Function at 0x140040570
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rsp + 0xf8], rbx
mov rax, qword [0x14011f190]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x19], rcx
mov rcx, rdx
call fcn.140040070
mov r15, rax
test rax, rax
jne 0x1400405d1
xor esi, esi
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
jmp 0x1400408c9
mov r9, rbx
mov r10, qword [rbx + 0x18]
cmp r10, 8
jb 0x1400405e1
mov r9, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rdx, 0xffffffffffffffff
test r8, r8
je 0x140040607
mov rcx, r8
mov rax, r9
cmp word [rax], 0x5c
je 0x140040664
add rax, 2
sub rcx, 1
jne 0x1400405f7
mov rax, rdx
inc rax
movdqa xmm0, xmmword [0x140101630]
movdqu xmmword [rbp - 1], xmm0
xor esi, esi
mov word [rbp - 0x11], si
cmp r8, rax
jb 0x140040907
sub r8, rax
cmp r8, rdx
cmovb rdx, r8
cmp r10, 8
jb 0x14004063c
mov rbx, qword [rbx]
lea r9, [rbx + rax*2]
lea rcx, [rbp - 0x11]
cmp rdx, 7
ja 0x140040671
mov qword [rbp - 1], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call fcn.1400933b0
mov word [rbp + rbx - 0x11], si
jmp 0x140040677
test rax, rax
je 0x140040607
sub rax, r9
sar rax, 1
jmp 0x14004060a
call fcn.14002d3d0
nop
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x19]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14004070a
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x1400408c9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400408c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400408f5
jmp 0x1400408c4
mov dword [rbp - 0x21], esi
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x14004071a
mov rdx, qword [r14]
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140040799
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x1400408c9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400408c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400408fb
jmp 0x1400408c4
xor eax, eax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rax
mov edx, dword [rbp - 0x21]
lea rcx, [rbp + 0xf]
call fcn.140040920
cmp qword [r14 + 0x18], 8
jb 0x1400407bd
mov r14, qword [r14]
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov rbx, qword [rbp + 0xf]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14004087a
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
test rbx, rbx
je 0x140040839
mov rdx, qword [rbp + 0x1f]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x140040830
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004090d
mov rcx, rbx
call fcn.14006f490
nop
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x1400408c9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400408c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040901
jmp 0x1400408c4
mov qword [rdi], rbx
mov rax, qword [rbp + 0x17]
mov qword [rdi + 8], rax
mov rax, qword [rbp + 0x1f]
mov qword [rdi + 0x10], rax
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x1400408c9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400408c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400408ef
call fcn.14006f490
mov rax, rdi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14006f430
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.14009c704
int3
call fcn.14009c704
int3
call fcn.14009c704
int3
call fcn.14009c704
int3
call fcn.14002cb50
nop
call fcn.14009c704
nop
int3