Function at 0x1400036e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x14371c080]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov rbx, rdx
mov r14, rcx
mov qword [rbp - 0x50], rcx
xor r15d, r15d
mov dword [rbp - 0x58], 0x200
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp]
call fcn.1400336c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
movdqa xmm1, xmmword [0x143715c80]
movdqu xmmword [rbp - 0x18], xmm1
mov byte [rbp - 0x28], r15b
lea rcx, [rsp + 0x30]
call fcn.140009c10
nop
mov r8, qword [rax]
lea rcx, [rbp - 0x70]
call fcn.1400020f0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140002430
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140002e40
cmp qword [rax + 0x18], 7
jbe 0x140003786
mov rax, qword [rax]
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x1400037ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cc9
call fcn.1400106d0
movdqa xmm0, xmmword [0x143715c70]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r15w
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x14000383a
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003835
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ccf
call fcn.1400106d0
movdqa xmm0, xmmword [0x143715c80]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140003893
mov rdx, qword [rbp - 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003882
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cd5
call fcn.1400106d0
mov qword [rbp - 0x70], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140003904
mov rdx, qword [rsp + 0x38]
call fcn.14000ad70
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
sub rcx, r8
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, r8
cmp rdx, 0x1000
jb 0x1400038fc
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cdb
mov rcx, r8
call fcn.1400106d0
mov r8, rbx
lea rcx, [rsp + 0x30]
call fcn.1400020f0
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140002430
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140002e40
cmp qword [rax + 0x18], 7
jbe 0x140003937
mov rax, qword [rax]
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x14000399f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000399a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ce1
call fcn.1400106d0
movdqa xmm0, xmmword [0x143715c70]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r15w
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x1400039f0
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400039eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ce7
call fcn.1400106d0
movdqa xmm0, xmmword [0x143715c80]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140003a3f
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ced
call fcn.1400106d0
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
test ebx, ebx
je 0x140003ad7
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], r15
xor r8d, r8d
lea rdx, [0x1400402ad]
mov rcx, r14
call fcn.14000a460
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140003aae
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003aa9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cc3
call fcn.1400106d0
mov rax, r14
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.1400106b0
mov rbx, qword [rsp + 0x550]
add rsp, 0x510
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ebx, dword [rbp - 0x58]
shr rbx, 1
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
cmp rbx, 7
ja 0x140003b16
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], 7
add rbx, rbx
mov r8, rbx
lea rdx, [rbp]
lea rcx, [rbp - 0x48]
call fcn.140033020
mov word [rbp + rbx - 0x48], r15w
jmp 0x140003b91
mov rsi, rbx
or rsi, 7
mov eax, 0xa
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi*2 + 2]
cmp rcx, 0x1000
jb 0x140003b66
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003cf3
mov rcx, rax
call fcn.1400106d8
test rax, rax
je 0x140003cbd
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140003b6e
call fcn.1400106d8
mov rdi, rax
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp]
mov rcx, rdi
call fcn.140033020
mov word [rbx + rdi], r15w
lea rcx, [rbp - 0x48]
mov r8, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
cmova rcx, r8
mov rax, qword [rbp - 0x38]
lea rdi, [rcx + rax*2]
lea rbx, [rbp - 0x48]
cmova rbx, r8
cmp rbx, rdi
je 0x140003c13
nop word [rax + rax]
movzx r9d, byte [rbx]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
cmp rcx, rdx
jae 0x140003bf1
lea rax, [rcx + 1]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x28]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x28]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140003c02
xor r8d, r8d
mov edx, 1
lea rcx, [rbp - 0x28]
call fcn.14000ae00
add rbx, 2
cmp rbx, rdi
jne 0x140003bc0
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x48]
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [r14 + 0x10], xmm1
movdqa xmm0, xmmword [0x143715c80]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
cmp rdx, 7
jbe 0x140003c6c
lea rdx, [rdx*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x140003c64
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cbd
mov rcx, r8
call fcn.1400106d0
movdqa xmm0, xmmword [0x143715c70]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r15w
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140003aae
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003aa9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cc3
jmp 0x140003aa9
call fcn.14001a900
nop
call fcn.14001a900
nop
call fcn.14001a900
nop
call fcn.14001a900
nop
call fcn.14001a900
nop
call fcn.14001a900
nop
call fcn.14001a900
nop
call fcn.14001a900
nop
call fcn.14001a900
int3
call fcn.1400011e0
int3