Function at 0x14004edf0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7fa0]
mov eax, 0x80a0
call fcn.1400d8890
sub rsp, rax
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x80f0], rbx
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp + 0x7f90], rax
mov r14, rdx
mov r9, rcx
mov r8d, dword [0x1401d5d60]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0xf
jne 0x14004ee6e
inc r8d
mov dword [0x1401d5d60], r8d
xor esi, esi
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x60], rsi
xor r8d, r8d
mov rdx, r9
lea rcx, [rsp + 0x70]
call fcn.14004c380
nop
mov qword [rsp + 0x68], rsi
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [0x1401d0d48]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test eax, eax
jne 0x14004eecd
mov dword [rsp + 0x58], esi
mov ecx, esi
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
test ecx, ecx
setne bl
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004eeeb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14004ef32
mov ecx, dword [0x1401d5d60]
imul ecx, ecx
mov eax, 0x78787879
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 0xb
jne 0x14004ef26
lea edx, [rcx + 0x3c]
lea r8d, [rcx + 0x3d]
lea rcx, [0x14015c754]
call fcn.1400d40f4
xor bl, bl
mov rdi, qword [rsp + 0x50]
jmp 0x14004f348
mov ebx, dword [0x1401d5d60]
lea ecx, [rbx + 2]
lea eax, [rbx + 1]
imul ecx, eax
imul ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 9
jne 0x14004ef82
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov ebx, dword [0x1401d5d60]
mov dword [rsp + 0x48], 0x4000
mov word [rbp - 0x70], si
xor edx, edx
mov r8d, 0x7ffe
lea rcx, [rbp - 0x6e]
call fcn.1400d8c20
mov r13d, esi
mov rdi, qword [rsp + 0x50]
nop word [rax + rax]
lea ecx, [rbx + 2]
lea eax, [rbx + 1]
imul ecx, eax
imul ecx, ebx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 1
jne 0x14004f046
test ebx, ebx
je 0x14004f046
nop dword [rax]
mov eax, ebx
and eax, 0x80000001
jge 0x14004eff0
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x14004f005
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
mov dword [0x1401d5d60], eax
jmp 0x14004f012
lea ebx, [rbx*2 + 1]
mov dword [0x1401d5d60], ebx
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov ecx, ebx
sub ecx, eax
je 0x14004f034
sub ecx, 2
je 0x14004f037
dec ecx
je 0x14004f039
jmp 0x14004f042
add ebx, 2
inc ebx
add ebx, 2
mov dword [0x1401d5d60], ebx
test ebx, ebx
jne 0x14004efe0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x48]
lea r8, [rbp - 0x70]
mov edx, r13d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov r12d, eax
inc r13d
test eax, eax
je 0x14004f084
cmp eax, 0x103
jne 0x14004f2cb
lea rcx, str.__r_
mov rdx, qword [str.__r_]
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
lea rcx, [rbp - 0x70]
lea rax, [rbp - 0x70]
test rax, 0xffffffffffff0000
jne 0x14004f0db
movzx edi, cx
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004f1b9
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002760
mov rbx, qword [rsp + 0x40]
jmp 0x14004f1b9
lea rax, [rbp - 0x70]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14004f0e3
test edi, edi
jne 0x14004f141
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004f1b9
cmp dword [rdx + 0x10], 0
jge 0x14004f11d
cmp dword [rbx - 0xc], 0
jl 0x14004f2db
mov dword [rbx - 0x10], esi
mov word [rbx], si
jmp 0x14004f1b9
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004f12d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
jmp 0x14004f1b9
mov r15d, dword [rbx - 0x10]
lea rsi, [rbp - 0x70]
sub rsi, rbx
sar rsi, 1
test edi, edi
js 0x14004f36f
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14004f179
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140002560
mov rbx, qword [rsp + 0x40]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp rsi, r15
lea r15, [rax + rax]
mov r9, r15
ja 0x14004f19d
lea r8, [rbx + rsi*2]
call fcn.1400d400c
jmp 0x14004f1a6
lea r8, [rbp - 0x70]
call fcn.1400d41cc
cmp edi, dword [rbx - 0xc]
jg 0x14004f364
mov dword [rbx - 0x10], edi
xor esi, esi
mov word [r15 + rbx], si
cmp dword [rbx - 0x10], 0
je 0x14004f25b
mov rax, qword [r14 + 8]
lea rcx, [rsp + 0x40]
cmp rcx, rax
jae 0x14004f226
mov rcx, qword [r14]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
ja 0x14004f226
lea rdi, [rsp + 0x40]
sub rdi, rcx
sar rdi, 3
cmp rax, qword [r14 + 0x10]
jne 0x14004f1f8
mov rcx, r14
call fcn.14001e1e0
mov rax, qword [r14]
lea rcx, [rax + rdi*8]
mov rdi, qword [r14 + 8]
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
test rdi, rdi
je 0x14004f224
mov rcx, qword [rcx]
sub rcx, 0x18
call fcn.1400025c0
add rax, 0x18
mov qword [rdi], rax
jmp 0x14004f256
cmp rax, qword [r14 + 0x10]
jne 0x14004f234
mov rcx, r14
call fcn.14001e1e0
mov rdi, qword [r14 + 8]
mov qword [rbp - 0x80], rdi
mov qword [rsp + 0x78], rdi
test rdi, rdi
je 0x14004f256
lea rcx, [rbx - 0x18]
call fcn.1400025c0
add rax, 0x18
mov qword [rdi], rax
add qword [r14 + 8], 8
mov dword [rsp + 0x48], 0x4000
mov r9d, dword [0x1401d5d60]
lea r8d, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, r8d
imul ecx, r9d
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 3
cmove r9d, r8d
mov dword [0x1401d5d60], r9d
xor edx, edx
mov r8d, 0x8000
lea rcx, [rbp - 0x70]
call fcn.1400d8c20
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004f2c6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x50]
test r12d, r12d
jne 0x14004f2e6
mov ebx, dword [0x1401d5d60]
jmp 0x14004efb0
mov ecx, 0x80070057
call fcn.140001920
nop
test rdi, rdi
je 0x14004f2fc
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, rsi
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x58], esi
mov eax, dword [0x1401d5d60]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 0x80000007
jge 0x14004f31b
dec ecx
or ecx, 0xfffffff8
inc ecx
cmp ecx, 7
jne 0x14004f346
mov r8d, esi
test eax, eax
je 0x14004f33f
nop word [rax + rax]
mov ecx, eax
and ecx, 1
add r8d, ecx
cdq
sub eax, edx
sar eax, 1
jne 0x14004f330
mov dword [0x1401d5d60], r8d
mov bl, 1
test rdi, rdi
je 0x14004f35b
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x58], esi
movzx eax, bl
jmp 0x14004f37a
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
nop
mov rcx, qword [rbp + 0x7f90]
xor rcx, rsp
call fcn.1400d37e0
mov rbx, qword [rsp + 0x80f0]
add rsp, 0x80a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret