Function at 0x1400db750
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
lea r14, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400db7aa
test byte [rcx + 0x1c], 1
je 0x1400db7aa
cmp byte [rcx + 0x19], 5
jb 0x1400db7aa
mov edx, 0x1d
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
xor r13d, r13d
cmp qword [rsi], r13
je 0x1400db7dd
mov ebx, r13d
cmp dword [rsi + 8], r13d
jle 0x1400db7d1
movsxd rcx, ebx
shl rcx, 5
add rcx, qword [rsi]
call fcn.140053400
inc ebx
cmp ebx, dword [rsi + 8]
jl 0x1400db7bb
mov rcx, qword [rsi]
call qword [sym.imp.msvcrt.dll_free]
mov qword [rsi], r13
mov qword [rsi + 8], r13
mov ebx, 0x54f
mov rdx, qword [rdi + 8]
cmp dword [rdx - 0x10], r13d
je 0x1400dbd88
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x19], r13
lea rcx, [rbp - 0x29]
call fcn.1400dc704
mov ebx, eax
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400db83b
test byte [rcx + 0x1c], 2
je 0x1400db83b
cmp byte [rcx + 0x19], 4
jb 0x1400db83b
mov edx, 0x1e
mov r9d, eax
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
mov qword [rbp - 0x61], r13
mov qword [rbp - 0x59], r13
test ebx, ebx
jne 0x1400dbd6f
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x29]
call fcn.1400d2210
mov ebx, eax
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400db88a
test byte [rcx + 0x1c], 2
je 0x1400db88a
cmp byte [rcx + 0x19], 4
jb 0x1400db88a
mov edx, 0x1f
mov r9d, eax
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
test ebx, ebx
jne 0x1400dbd6f
mov r15d, r13d
mov eax, dword [rbp - 0x59]
test eax, eax
jle 0x1400dbd6f
mov r12, r13
mov rdi, r13
mov qword [rbp - 0x49], r13
mov qword [rbp - 0x41], r13
mov qword [rbp - 0x39], r13
test r12, r12
js 0x1400dbd5c
cmp r15d, eax
jge 0x1400dbd5c
mov rax, qword [rbp - 0x61]
mov qword [rbp - 0x31], r13
lea rcx, [rbp - 0x31]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20119
xor r8d, r8d
mov rdx, qword [rax + r12*8]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400db8fd
mov ebx, r13d
mov rdi, qword [rbp - 0x31]
mov qword [rbp - 0x49], rdi
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400db92d
test byte [rcx + 0x1c], 2
je 0x1400db92d
cmp byte [rcx + 0x19], 4
jb 0x1400db92d
mov edx, 0x20
mov r9d, ebx
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
test ebx, ebx
jne 0x1400dbccb
mov rax, qword [section..data]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140015690]
lea rcx, section..data
call rbx
add rax, 0x18
mov qword [rbp - 0x51], rax
mov rax, qword [section..data]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140015690]
lea rcx, section..data
call rbx
add rax, 0x18
mov qword [rbp - 0x69], rax
mov rax, qword [section..data]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140015690]
lea rcx, section..data
call rbx
add rax, 0x18
mov qword [rbp + 0x7f], rax
mov dword [rbp + 0x67], 4
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f]
xor r8d, r8d
lea rdx, [0x140009220]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1400db9e7
mov eax, dword [rbp + 0x6f]
sub eax, 4
neg eax
sbb ebx, ebx
and ebx, 0xd
mov rcx, qword [0x140148ea8]
mov dil, 2
cmp rcx, r14
je 0x1400dba1a
test byte [rcx + 0x1c], dil
je 0x1400dba1a
cmp byte [rcx + 0x19], 4
jb 0x1400dba1a
mov edx, 0x21
mov r9d, ebx
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
test ebx, ebx
jne 0x1400dbb00
lea r8, [rbp - 0x51]
lea rdx, [0x140009230]
lea rcx, [rbp - 0x49]
call fcn.1400d252c
mov ebx, eax
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400dba68
test byte [rcx + 0x1c], dil
je 0x1400dba68
cmp byte [rcx + 0x19], 4
jb 0x1400dba68
mov edx, 0x22
mov r9d, eax
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
test ebx, ebx
jne 0x1400dbb00
lea r8, [rbp - 0x69]
lea rdx, [0x140009238]
lea rcx, [rbp - 0x49]
call fcn.1400d252c
mov ebx, eax
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400dbab6
test byte [rcx + 0x1c], dil
je 0x1400dbab6
cmp byte [rcx + 0x19], 4
jb 0x1400dbab6
mov edx, 0x23
mov r9d, eax
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
