Function at 0x140092510
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1401b3838]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov r15d, r8d
mov r14d, edx
mov rsi, rcx
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x60]
call fcn.140121c70
nop
mov edx, 3
lea r8d, [rdx - 2]
lea rcx, [rbp + 0x60]
call fcn.140017d60
nop
lea rdx, [0x140150fb8]
lea rcx, [rbp + 0x70]
call fcn.140014970
nop
mov rcx, rax
mov edx, r14d
call fcn.14005c4a0
nop
mov rcx, rax
lea rdx, [0x1401574b0]
call fcn.140014970
nop
mov rcx, rax
mov edx, r15d
call fcn.14005c4a0
nop
mov rcx, rax
lea rdx, str.HIPM
call fcn.140014970
nop
xor r12d, r12d
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x54], 4
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r12w
mov rcx, qword [rbp + 0xe8]
test cl, 2
jne 0x14009260f
mov rax, qword [rbp + 0xb8]
mov r8, qword [rax]
test r8, r8
je 0x14009260f
mov rax, qword [rbp + 0x98]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0xe0]
cmovb r8, qword [rbp + 0xe0]
sub r8, rdx
jmp 0x140092640
test cl, 4
jne 0x14009264e
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax]
test rcx, rcx
je 0x14009264e
mov rax, qword [rbp + 0x90]
mov rdx, qword [rax]
mov rax, qword [rbp + 0xc8]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
lea rcx, [rsp + 0x30]
call fcn.140011bc0
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
nop
mov ebx, eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400926c8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400926c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400928a3
call fcn.14012d3b0
nop
cmp ebx, 2
je 0x1400926dd
test ebx, ebx
jne 0x1400926d8
cmp dword [rsp + 0x50], 1
je 0x1400926dd
xor dil, dil
jmp 0x1400926e0
mov dil, 1
xor edx, edx
mov r8d, 0xf8
lea rcx, [rsp + 0x60]
call fcn.140121c70
nop
mov edx, 3
lea r8d, [rdx - 2]
lea rcx, [rsp + 0x60]
call fcn.140017d60
nop
lea rdx, [0x140150fb8]
lea rcx, [rsp + 0x70]
call fcn.140014970
nop
mov rcx, rax
mov edx, r14d
call fcn.14005c4a0
nop
mov rcx, rax
lea rdx, [0x1401574b0]
call fcn.140014970
nop
mov rcx, rax
mov edx, r15d
call fcn.14005c4a0
nop
mov rcx, rax
lea rdx, str.DIPM
call fcn.140014970
nop
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x54], 4
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r12w
mov rcx, qword [rbp - 0x18]
test cl, 2
jne 0x14009279c
mov rax, qword [rbp - 0x48]
mov r8, qword [rax]
test r8, r8
je 0x14009279c
mov rax, qword [rbp - 0x68]
mov rdx, qword [rax]
cmp r8, qword [rbp - 0x20]
cmovb r8, qword [rbp - 0x20]
sub r8, rdx
jmp 0x1400927c4
test cl, 4
jne 0x1400927d2
mov rax, qword [rbp - 0x50]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400927d2
mov rax, qword [rbp - 0x70]
mov rdx, qword [rax]
mov rax, qword [rbp - 0x38]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
lea rcx, [rsp + 0x30]
call fcn.140011bc0
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
nop
mov ebx, eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140092848
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140092842
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009289d
call fcn.14012d3b0
nop
test dil, dil
je 0x140092861
cmp ebx, 2
je 0x14009285d
test ebx, ebx
jne 0x140092861
cmp dword [rsp + 0x50], 1
jne 0x140092861
mov bl, 1
jmp 0x140092863
xor bl, bl
lea rcx, [rsp + 0x60]
call fcn.140017230
nop
lea rcx, [rbp + 0x60]
call fcn.140017230
nop
movzx eax, bl
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14012d380
nop
add rsp, 0x270
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400fd3f0
nop
call fcn.1400fd3f0
nop
int3