Function at 0x1401ddda0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rsi, r9
mov r14, r8
mov rax, rdx
mov rbx, rcx
mov qword [rbp - 0x49], rcx
mov qword [rbp - 0x31], r8
mov qword [rbp - 0x29], r9
mov rdx, r8
cmp qword [r8 + 0x18], 8
jb 0x1401ddde6
mov rdx, qword [r8]
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1401dde45
xor edi, edi
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov r8d, 0xd
lea rdx, str.ERROR_READREG
mov rcx, rbx
call fcn.1400f8950
nop
mov rcx, r14
call fcn.1400ebe10
nop
mov rcx, rsi
call fcn.1400ebe10
jmp 0x1401ddfdd
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1401dde52
mov rdx, qword [rsi]
lea rax, [rbp - 0x3d]
mov qword [rsp + 0x28], rax
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x41]
xor r8d, r8d
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1401dde83
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401dde07
cmp dword [rbp - 0x41], 4
jne 0x1401dde77
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1401dde96
mov rdx, qword [rsi]
lea rax, [rbp - 0x3d]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x41]
xor r8d, r8d
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401dde77
lea r9, [rbp + 0x29]
mov r8d, dword [rbp - 0x39]
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x1401dded0
mov qword [rbp - 0x21], rdi
mov qword [rbp - 0x11], rdi
mov qword [rbp - 9], 7
lea rax, [rbp + 0x29]
cmp r9, rax
je 0x1401ddf2f
lea r8, [rbp + 0x29]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp - 0x21]
call fcn.1400f8950
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [rbp - 0x21]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x11]
movups xmmword [rbx + 0x10], xmm1
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x1401ddf83
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1401ddf7e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401ddffa
mov rcx, r8
call fcn.14020be84
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], 7
mov word [r14], di
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x1401ddfce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x1401ddfc9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401de000
mov rcx, r8
call fcn.14020be84
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 7
mov word [rsi], di
mov rax, rbx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14020c3e0
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3