Function at 0x140198810
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov rbx, rdx
mov rsi, rcx
mov rdi, qword [rbp + 0xc0]
add r9, r8
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov word [rbp + 0x30], 0
mov dword [rbp + 0x38], 1
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x20]
call fcn.140183850
mov rax, qword [rbp + 0xc8]
add rax, rdi
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], rax
mov word [rbp + 0x30], 0
mov dword [rbp + 0x38], 1
lea rcx, [rbp - 0x18]
lea r14, [rbp + 0x20]
mov rdx, r14
call fcn.140183850
mov rdi, qword [rbp - 0x28]
mov qword [rbp + 0x20], 0
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x20019
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x1401988dc
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp - 0x18]
test rdx, rdx
jne 0x140198a6e
jmp 0x140198a80
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x40], rax
mov dword [rbp + 0x4c], 0x800
movzx eax, byte [0x1402e8381]
mov ecx, 0x800
mov edx, 1
call fcn.140016e50
test rax, rax
je 0x140198ab1
mov r14, rax
mov qword [rbp], rdi
mov qword [rbp + 8], 0x800
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 0
mov rbx, qword [rbp - 0x10]
lea r12, [rbp + 0x4c]
lea r15, [rbp + 0x20]
mov rdi, qword [rbp + 8]
mov r13, qword [rbp + 0x18]
sub rdi, r13
nop dword [rax]
mov dword [rbp + 0x20], 0
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
mov rcx, qword [rbp + 0x40]
mov rdx, rbx
xor r8d, r8d
mov r9, r15
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x140198994
mov r8d, dword [rbp + 0x4c]
cmp rdi, r8
jae 0x140198940
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rbp + 8]
mov rdx, r13
call fcn.1401f0c90
mov r14, qword [rbp + 0x10]
jmp 0x140198931
test eax, eax
jne 0x140198a34
mov eax, dword [rbp + 0x4c]
mov qword [rbp + 0x18], rax
and eax, 0xfffffffe
add rax, r14
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], rax
mov word [rbp + 0x30], 0
lea rcx, [rbp - 0x48]
lea rdx, [rbp + 0x20]
call fcn.140043380
mov rdi, qword [rbp]
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x1401989ec
mov rcx, qword [rbp - 0x40]
nop word cs:[rax + rax]
cmp byte [rcx + rax - 1], 0
jne 0x1401989ee
dec rax
jne 0x1401989e0
xor eax, eax
mov qword [rbp - 0x38], rax
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 8]
test rdx, rdx
je 0x140198a14
mov r8d, 1
mov rcx, r14
call fcn.140016e60
mov rcx, qword [rbp + 0x40]
call fcn.1401ef982
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x140198a80
add rdx, rdx
mov r8d, 2
mov rcx, rbx
jmp 0x140198a7b
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 8]
test rdx, rdx
mov rdi, qword [rbp]
je 0x140198a5c
mov r8d, 1
mov rcx, r14
call fcn.140016e60
mov rcx, qword [rbp + 0x40]
call fcn.1401ef982
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x140198a80
mov rcx, qword [rbp - 0x10]
add rdx, rdx
mov r8d, 2
call fcn.140016e60
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x140198a9a
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140016e60
mov rax, rsi
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 1
mov edx, 0x800
call fcn.1401fd4e0
ud2