Function at 0x1400460d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x98
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov rsi, rcx
test rcx, rcx
jne 0x140046100
xor eax, eax
jmp 0x140046356
xor r14d, r14d
mov qword [rbp + 0x7f], r14
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
lea r9, [0x14028b3a8]
xor edx, edx
lea r8d, [r14 + 0x17]
lea rcx, [0x14028b3b8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140046344
lea r12d, [r14 + 1]
mov rdi, qword [rbp + 0x7f]
mov rcx, qword [rsi]
sub rcx, 0x18
test dword [rsi + 0x180], 0x800000
je 0x140046195
call fcn.140004c20
lea rbx, [rax + 0x18]
mov qword [rbp - 0x11], rbx
mov rax, qword [rdi]
mov r8d, r12d
mov rdx, rbx
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov edi, eax
lea rdx, [rbx - 0x18]
mov r15d, 0xffffffff
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
sub ecx, r12d
jg 0x14004618c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
test edi, edi
jns 0x1400461dc
jmp 0x140046344
call fcn.140004c20
lea rbx, [rax + 0x18]
mov qword [rbp - 9], rbx
mov rax, qword [rdi]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov edi, eax
lea rdx, [rbx - 0x18]
mov r15d, 0xffffffff
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400461d4
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
test edi, edi
js 0x140046344
mov dword [rbp + 0x67], r12d
mov rcx, qword [rsi]
sub rcx, 0x18
call fcn.140004c20
mov r13, rax
lea rcx, [rax + 0x18]
mov qword [rbp - 1], rcx
mov rcx, rax
call fcn.140004c20
add rax, 0x18
mov qword [rbp - 0x49], rax
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x39]
call fcn.140046760
nop
mov qword [rbp - 0x31], r14
mov dword [rbp - 0x29], r14d
mov qword [rbp - 0x21], r14
mov r9d, 0x20019
mov r8, qword [rbp - 0x39]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x31]
call fcn.14000ddf0
mov rdi, qword [rbp - 0x31]
test eax, eax
jne 0x1400462a7
mov qword [rbp - 0x41], r14
test rdi, rdi
je 0x1400462a7
lea rdx, [rbp - 0x41]
lea rcx, [0x140281930]
call fcn.140011a50
test eax, eax
js 0x140046297
mov dword [rbp + 0x6f], 4
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x77]
xor r8d, r8d
mov rdx, qword [rbp - 0x41]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r14
mov qword [rbp - 0x31], r14
mov ebx, dword [rbp + 0x67]
test rdi, rdi
je 0x1400462b9
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400462d8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lock xadd dword [r13 + 0x10], r15d
sub r15d, 1
jg 0x1400462f1
mov rcx, qword [r13]
mov rax, qword [rcx]
mov rdx, r13
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rsi
call fcn.14000b7c0
test eax, eax
jne 0x140046328
cmp dword [rsi + 0x15c], 3
je 0x140046328
mov rcx, rsi
call fcn.14000b8a0
test eax, eax
jne 0x14004632e
mov eax, dword [rsi + 0x180]
and eax, 0xe00000
neg eax
sbb r12d, r12d
add r12d, 3
jmp 0x14004632e
mov r12d, 2
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
mov r8d, ebx
mov edx, r12d
call qword [rax + 0x20]
test eax, eax
setns r14b
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140046353
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, r14d
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret