mov edi, dword [rbp + 0x630]
mov r12, rbx
mov qword [rbp - 0x80], rbx
xor r13d, r13d
jmp 0x140012f10