Function at 0x140035bf4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r15, r8
mov rbx, rdx
mov r14, rcx
lea rdi, section..data
mov rcx, qword [section..data]
cmp rcx, rdi
je 0x140035c47
test byte [rcx + 0x1c], 1
je 0x140035c47
cmp byte [rcx + 0x19], 5
jb 0x140035c47
mov edx, 0x37
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.1400a09ec
mov rdx, rbx
mov rcx, r14
call fcn.1400065a4
mov esi, eax
mov rcx, qword [section..data]
cmp rcx, rdi
je 0x140035c81
test byte [rcx + 0x1c], 2
je 0x140035c81
cmp byte [rcx + 0x19], 5
jb 0x140035c81
mov edx, 0x38
mov dword [rsp + 0x20], eax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.1400a09ec
xor edi, edi
mov eax, 0x490
test esi, esi
cmove edi, eax
mov rdx, rbx
lea rcx, [rbp + 0x48]
call fcn.140017070
nop
lea rcx, [rbp + 0x48]
call fcn.140007760
xor esi, esi
mov qword [rbp - 0x18], rsi
and qword [rbp - 0x10], rsi
and qword [rbp - 8], rsi
test edi, edi
jne 0x140035d01
xor r8d, r8d
lea rdx, [rbp - 0x18]
mov rcx, r14
call fcn.140006740
mov edi, eax
mov rcx, qword [section..data]
lea r14, section..data
cmp rcx, r14
je 0x140035cfb
test byte [rcx + 0x1c], 2
je 0x140035cfb
cmp byte [rcx + 0x19], 4
jb 0x140035cfb
lea edx, [rsi + 0x39]
mov r9d, eax
lea r8, [0x1400afc70]
mov rcx, qword [rcx + 0x10]
call fcn.1400438d8
mov rsi, qword [rbp - 0x18]
jmp 0x140035d08
lea r14, section..data
and dword [r15], 0
and dword [rbp + 0x40], 0
mov rbx, qword [rbp + 0x48]
test edi, edi
jne 0x140035e8f
lea r14d, [rdi + 4]
mov dword [rbp + 0x48], r14d
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x20]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140035d62
mov eax, dword [rbp - 0x20]
sub eax, r14d
neg eax
sbb edi, edi
and edi, 0xd
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140035dab
test byte [rcx + 0x1c], 2
je 0x140035dab
cmp byte [rcx + 0x19], r14b
jb 0x140035dab
mov edx, 0x3a
mov dword [rsp + 0x28], edi
mov eax, dword [rbp + 0x40]
mov dword [rsp + 0x20], eax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.1400a0934
mov rcx, qword [section..data]
lea rax, section..data
cmp edi, 2
jne 0x140035e57
xor edi, edi
cmp rcx, rax
je 0x140035e22
test byte [rcx + 0x1c], 2
je 0x140035de1
cmp byte [rcx + 0x19], r14b
jb 0x140035de1
lea edx, [rdi + 0x3b]
lea r8, [0x1400afc70]
mov rcx, qword [rcx + 0x10]
call fcn.140045cf4
mov rcx, qword [section..data]
lea r14, section..data
cmp rcx, r14
je 0x140035e22
test byte [rcx + 0x1c], 1
je 0x140035e22
movzx r9d, byte [rcx + 0x19]
mov eax, edi
neg eax
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp r9d, edx
jb 0x140035e22
mov edx, 0x3d
mov r9d, edi
lea r8, [0x1400afc70]
mov rcx, qword [rcx + 0x10]
call fcn.1400438d8
nop
test rsi, rsi
je 0x140035e37
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
nop
lea rcx, [rbx - 0x18]
call fcn.14000ccd0
mov eax, edi
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
test edi, edi
jne 0x140035de1
cmp dword [rbp + 0x40], edi
je 0x140035de1
mov dword [r15], 1
mov rcx, qword [section..data]
cmp rcx, rax
je 0x140035e22
test byte [rcx + 0x1c], 2
je 0x140035de1
cmp byte [rcx + 0x19], r14b
jb 0x140035de1
lea edx, [rdi + 0x3c]
jmp 0x140035dca
mov rcx, qword [section..data]
jmp 0x140035de8