Function at 0x14000489c
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r12, rcx
xor r10d, r10d
test r8d, r8d
je 0x1400048c7
mov word [rdx], r10w
mov r8d, r8d
add r8, r8
mov eax, r9d
cmp rax, r8
jae 0x1400048e7
mov ecx, 0x48d3d3
call fcn.140009b98
or eax, 0xffffffff
jmp 0x140004b8d
lea r14, [0x140022c84]
lea r9, [0x14002c2c0]
or edi, 0xffffffff
mov rdx, r12
mov cl, byte [r14]
call fcn.140004560
mov esi, eax
mov dword [rbp - 0x2c], eax
cmp eax, 0xffffffff
je 0x140004b78
mov qword [rbp - 0x20], r9
and qword [rbp - 0x18], 0
mov rcx, r9
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
xor r10d, r10d
test eax, eax
jne 0x140004bb2
lea eax, [rdi + 2]
lock xadd dword [rbp - 0x18], eax
inc eax
cmp eax, 1
jne 0x140004953
cmp dword [rbp - 0x14], r10d
jne 0x140004bc8
call qword [sym.imp.MSVCP140.dll__Thrd_id]
mov dword [rbp - 0x14], eax
xor r10d, r10d
mov r15d, r10d
cmp r15d, 4
jge 0x140004b56
mov r13b, r10b
mov qword [rsp + 0x28], r10
mov al, byte [r12 + 0x18]
mov byte [rsp + 0x20], al
mov r9d, esi
xor r8d, r8d
mov rdx, qword [r12 + 0x10]
lea rcx, [rbp - 0x10]
call fcn.140003818
mov edi, dword [rax]
mov rsi, qword [rax + 8]
xor r10d, r10d
mov qword [rax + 8], r10
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400049af
mov qword [rbp - 8], r10
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400206a8]
xor r10d, r10d
test edi, edi
jne 0x140004b00
mov dil, byte [r12 + 0x1c]
and dil, 0xf
mov eax, dword [rbp + 0x58]
mov dword [rbp + 0x50], eax
mov dword [rbp - 0x30], r10d
lea rax, [rbp + 0x50]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xffff
mov r8, qword [r12]
xor edx, edx
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edx, eax
mov r8d, dword [rbp - 0x30]
mov r9d, 2
cmp dword [rbp + 0x50], r9d
jae 0x140004a18
lea ecx, [r8 - 1]
cmp ecx, 1
cmovbe edx, r9d
xor r10d, r10d
test edx, edx
jne 0x140004a61
lea eax, [r8 - 1]
cmp eax, 1
ja 0x140004a3c
mov eax, dword [rbp + 0x50]
shr rax, 1
mov rcx, qword [rbp + 0x48]
mov word [rcx + rax*2 - 2], r10w
mov r8d, dword [rbp - 0x30]
movzx eax, dil
cmp r8d, eax
jne 0x140004a49
mov edi, edx
jmp 0x140004a78
sub r8d, 1
je 0x140004ad5
cmp r8d, 1
jne 0x140004a5e
cmp eax, r8d
je 0x140004a45
mov edx, r9d
mov edi, edx
cmp edx, 0x3f2
je 0x140004ada
cmp edx, 0x3fa
je 0x140004ada
cmp edx, 6
je 0x140004ada
test edx, edx
jne 0x140004b00
test rsi, rsi
je 0x140004a98
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 8]
call qword [0x1400206a8]
xor r10d, r10d
mov eax, dword [rbp - 0x18]
test eax, eax
je 0x140004b9d
or eax, 0xffffffff
lock xadd dword [rbp - 0x18], eax
cmp eax, 1
jne 0x140004ac3
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x14], eax
jne 0x140004bd5
and dword [rbp - 0x14], 0
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, dword [rbp - 0x18]
xor r10d, r10d
jmp 0x140004a9b
cmp eax, r9d
jmp 0x140004a5c
mov rcx, qword [r12 + 0x10]
movzx eax, word [rcx + 0xa]
and eax, 0x1f
shl rax, 5
lea rdx, [0x14002b090]
mov qword [rax + rdx], r10
call fcn.140001eec
mov r13b, 1
xor r10d, r10d
test rsi, rsi
je 0x140004b18
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 8]
call qword [0x1400206a8]
xor r10d, r10d
inc r15d
test r13b, r13b
mov esi, dword [rbp - 0x2c]
jne 0x140004956
jmp 0x140004b56
or eax, 0xffffffff
lock xadd dword [rbp - 0x18], eax
cmp eax, 1
jne 0x140004b49
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x14], eax
jne 0x140004bef
and dword [rbp - 0x14], 0
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
xor r10d, r10d
mov eax, dword [rbp - 0x18]
test eax, eax
jne 0x140004b29
cmp dword [rbp - 0x14], r10d
je 0x140004b71
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x14], eax
jne 0x140004bbb
xor r10d, r10d
lea r9, [0x14002c2c0]
inc r14
lea rax, [0x140022c87]
cmp r14, rax
jne 0x1400048f5
mov eax, edi
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp dword [rbp - 0x14], r10d
je 0x140004bae
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x14], eax
jne 0x140004be2
xor eax, eax
jmp 0x140004b8d
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
xor edx, edx
mov ecx, 0x131f4c3
call fcn.140001d78
int3
xor edx, edx
mov ecx, 0x131f4c4
call fcn.140001d78
int3
xor edx, edx
mov ecx, 0x131f4c5
call fcn.140001d78
int3
xor edx, edx
mov ecx, 0x131f4c3
call fcn.140001d78
int3
xor edx, edx
mov ecx, 0x131f4c5
call fcn.140001d78
int3