Function at 0x140012280
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push r12
push r13
lea rbp, [rsp - 0x118]
sub rsp, 0x218
mov rax, qword [0x140200d38]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov eax, dword [0x1402019fc]
xor ebx, ebx
mov r8, qword [0x140357530]
mov r12, rcx
lea r13d, [rax - 1]
test r8, r8
je 0x1400122ef
mov rax, qword [0x1403572d0]
test rax, rax
je 0x1400122e2
test r8, r8
je 0x1400122e2
mov rcx, qword [0x1403572d0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x1402019fc]
mov qword [0x140357530], rbx
mov r8d, eax
mov rax, qword [0x1403572d0]
shl r8, 4
test rax, rax
je 0x140012317
mov rcx, qword [0x1403572d0]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [0x140357530], rbx
test rbx, rbx
je 0x14001274d
mov r8d, dword [0x1402019fc]
xor edx, edx
shl r8, 4
mov rcx, rbx
mov qword [rsp + 0x248], rsi
call fcn.140140260
movabs rax, 0x1c1b0de9bf1d0000
mov esi, 1
mov qword [rbx], rax
movabs rax, 0x1c1b0de9bf800000
mov qword [rbx + 8], rax
test r13d, r13d
jle 0x140012745
mov qword [rsp + 0x250], rdi
mov qword [rsp + 0x258], r14
lea r14d, [rsi + 0xf]
mov qword [rsp + 0x210], r15
mov r15d, esi
nop dword [rax]
xor edx, edx
mov dword [rsp + 0x30], SafeArrayDestroy
lea rcx, [rbp - 0x30]
lea r8d, [rdx + 0x50]
call fcn.140140260
movups xmm0, xmmword [str.MgLowerRange]
lea rdx, [0x1401b260c]
xor eax, eax
movsd xmm1, qword [0x1401b25e0]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
mov r8d, esi
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
movzx eax, word [0x1401b25e8]
mov word [rbp - 0x58], ax
xor eax, eax
mov qword [rbp - 0x56], rax
mov qword [rbp - 0x4e], rax
mov qword [rbp - 0x46], rax
mov qword [rbp - 0x3e], rax
mov word [rbp - 0x36], ax
movzx eax, word [0x1401b2608]
movups xmmword [rbp - 0x70], xmm0
mov word [rsp + 0x68], ax
xor eax, eax
movups xmm0, xmmword [str.MgUpperRange]
mov qword [rsp + 0x6a], rax
movsd qword [rbp - 0x60], xmm1
movsd xmm1, qword [0x1401b2600]
mov qword [rsp + 0x72], rax
mov qword [rsp + 0x7a], rax
mov qword [rbp - 0x7e], rax
mov word [rbp - 0x76], ax
movups xmmword [rsp + 0x50], xmm0
movsd qword [rsp + 0x60], xmm1
call fcn.140013950
lea rcx, [rbp - 0x70]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140012450
lea r8, [rsp + 0x38]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140012470
lea rcx, [rsp + 0x50]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140012490
lea r8, [rsp + 0x38]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1400124b0
lea rcx, [rsp + 0x50]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400124d0
add eax, eax
lea r9, [rsp + 0x30]
mov dword [rsp + 0x34], eax
lea rdx, [rbp - 0x70]
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, r12
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001271a
cmp dword [rsp + 0x30], 1
jne 0x14001271a
xor edx, edx
lea r8d, [rax + 0x64]
lea rcx, [rbp + 0x20]
call fcn.140140260
lea rax, [rbp - 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140012535
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x20]
call fcn.14014e46c
mov rdi, qword [0x140357530]
lea r11, [rbp + 0x20]
add rdi, r14
mov ebx, 7
mov qword [rdi], 0
nop word [rax + rax]
xor r9b, r9b
mov r10d, SafeArrayUnlock
xor r8d, r8d
nop dword [rax]
movzx ecx, byte [r11 + r8]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140012591
sub cl, 0x30
jmp 0x1400125a5
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x14001259d
sub cl, 0x37
jmp 0x1400125a5
cmp cl, 0x61
jl 0x1400125cc
sub cl, 0x57
movzx edx, r10b
mov eax, r10d
movzx ecx, cl
inc r8
imul edx, ecx
add r9b, dl
cdq
and edx, 0xf
lea r10d, [rdx + rax]
sar r10d, 4
cmp r8, 2
jl 0x140012580
jmp 0x1400125cf
xor r9b, r9b
mov byte [rbx + rdi], r9b
add r11, 2
dec rbx
cmp rbx, 1
jg 0x140012570
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rbp - 0x30]
mov rcx, r12
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140012703
cmp dword [rsp + 0x30], 1
jne 0x140012703
xor edx, edx
lea r8d, [rax + 0x64]
lea rcx, [rbp + 0x90]
call fcn.140140260
lea rax, [rbp - 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140012640
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x90]
call fcn.14014e46c
mov rax, qword [0x140357530]
lea r11, [rbp + 0x90]
lea rdi, [rax + r14]
mov ebx, 7
mov qword [rdi + 8], 0
nop word [rax + rax]
xor r9b, r9b
mov r10d, SafeArrayUnlock
xor r8d, r8d
nop dword [rax]
movzx eax, byte [r11 + r8]
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x1400126a1
sub al, 0x30
jmp 0x1400126b3
lea ecx, [rax - 0x41]
cmp cl, 5
ja 0x1400126ad
sub al, 0x37
jmp 0x1400126b3
cmp al, 0x61
jl 0x1400126da
sub al, 0x57
movzx ecx, al
inc r8
movzx edx, r10b
mov eax, r10d
imul edx, ecx
add r9b, dl
cdq
and edx, 0xf
add eax, edx
sar eax, 4
mov r10d, eax
cmp r8, 2
jl 0x140012690
jmp 0x1400126dd
xor r9b, r9b
mov byte [rbx + rdi + 8], r9b
add r11, 2
dec rbx
cmp rbx, 1
jg 0x140012680
inc esi
inc r15
add r14, 0x10
cmp esi, r13d
jle 0x140012390
jmp 0x14001272d
mov rax, qword [0x140357530]
add r15, r15
xor ebx, ebx
mov qword [rax + r15*8], rbx
mov qword [rax + r15*8 + 8], rbx
jmp 0x14001272d
mov rax, qword [0x140357530]
movsxd rcx, esi
add rcx, rcx
xor ebx, ebx
mov qword [rax + rcx*8], rbx
mov r14, qword [rsp + 0x258]
mov rdi, qword [rsp + 0x250]
mov r15, qword [rsp + 0x210]
mov rsi, qword [rsp + 0x248]
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.140121cc0
add rsp, 0x218
pop r13
pop r12
pop rbx
pop rbp
ret