Function at 0x1400083a8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0x98
xor r14d, r14d
mov rsi, r8
mov dword [rbp - 0x19], r14d
mov rax, rcx
mov dword [rbp - 0x29], r14d
mov dword [rbp - 0x25], r14d
mov dword [rbp - 0x21], r14d
mov dword [rbp - 0x1d], r14d
test rcx, rcx
je 0x1400087d5
test rdx, rdx
je 0x1400087d5
test r8, r8
je 0x1400087d5
test r9, r9
je 0x1400087d5
mov r15, qword [rbp + 0x7f]
test r15, r15
je 0x1400087d5
mov ebx, dword [rbp + 0x77]
lea r12d, [r14 + 1]
cmp ebx, r12d
ja 0x140008438
cmp dword [r15], r12d
jne 0x140008438
xor eax, eax
jmp 0x1400087e3
mov qword [rsp + 0x58], r14
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x50], r14
xor r9d, r9d
mov qword [rsp + 0x48], r14
xor r8d, r8d
mov qword [rsp + 0x40], rcx
xor edx, edx
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x38], rcx
mov rcx, rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x1400087da
mov qword [rsp + 0x58], r14
lea rax, [rbp - 0x1d]
mov qword [rsp + 0x50], r14
xor r9d, r9d
mov qword [rsp + 0x48], r14
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
lea rax, [rbp - 0x25]
mov rcx, rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x1400087da
mov ecx, dword [rbp - 0x21]
mov edx, dword [rbp - 0x1d]
cmp ebx, r12d
ja 0x1400084f9
mov eax, dword [rbp - 0x25]
cmp dword [rbp - 0x29], eax
jne 0x1400084f1
cmp ecx, edx
je 0x1400084f9
mov dword [r15], r12d
jmp 0x140008431
add edx, r12d
add ecx, r12d
mov dword [rbp - 0x1d], edx
mov dword [rbp - 0x21], ecx
cmp edx, ecx
jbe 0x14000850e
mov dword [rbp - 0x21], edx
jmp 0x140008511
mov dword [rbp - 0x1d], ecx
call fcn.14000ecac
mov qword [rbp - 0x11], rax
mov r12, rax
test rax, rax
jne 0x140008535
mov ebx, 0xe
mov ecx, ebx
call fcn.140002874
mov eax, ebx
jmp 0x1400087e3
call fcn.14000ecac
mov qword [rbp - 9], rax
mov r13, rax
test rax, rax
jne 0x140008551
lea rcx, [rbp - 0x11]
call fcn.14000ecdc
jmp 0x140008522
mov ecx, dword [rbp - 0x21]
add ecx, ecx
call fcn.14000c800
mov qword [rbp - 1], rax
mov rsi, rax
test rax, rax
jne 0x140008572
lea rcx, [rbp - 9]
call fcn.14000ecdc
jmp 0x140008546
mov edi, r14d
mov ebx, 0xe
cmp dword [rbp - 0x29], r14d
jbe 0x1400085eb
mov r15, qword [rbp + 0x57]
test edi, edi
jne 0x1400085e7
mov eax, dword [rbp - 0x21]
lea r9, [rbp - 0x19]
mov ecx, eax
mov dword [rbp - 0x19], eax
xor eax, eax
add rcx, rcx
and qword [rsp + 0x38], rax
mov rdi, rsi
and qword [rsp + 0x30], rax
mov r8, rsi
and qword [rsp + 0x28], rax
mov edx, r14d
and qword [rsp + 0x20], rax
rep stosb byte [rdi], al
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x1400085de
mov rdx, rsi
mov rcx, r12
call fcn.14000ee68
cmp eax, 0xffffffff
cmove edi, ebx
inc r14d
cmp r14d, dword [rbp - 0x29]
jb 0x140008584
mov r15, qword [rbp + 0x7f]
xor r14d, r14d
cmp dword [rbp - 0x25], r14d
jbe 0x14000865f
mov r15, qword [rbp + 0x67]
test edi, edi
jne 0x14000865b
mov eax, dword [rbp - 0x1d]
lea r9, [rbp - 0x19]
mov ecx, eax
mov dword [rbp - 0x19], eax
xor eax, eax
add rcx, rcx
and qword [rsp + 0x38], rax
mov rdi, rsi
and qword [rsp + 0x30], rax
mov r8, rsi
and qword [rsp + 0x28], rax
mov edx, r14d
and qword [rsp + 0x20], rax
rep stosb byte [rdi], al
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140008652
mov rdx, rsi
mov rcx, r13
call fcn.14000ee68
cmp eax, 0xffffffff
cmove edi, ebx
inc r14d
cmp r14d, dword [rbp - 0x25]
jb 0x1400085f8
mov r15, qword [rbp + 0x7f]
lea rcx, [rbp - 1]
call fcn.14000cca4
mov eax, dword [rbp - 0x29]
xor esi, esi
test eax, eax
je 0x140008711
test edi, edi
jne 0x140008711
xor r8d, r8d
mov edx, esi
mov rcx, r12
call fcn.14000f370
test rax, rax
jne 0x140008693
xor ebx, ebx
jmp 0x1400086a0
cmp dword [rax + 4], 0x20000
jne 0x14000868f
mov rbx, qword [rax + 0x10]
mov r8, rbx
mov rcx, r13
call fcn.14000f200
mov r14d, eax
cmp eax, 0xffffffff
je 0x140008704
mov eax, dword [rbp + 0x77]
mov r9, qword [rbp + 0x6f]
mov r8, qword [rbp + 0x67]
mov rdx, qword [rbp + 0x5f]
mov rcx, qword [rbp + 0x57]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call fcn.140008bb0
mov edi, eax
test eax, eax
jne 0x140008706
mov edx, esi
mov rcx, r12
call fcn.14000f008
mov edx, r14d
mov rcx, r13
call fcn.14000f008
mov eax, dword [rbp - 0x29]
or ecx, 0xffffffff
add eax, ecx
add dword [rbp - 0x25], ecx
mov dword [rbp - 0x29], eax
jmp 0x140008709
inc esi
mov eax, dword [rbp - 0x29]
cmp esi, eax
jb 0x140008675
xor ebx, ebx
test eax, eax
je 0x140008769
mov r13d, dword [rbp + 0x77]
lea esi, [rbx + 1]
test edi, edi
jne 0x140008765
xor r8d, r8d
mov edx, ebx
mov rcx, r12
call fcn.14000f370
test rax, rax
je 0x140008741
cmp dword [rax + 4], 0x20000
jne 0x140008741
mov r8, qword [rax + 0x10]
lea eax, [r13 - 3]
cmp eax, esi
ja 0x14000875b
mov rdx, qword [rbp + 0x5f]
mov r9d, esi
mov rcx, qword [rbp + 0x57]
call fcn.140008fa4
mov edi, eax
add ebx, esi
mov dword [r15], esi
cmp ebx, dword [rbp - 0x29]
jb 0x14000871e
mov r13, qword [rbp - 9]
xor ebx, ebx
cmp dword [rbp - 0x25], ebx
jbe 0x1400087c1
test edi, edi
jne 0x1400087c1
xor r8d, r8d
mov edx, ebx
mov rcx, r13
call fcn.14000f370
test rax, rax
je 0x140008793
cmp dword [rax + 4], 0x20000
jne 0x140008793
mov r8, qword [rax + 0x10]
mov eax, dword [rbp + 0x77]
add eax, 0xfffffffd
cmp eax, 1
ja 0x1400087b3
mov rdx, qword [rbp + 0x6f]
mov r9d, 2
mov rcx, qword [rbp + 0x67]
call fcn.140008fa4
mov edi, eax
inc ebx
mov dword [r15], 1
cmp ebx, dword [rbp - 0x25]
jb 0x140008770
lea rcx, [rbp - 0x11]
call fcn.14000ecdc
lea rcx, [rbp - 9]
call fcn.14000ecdc
jmp 0x1400087da
mov edi, 0x57
mov ecx, edi
call fcn.140002874
mov eax, edi
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret