Function at 0x140107074
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x140334860]
xor rax, rsp
mov qword [rbp + 0x360], rax
xor r13d, r13d
mov edi, 0x200
mov r14, r9
mov rsi, r8
mov r12, rdx
mov rbx, rcx
test rdi, rcx
je 0x140107290
mov rcx, qword [0x140331c48]
lea r8, [rsp + 0x58]
lea edx, [r13 + 1]
mov qword [rsp + 0x58], r13
call fcn.1400a1c4c
test eax, eax
jne 0x140107290
mov dword [rsp + 0x40], edi
xor edx, edx
mov edi, r13d
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x44], 0x100
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x160]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140107285
cmp dword [rsp + 0x50], 1
mov qword [rsp + 0x48], r13
jne 0x140107191
mov edx, dword [rsp + 0x44]
test edx, edx
je 0x140107191
cmp dword [rsi], edx
jbe 0x140107191
test edx, edx
js 0x140107276
mov r8, qword [r12]
lea rcx, [rbp + 0x160]
mov r9d, edx
call fcn.14009dcd8
test eax, eax
jne 0x140107191
mov ecx, dword [rsi]
lea rdx, [rsp + 0x48]
mov r15d, dword [rsp + 0x40]
mov r8, r14
shr r15d, 1
dec r15d
add ecx, r15d
add rcx, rcx
call fcn.14009ff30
test eax, eax
jns 0x1401071a2
inc edi
mov dword [rsp + 0x40], 0x200
mov edx, edi
jmp 0x1401070ec
mov r8d, dword [rsi]
lea rdi, [r15 + r15]
add r8d, r15d
add r8, r8
test rdi, rdi
je 0x1401071f6
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x1401071cb
call fcn.14015a000
mov dword [rax], 0x16
jmp 0x1401071f1
cmp r8, rdi
jb 0x1401071df
mov r8, rdi
lea rdx, [rsp + 0x60]
call fcn.140137400
jmp 0x1401071f6
xor edx, edx
call fcn.1401380c0
call fcn.14015a000
mov dword [rax], 0x22
call fcn.140157120
mov rax, qword [rsp + 0x48]
movsxd rbx, dword [rsi]
mov r14, qword [r12]
lea rcx, [rdi + rax]
add rbx, rbx
je 0x140107258
test rcx, rcx
jne 0x14010721d
call fcn.14015a000
mov dword [rax], 0x16
jmp 0x140107253
test r14, r14
je 0x140107234
cmp rbx, rbx
jb 0x140107234
mov r8, rbx
mov rdx, r14
call fcn.140137400
jmp 0x140107258
mov r8, rbx
xor edx, edx
call fcn.1401380c0
test r14, r14
je 0x140107210
cmp rbx, rbx
jae 0x140107258
call fcn.14015a000
mov dword [rax], 0x22
call fcn.140157120
mov rcx, qword [rsp + 0x48]
mov qword [r12], rcx
add dword [rsi], r15d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140107327
mov dword [0], 1
xor ecx, ecx
int 0x29
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
bt rbx, 0xa
jae 0x140107325
mov rcx, qword [0x140331c40]
lea rdx, [rsp + 0x60]
mov r8d, 0x100
call fcn.1400a5bf0
lea rax, [rsp + 0x60]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], r13w
jne 0x1401072bb
mov qword [rsp + 0x48], r13
test edi, edi
je 0x140107325
mov ecx, dword [rsi]
lea rdx, [rsp + 0x48]
add ecx, edi
mov r8, r14
add rcx, rcx
call fcn.14009ff30
test eax, eax
js 0x140107325
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov eax, edi
lea rbx, [rax + rax]
mov r8, rbx
call fcn.140137400
movsxd r8, dword [rsi]
mov rcx, qword [rsp + 0x48]
add r8, r8
mov rdx, qword [r12]
add rcx, rbx
call fcn.140137400
mov rax, qword [rsp + 0x48]
mov qword [r12], rax
add dword [rsi], edi
jmp 0x14010726f
xor al, al
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.140135130
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x470
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret