Function at 0x1400432a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rsp + 0xf8], rbx
mov rax, qword [0x140124190]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x19], rcx
mov rcx, rdx
call fcn.140042da0
mov r15, rax
test rax, rax
jne 0x140043301
xor esi, esi
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
jmp 0x1400435f9
mov r9, rbx
mov r10, qword [rbx + 0x18]
cmp r10, 8
jb 0x140043311
mov r9, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rdx, 0xffffffffffffffff
test r8, r8
je 0x140043337
mov rcx, r8
mov rax, r9
cmp word [rax], 0x5c
je 0x140043394
add rax, 2
sub rcx, 1
jne 0x140043327
mov rax, rdx
inc rax
movdqa xmm0, xmmword [0x1401057a0]
movdqu xmmword [rbp - 1], xmm0
xor esi, esi
mov word [rbp - 0x11], si
cmp r8, rax
jb 0x140043637
sub r8, rax
cmp r8, rdx
cmovb rdx, r8
cmp r10, 8
jb 0x14004336c
mov rbx, qword [rbx]
lea r9, [rbx + rax*2]
lea rcx, [rbp - 0x11]
cmp rdx, 7
ja 0x1400433a1
mov qword [rbp - 1], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call fcn.140096e70
mov word [rbp + rbx - 0x11], si
jmp 0x1400433a7
test rax, rax
je 0x140043337
sub rax, r9
sar rax, 1
jmp 0x14004333a
call fcn.14002d400
nop
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x19]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14004343a
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x1400435f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400435f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043625
jmp 0x1400435f4
mov dword [rbp - 0x21], esi
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x14004344a
mov rdx, qword [r14]
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400434c9
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x1400435f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400435f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004362b
jmp 0x1400435f4
xor eax, eax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rax
mov edx, dword [rbp - 0x21]
lea rcx, [rbp + 0xf]
call fcn.140043650
cmp qword [r14 + 0x18], 8
jb 0x1400434ed
mov r14, qword [r14]
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov rbx, qword [rbp + 0xf]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400435aa
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
test rbx, rbx
je 0x140043569
mov rdx, qword [rbp + 0x1f]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x140043560
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004363d
mov rcx, rbx
call fcn.140072f50
nop
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x1400435f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400435f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043631
jmp 0x1400435f4
mov qword [rdi], rbx
mov rax, qword [rbp + 0x17]
mov qword [rdi + 8], rax
mov rax, qword [rbp + 0x1f]
mov qword [rdi + 0x10], rax
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x1400435f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400435f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004361f
call fcn.140072f50
mov rax, rdi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140072ef0
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400a01c4
int3
call fcn.1400a01c4
int3
call fcn.1400a01c4
int3
call fcn.1400a01c4
int3
call fcn.14002cb80
nop
call fcn.1400a01c4
nop
int3