test ebx, ebx
jne 0x1400dbb00
lea r8, [rbp + 0x7f]
lea rdx, [0x140009248]
lea rcx, [rbp - 0x49]
call fcn.1400d252c
mov ebx, eax
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400dbb00
test byte [rcx + 0x1c], dil
je 0x1400dbb00
cmp byte [rcx + 0x19], 4
jb 0x1400dbb00
mov edx, 0x24
mov r9d, eax
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
lea rdx, [0x140009258]
mov rcx, qword [rbp - 0x69]
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1400dbb4a
lea rcx, [rbp - 0x69]
call fcn.140011644
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400dbb4a
test byte [rcx + 0x1c], dil
je 0x1400dbb4a
cmp byte [rcx + 0x19], 4
jb 0x1400dbb4a
mov edx, 0x25
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
lea rdx, [0x140009258]
mov rcx, qword [rbp + 0x7f]
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1400dbb94
lea rcx, [rbp + 0x7f]
call fcn.140011644
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400dbb94
test byte [rcx + 0x1c], dil
je 0x1400dbb94
cmp byte [rcx + 0x19], 4
jb 0x1400dbb94
mov edx, 0x26
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
test ebx, ebx
jne 0x1400dbc43
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x69]
mov r8, qword [rbp - 0x51]
mov edx, dword [rbp + 0x77]
lea rcx, [rbp - 9]
call fcn.1400daf14
mov rdi, rax
mov ebx, dword [rsi + 8]
cmp ebx, dword [rsi + 0xc]
jne 0x1400dbbfb
cmp dword [rsi + 0xc], r13d
jne 0x1400dbbd1
mov ebx, 1
jmp 0x1400dbbd5
add ebx, ebx
js 0x1400dbc0c
movsxd rdx, ebx
cmp rdx, 0x3ffffff
ja 0x1400dbc0c
mov r8d, 0x20
mov rcx, qword [rsi]
call qword [0x140148050]
test rax, rax
je 0x1400dbc0c
mov dword [rsi + 0xc], ebx
mov qword [rsi], rax
mov r8, rdi
mov edx, dword [rsi + 8]
mov rcx, rsi
call fcn.1400dc940
inc dword [rsi + 8]
lea rcx, [rbp - 9]
call fcn.140053400
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400dbc43
test byte [rcx + 0x1c], 2
je 0x1400dbc43
cmp byte [rcx + 0x19], 4
jb 0x1400dbc43
mov edx, 0x27
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
nop
mov r14, qword [rbp + 0x7f]
lock add dword [r14 - 8], 0xffffffff
jg 0x1400dbc6d
mov rdi, qword [r14 - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140015690]
lea rdx, [r14 - 0x18]
mov rcx, rdi
call rbx
nop
mov r14, qword [rbp - 0x69]
lock add dword [r14 - 8], 0xffffffff
jg 0x1400dbc97
mov rdi, qword [r14 - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140015690]
lea rdx, [r14 - 0x18]
mov rcx, rdi
call rbx
nop
mov r14, qword [rbp - 0x51]
lock add dword [r14 - 8], 0xffffffff
jg 0x1400dbcc0
mov rdi, qword [r14 - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140015690]
lea rdx, [r14 - 0x18]
mov rcx, rdi
call rbx
lea r14, [0x140148ea8]
mov rdi, qword [rbp - 0x49]
test rdi, rdi
je 0x1400dbce0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r13
mov qword [rbp - 0x49], r13
cmp r15d, dword [rbp - 0x59]
jge 0x1400dbd4c
mov rdx, qword [rbp - 0x61]
mov rdx, qword [rdx + r12*8]
lea rcx, [rbp - 0x29]
call fcn.1400d2778
mov ebx, eax
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400dbd2a
test byte [rcx + 0x1c], 2
je 0x1400dbd2a
cmp byte [rcx + 0x19], 4
jb 0x1400dbd2a
mov edx, 0x28
mov r9d, eax
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
nop
test rdi, rdi
je 0x1400dbd38
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r15d
inc r12
mov eax, dword [rbp - 0x59]
cmp r15d, eax
jl 0x1400db8a3
jmp 0x1400dbd6f
mov edx, 1
mov ecx, 0xc000008c
call fcn.1400119d8
int3
mov edx, 1
mov ecx, 0xc000008c
call fcn.1400119d8
nop
jmp 0x1400dbd6e
nop
lea rcx, [rbp - 0x61]
call fcn.140026ee0
nop
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x1400dbd88
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400dbdc8
test byte [rcx + 0x1c], 1
je 0x1400dbdc8
movzx r9d, byte [rcx + 0x19]
mov eax, ebx
neg eax
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp r9d, edx
jl 0x1400dbdc8
mov edx, 0x29
mov r9d, ebx
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
mov eax, ebx
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret