Function at 0x140036ce0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov r15, r8
mov r12, rdx
mov r13, rcx
xor esi, esi
mov dword [rbp + 0xe8], esi
lea rdx, [rbp - 0x60]
call fcn.140030400
nop
mov rax, qword [rbp - 0x60]
cmp dword [rax - 0x10], esi
jne 0x140036d81
lea rdx, [rax - 0x18]
mov eax, dword [rdx + 0x10]
lea r14d, [rsi - 1]
cmp eax, 0x7ffffc17
je 0x140036d63
mov eax, dword [rdx + 0x10]
cmp eax, r14d
je 0x140036d59
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140036d63
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400379e8
mov eax, dword [rdx + 0x10]
jmp 0x1400379cd
call fcn.140002000
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x30]
mov qword [rbp - 0x80], rax
call fcn.140002000
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x30]
mov qword [rbp - 0x78], rax
mov rbx, qword [r12]
lea rdi, [0x1400ca480]
cmp rbx, rdi
je 0x140036e5a
call fcn.140002000
mov rcx, rax
mov r8, rdi
mov rdx, rbx
call fcn.140001f10
test eax, eax
je 0x140036e5a
mov rbx, qword [r12]
lea rdi, [0x1400ca680]
cmp rbx, rdi
je 0x140036e3e
call fcn.140002000
mov rcx, rax
mov r8, rdi
mov rdx, rbx
call fcn.140001f10
test eax, eax
je 0x140036e3e
mov rbx, qword [r12]
lea rdi, [0x1400ca468]
cmp rbx, rdi
je 0x140036e22
call fcn.140002000
mov rcx, rax
mov r8, rdi
mov rdx, rbx
call fcn.140001f10
test eax, eax
jne 0x140036e80
xor r9d, r9d
lea rdx, [0x1400ca6b8]
lea rcx, [rbp - 0x80]
call fcn.140014540
lea rdx, [0x1400ca6c8]
jmp 0x140036e74
xor r9d, r9d
lea rdx, [0x1400ca698]
lea rcx, [rbp - 0x80]
call fcn.140014540
lea rdx, [0x1400ca6a8]
jmp 0x140036e74
xor r9d, r9d
lea rdx, [0x1400cfbe0]
lea rcx, [rbp - 0x80]
call fcn.140014540
lea rdx, [0x1400ca668]
xor r9d, r9d
lea rcx, [rbp - 0x78]
call fcn.140014540
mov rax, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x80]
cmp dword [rcx - 0x10], 0
je 0x140037923
cmp dword [rax - 0x10], 0
je 0x140037923
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x60], esi
lea r8, [0x1400ca6e0]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 8]
call fcn.140017010
mov qword [rbp - 0x20], rsi
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x140036f1d
mov ebx, esi
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140036f10
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], esi
mov rdx, qword [rbp - 8]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
mov r14d, 0xffffffff
cmp eax, 0x7ffffc17
je 0x140036f54
mov eax, dword [rdx + 0x10]
cmp eax, r14d
je 0x140036f4a
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140036f54
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
test ebx, ebx
jne 0x14003782b
call fcn.140002000
mov r10, qword [rax]
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], bl
mov byte [rsp + 0x20], bl
mov r9d, r14d
mov r8d, r14d
lea rdx, [0x1400c5494]
mov rcx, rax
call qword [r10 + 0x28]
mov rbx, rax
mov qword [rsp + 0x78], rax
mov dword [rbp + 0xe8], 1
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14003715c
mov dword [rsp + 0x6c], 1
mov dword [rsp + 0x68], esi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x6c]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003715c
mov ecx, dword [rsp + 0x6c]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x1400370cb
cmp ecx, 4
jne 0x14003715c
mov dword [rsp + 0x50], esi
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400370ae
mov dword [rbp - 0x48], 4
mov dword [rbp - 0x70], 0xffffffff
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14003703d
mov dword [rsp + 0x50], esi
jmp 0x1400370ae
mov eax, dword [rbp - 0x70]
cmp eax, 4
je 0x1400370ae
mov dword [rsp + 0x50], esi
cmp eax, 1
jne 0x1400370ae
lea r9, [0x1400c5494]
xor r8d, r8d
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x58]
call fcn.140029c70
nop
mov rax, qword [rbp - 0x18]
cmp dword [rax - 0x10], 0
jle 0x140037081
mov rcx, rax
call fcn.140017960
mov dword [rsp + 0x50], eax
mov rax, qword [rbp - 0x18]
lea rdx, [rax - 0x18]
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400370ae
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400370a4
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400370ae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
movsxd rdx, dword [rsp + 0x50]
mov r9d, 0xa
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.140013580
jmp 0x140037157
mov edi, dword [rsp + 0x68]
inc rdi
shr rdi, 1
lea edx, [rdi + 1]
mov r9b, 1
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.140010590
mov rbx, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x6c]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rcx, edi
mov word [rbx + rcx*2], si
mov rax, qword [rsp + 0x78]
test rax, rax
jne 0x140037124
mov edx, esi
jmp 0x140037144
mov rdx, rax
nop word [rax + rax]
movzx ecx, word [rdx]
add rdx, 2
test cx, cx
jne 0x140037130
sub rdx, rax
sar rdx, 1
dec edx
mov dword [rax - 0x10], edx
mov ecx, dword [rax - 8]
cmp ecx, 0xffffffff
jne 0x140037157
mov ecx, 1
xchg dword [rax - 8], ecx
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rbp - 0x60]
cmp dword [rbx - 0x10], 0
jle 0x14003719f
mov rcx, qword [0x1400fac38]
test rcx, rcx
je 0x14003719f
mov rax, qword [rcx]
mov dl, 1
call qword [rax + 0x28]
test rax, rax
je 0x14003719f
mov r10, qword [rax]
mov r9d, 3
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call qword [r10 + 0xc0]
mov esi, eax
cmp eax, 0xffffffff
jne 0x1400371a2
mov esi, r14d
shr esi, 0x1f
xor sil, 1
test r15, r15
je 0x1400377fc
call fcn.140002000
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x30]
mov r15, rax
mov qword [rbp - 0x50], rax
mov rax, qword [rbp + 0xe0]
cmp byte [rax], 0
je 0x14003750c
test sil, sil
jne 0x140037256
lea rdx, [r13 + 8]
lea r8, [0x1400ca708]
lea rcx, [rbp]
call fcn.140017010
mov rdi, qword [rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140037252
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140037248
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140037252
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdi, qword [rbp - 0x60]
call fcn.140002000
mov r10, qword [rax]
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov r9d, r14d
mov r8d, r14d
lea rdx, [0x1400c551c]
mov rcx, rax
call qword [r10 + 0x28]
mov rbx, rax
mov qword [rbp + 0x10], rax
xor eax, eax
mov dword [rbp - 0x30], eax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x80], xmm0
mov dword [rbp - 0x30], eax
movaps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x70], xmm1
mov dword [rbp - 0x30], eax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x60], xmm0
mov dword [rbp + 0x30], 3
lea rax, [rbp - 0x78]
mov qword [rbp + 0x38], rax
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x30], xmm0
call fcn.140002000
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x30]
mov qword [rbp - 0x58], rax
mov dword [rbp + 0xe8], 3
mov r15d, dword [rbx - 0x10]
add r15d, dword [rdi - 0x10]
mov r9b, 1
xor r8d, r8d
mov edx, r15d
lea rcx, [rbp - 0x58]
call fcn.140010590
mov rsi, rax
movsxd r8, dword [rbx - 0x10]
add r8, r8
mov rdx, rbx
mov rcx, rax
call fcn.14008ff40
movsxd r8, dword [rdi - 0x10]
add r8, r8
movsxd rcx, dword [rbx - 0x10]
lea rcx, [rsi + rcx*2]
mov rdx, rdi
call fcn.14008ff40
mov rax, qword [rbp - 0x58]
cmp r15d, 0xffffffff
jne 0x140037357
test rax, rax
jne 0x14003733e
xor edx, edx
jmp 0x140037363
mov rdx, rax
movzx ecx, word [rdx]
add rdx, 2
test cx, cx
jne 0x140037341
sub rdx, rax
sar rdx, 1
dec edx
jmp 0x140037363
movsxd rcx, r15d
xor edx, edx
mov word [rax + rcx*2], dx
mov edx, r15d
mov dword [rax - 0x10], edx
mov ecx, dword [rax - 8]
cmp ecx, 0xffffffff
jne 0x140037376
mov ecx, 1
xchg dword [rax - 8], ecx
lea r8, [0x1400ca728]
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 8]
call fcn.140017010
nop
mov rbx, qword [rax]
lea rax, [rbp - 0x30]
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x60]
mov qword [rbp + 0x48], rax
lea rax, [rbp + 0x70]
mov qword [rbp + 0x50], rax
lea rax, [rbp + 0x80]
mov qword [rbp + 0x58], rax
call fcn.140002000
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x30]
mov qword [rbp - 0x40], rax
lea r9, [rbp - 0x40]
mov r8d, 4
lea rdx, [rbp + 0x40]
mov rcx, rbx
call fcn.140044c50
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x50]
call fcn.1400103b0
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140037418
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x14003740e
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140037418
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140037449
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x14003743f
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140037449
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
and dword [rbp + 0xe8], 0xfffffffd
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140037481
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140037477
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140037481
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x10]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400374b2
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400374a8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400374b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
call fcn.140002000
mov r10, qword [rax]
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov r9d, r14d
mov r8d, r14d
lea rdx, [0x1400ca738]
mov rcx, rax
call qword [r10 + 0x28]
mov rbx, rax
mov qword [rbp + 0x18], rax
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x50]
call fcn.140010890
nop
lea rdx, [rbx - 0x18]
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140037792
mov eax, dword [rdx + 0x10]
jmp 0x140037776
lea rdx, [r13 + 8]
lea r8, [0x1400ca708]
lea rcx, [rbp + 0x20]
call fcn.140017010
nop
mov rsi, qword [rax]
call fcn.140002000
mov r10, qword [rax]
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov r9d, r14d
mov r8d, r14d
mov rdx, r15
mov rcx, rax
call qword [r10 + 0x28]
mov qword [rbp - 0x68], rax
mov dword [rbp + 0xe8], 5
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140037719
mov dword [rsp + 0x74], 1
xor r15d, r15d
mov dword [rsp + 0x70], r15d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x74]
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140037719
mov ecx, dword [rsp + 0x74]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x140037695
cmp ecx, 4
jne 0x140037719
mov dword [rsp + 0x54], r15d
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140037679
mov dword [rbp - 0x44], 4
mov dword [rbp - 0x6c], 0xffffffff
lea rax, [rbp - 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x6c]
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140037607
mov dword [rsp + 0x54], r15d
jmp 0x140037679
mov eax, dword [rbp - 0x6c]
cmp eax, 4
je 0x140037679
mov dword [rsp + 0x54], r15d
cmp eax, 1
jne 0x140037679
lea r9, [0x1400c5494]
mov r8, rsi
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140029c70
nop
mov rax, qword [rbp - 0x10]
cmp dword [rax - 0x10], 0
jle 0x14003764c
mov rcx, rax
call fcn.140017960
mov dword [rsp + 0x54], eax
mov rax, qword [rbp - 0x10]
lea rdx, [rax - 0x18]
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140037679
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x14003766f
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140037679
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
movsxd rdx, dword [rsp + 0x54]
mov r9d, 0xa
xor r8d, r8d
lea rcx, [rbp - 0x68]
call fcn.140013580
jmp 0x140037719
mov edi, dword [rsp + 0x70]
inc rdi
shr rdi, 1
lea edx, [rdi + 1]
mov r9b, 1
xor r8d, r8d
lea rcx, [rbp - 0x68]
call fcn.140010590
mov rbx, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x74]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rcx, edi
mov word [rbx + rcx*2], r15w
mov rax, qword [rbp - 0x68]
test rax, rax
jne 0x1400376ef
mov edx, r15d
jmp 0x140037706
mov rdx, rax
movzx ecx, word [rdx]
add rdx, 2
test cx, cx
jne 0x1400376f2
sub rdx, rax
sar rdx, 1
dec edx
mov dword [rax - 0x10], edx
mov ecx, dword [rax - 8]
cmp ecx, 0xffffffff
jne 0x140037719
mov ecx, 1
xchg dword [rax - 8], ecx
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x50]
call fcn.1400103b0
mov dword [rbp + 0xe8], 1
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140037761
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140037757
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140037761
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140037792
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140037788
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140037792
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rbx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rdx, [rbx - 0x18]
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400377f0
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400377e6
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400377f0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rbx, qword [rsp + 0x78]
mov r15, qword [rbp + 0xe0]
lea rdx, [rbx - 0x18]
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140037829
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x14003781f
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140037829
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
xor esi, esi
test r15, r15
je 0x140037840
cmp byte [r15], 0
je 0x14003783b
mov byte [r13], 1
mov byte [r13 + 1], 1
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140037855
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x60], esi
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x14003788a
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140037880
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003788a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400378bb
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400378b1
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400378bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400378ec
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400378e2
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400378ec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x14003791c
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140037912
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14003791c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov al, 1
jmp 0x1400379ea
lea rdx, [rax - 0x18]
mov eax, dword [rdx + 0x10]
mov r14d, 0xffffffff
cmp eax, 0x7ffffc17
je 0x140037956
mov eax, dword [rdx + 0x10]
cmp eax, r14d
je 0x14003794c
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140037956
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140037987
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x14003797d
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140037987
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400379b8
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400379ae
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400379b8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400379e8
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400379de
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x1400379e8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
xor al, al
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret