Function at 0x14003b2a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov rax, qword [0x1400e0180]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rbp - 0x11], rcx
xor r12d, r12d
mov rcx, rdx
call fcn.14003add0
mov rsi, rax
test rax, rax
jne 0x14003b2f5
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
jmp 0x14003b443
mov r8, rdi
mov r10, qword [rdi + 0x18]
cmp r10, 7
jbe 0x14003b305
mov r8, qword [rdi]
mov rdx, qword [rdi + 0x10]
mov r9, 0xffffffffffffffff
test rdx, rdx
je 0x14003b334
mov rcx, rdx
mov rax, r8
nop dword [rax + rax]
cmp word [rax], 0x5c
je 0x14003b464
add rax, 2
sub rcx, 1
jne 0x14003b320
mov rax, r9
inc rax
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 7], xmm1
cmp rdx, rax
jb 0x14003b5b1
sub rdx, rax
cmp rdx, r9
cmovb r9, rdx
cmp r10, 7
jbe 0x14003b365
mov rdi, qword [rdi]
lea rdx, [rdi + rax*2]
mov r8, r9
lea rcx, [rbp - 9]
call fcn.1400276c0
nop
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 7
cmova rdx, qword [rbp - 9]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x11]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14003b3f8
mov dword [rbp - 0x15], r12d
mov rdx, r15
cmp qword [r15 + 0x18], 7
jbe 0x14003b3c8
mov rdx, qword [r15]
lea rax, [rbp - 0x15]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14003b478
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
mov rdx, qword [rbp + 0xf]
cmp rdx, 7
jbe 0x14003b443
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b43e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b5ab
call fcn.14005ff0c
mov rax, rbx
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14005feb0
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
test rax, rax
je 0x14003b334
sub rax, r8
sar rax, 1
jmp 0x14003b337
mov r14d, dword [rbp - 0x15]
mov rdi, r12
mov rsi, r12
test r14, r14
je 0x14003b4d5
cmp r14, 0x1000
jb 0x14003b4b9
lea rcx, [r14 + 0x27]
cmp rcx, r14
jbe 0x14003b5b7
call fcn.14005fed0
test rax, rax
je 0x14003b5a5
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14003b4c4
mov rcx, r14
call fcn.14005fed0
mov rdi, rax
lea rsi, [rdi + r14]
mov r8, r14
xor edx, edx
mov rcx, rdi
call fcn.1400b4390
cmp qword [r15 + 0x18], 7
jbe 0x14003b4df
mov r15, qword [r15]
lea rax, [rbp - 0x15]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14003b556
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
test rdi, rdi
je 0x14003b403
sub rsi, rdi
cmp rsi, 0x1000
jb 0x14003b546
add rsi, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x14003b5a5
mov rdi, rcx
mov rdx, rsi
mov rcx, rdi
call fcn.14005ff0c
jmp 0x14003b403
mov qword [rbx], rdi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov rdx, qword [rbp + 0xf]
cmp rdx, 7
jbe 0x14003b443
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b43e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b5ab
jmp 0x14003b43e
call fcn.140091ac4
nop
call fcn.140091ac4
int3
call fcn.1400273d0
nop
call fcn.140020a90
int3