Function at 0x140001ce0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x10758]
mov eax, 0x10858
call fcn.14003f630
sub rsp, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0x3ff
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r15d, r15d
lea rdi, [r15 - 1]
test eax, eax
je 0x140001d5f
lea rcx, [rsp + 0x40]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140001d30
dec eax
movsxd rcx, eax
test eax, eax
jle 0x140001d5f
cmp word [rsp + rcx*2 + 0x40], 0x5c
je 0x140001d57
dec eax
dec rcx
test rcx, rcx
jg 0x140001d43
jmp 0x140001d5f
cdqe
mov word [rsp + rax*2 + 0x40], r15w
call fcn.1400020a0
xor edx, edx
mov r8d, 0x10000
lea rcx, [rbp + 0x742]
call fcn.14005fd20
mov word [rbp + 0x740], r15w
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r14d, 1
mov r9d, r14d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001e01
mov dword [rbp + 0x10790], 0x10002
mov dword [rbp + 0x10798], 2
lea rax, [rbp + 0x10790]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x740]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x10798]
xor r8d, r8d
lea rdx, str.Path
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [rbp + 0x740], r15w
je 0x140002056
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14000207e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x107a8], rax
lea rax, [rbp + 0x740]
cmp rax, 0x10000
lea rax, [rbp + 0x740]
jae 0x140001e58
movzx edx, ax
lea rcx, [rbp + 0x107a8]
call fcn.140002950
jmp 0x140001e7f
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140001e60
lea rdx, [rbp + 0x740]
lea rcx, [rbp + 0x107a8]
call fcn.140002da0
nop
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140002089
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x107a0], rax
lea rax, [rsp + 0x40]
cmp rax, 0x10000
lea rax, [rsp + 0x40]
jae 0x140001ec4
movzx edx, ax
lea rcx, [rbp + 0x107a0]
call fcn.140002950
jmp 0x140001eed
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140001ed0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x107a0]
call fcn.140002da0
nop
mov rbx, qword [rbp + 0x107a8]
movsxd rsi, dword [rbx - 0x10]
test esi, esi
js 0x140002073
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x140001f24
mov edx, esi
lea rcx, [rbp + 0x107a8]
call fcn.140002b00
mov rbx, qword [rbp + 0x107a8]
lea eax, [rsi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.14004b7b4
cmp esi, dword [rbx - 0xc]
jg 0x140002073
mov dword [rbx - 0x10], esi
mov word [rbx + rsi*2], r15w
mov rbx, qword [rbp + 0x107a0]
movsxd rsi, dword [rbx - 0x10]
test esi, esi
js 0x140002073
sub r14d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, r14d
jge 0x140001f79
mov edx, esi
lea rcx, [rbp + 0x107a0]
call fcn.140002b00
mov rbx, qword [rbp + 0x107a0]
lea eax, [rsi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.14004b7b4
cmp esi, dword [rbx - 0xc]
jg 0x140002073
mov dword [rbx - 0x10], esi
mov word [rbx + rsi*2], r15w
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140002068
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x740]
lea rdx, str._s__s_
lea rcx, [rsp + 0x38]
call fcn.140002f70
lea r8, [0x14006cd90]
lea rdx, [0x14006cd94]
lea rcx, [rsp + 0x38]
call fcn.1400024d0
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rbx
call fcn.1400125a0
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140002017
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x107a0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140002038
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x107a8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140002056
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
add rsp, 0x10858
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80070057
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
int3