Function at 0x1400159d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov rax, qword [0x14003c040]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r14, r8
mov r15, rcx
call fcn.140014200
test rax, rax
je 0x140015cec
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 9], rax
lea r13, str.agentrefreshrate
lea rcx, [rbp - 9]
cmp r13, 0x10000
jae 0x140015a3e
movzx edx, r13w
call fcn.140014660
jmp 0x140015a4d
mov r8d, 0x10
mov rdx, r13
call fcn.1400149d0
nop
mov rbx, qword [r15 + 0x28]
mov r8, qword [rbx + 8]
mov rsi, rbx
xor r10d, r10d
mov rax, qword [rbp - 9]
cmp byte [r8 + 0x19], r10b
jne 0x140015ab6
test rax, rax
je 0x140015cec
mov rcx, qword [r8 + 0x20]
mov r9, rax
sub r9, rcx
nop dword [rax + rax]
movzx edx, word [rcx]
cmp dx, word [rcx + r9]
jne 0x140015a98
add rcx, 2
test dx, dx
jne 0x140015a80
mov ecx, r10d
jmp 0x140015a9d
sbb ecx, ecx
or ecx, 1
shr ecx, 0x1f
test cl, cl
je 0x140015aaa
mov r8, qword [r8 + 0x10]
jmp 0x140015ab0
mov rsi, r8
mov r8, qword [r8]
cmp byte [r8 + 0x19], r10b
je 0x140015a65
cmp byte [rsi + 0x19], r10b
jne 0x140015af4
mov r8, qword [rsi + 0x20]
test r8, r8
je 0x140015cec
mov rcx, rax
sub r8, rax
nop
movzx edx, word [rcx]
cmp dx, word [rcx + r8]
jne 0x140015ae8
add rcx, 2
test dx, dx
jne 0x140015ad0
mov ecx, r10d
jmp 0x140015aed
sbb ecx, ecx
or ecx, 1
shr ecx, 0x1f
test cl, cl
je 0x140015af7
mov rsi, rbx
lea rdx, [rax - 0x18]
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140015b18
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor r10d, r10d
cmp rsi, rbx
jne 0x140015c69
mov dword [rbp + 0xb], r10d
mov dword [r14], r10d
mov eax, dword [r15 + 8]
or eax, 1
lea rcx, [rbp + 0xb]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 1]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r10d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [r15 + 0x10]
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140015c39
mov dword [rbp + 7], eax
mov dword [rbp + 0xf], 4
mov dword [rbp + 0x13], 4
lea rax, [rbp + 0xf]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x13]
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 1]
test eax, eax
jne 0x140015c33
mov eax, dword [rbp + 7]
mov dword [r14], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140014200
mov rcx, rax
test rax, rax
je 0x140015cf7
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x19], rax
lea rcx, [rbp - 0x19]
cmp r13, 0x10000
jae 0x140015bf0
movzx edx, r13w
call fcn.140014660
jmp 0x140015bfe
mov r8d, 0x10
mov rdx, r13
call fcn.1400149d0
movzx ebx, r13w
lea rdx, [rbp - 0x19]
lea rcx, [r15 + 0x28]
call fcn.140015d10
mov ecx, dword [r14]
mov dword [rax], ecx
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140015c6c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140015c6c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [r14], 0x3e8
xor al, al
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140016720
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rbx, r13
call fcn.140014200
mov rcx, rax
test rax, rax
je 0x140015ce1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x11], rax
lea rcx, [rbp - 0x11]
cmp r13, 0x10000
jae 0x140015c9e
movzx edx, bx
call fcn.140014660
jmp 0x140015cad
mov r8d, 0x10
mov rdx, r13
call fcn.1400149d0
nop
lea rcx, [r15 + 0x28]
lea rdx, [rbp - 0x11]
call fcn.140015d10
mov ecx, dword [rax]
mov dword [r14], ecx
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140015cda
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov al, 1
jmp 0x140015c42
mov ecx, 0x80004005
call fcn.140014060
int3
mov ecx, 0x80004005
call fcn.140014060
int3
mov ecx, 0x80004005
call fcn.140014060
int3