Function at 0x1400f08e0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x14031d040]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [0x140331ec0], 0
je 0x1400f0c65
mov qword [rsp + 0x40], rbx
xorps xmm0, xmm0
lea rcx, [rsp + 0x50]
movaps xmmword [rcx], xmm0
mov rdx, rdi
call sub.ntdll.dll_RtlInitUnicodeString
mov dword [rsp + 0x4c], 0x18
mov ecx, 0x18
call fcn.1401ef3e0
test rax, rax
je 0x1400f0b3f
mov rdi, rax
mov byte [rax], 0
cmp rax, 0xffffffffffffffff
je 0x1400f0b3f
mov byte [rdi + 1], 0
cmp rdi, 0xfffffffffffffffe
je 0x1400f0b3f
mov byte [rdi + 2], 0
cmp rdi, 0xfffffffffffffffd
je 0x1400f0b3f
mov byte [rdi + 3], 0
cmp rdi, 0xfffffffffffffffc
je 0x1400f0b3f
mov byte [rdi + 4], 0
cmp rdi, 0xfffffffffffffffb
je 0x1400f0b3f
mov byte [rdi + 5], 0
cmp rdi, 0xfffffffffffffffa
je 0x1400f0b3f
mov byte [rdi + 6], 0
cmp rdi, 0xfffffffffffffff9
je 0x1400f0b3f
mov byte [rdi + 7], 0
cmp rdi, 0xfffffffffffffff8
je 0x1400f0b3f
mov byte [rdi + 8], 0
cmp rdi, 0xfffffffffffffff7
je 0x1400f0b3f
mov byte [rdi + 9], 0
cmp rdi, 0xfffffffffffffff6
je 0x1400f0b3f
mov byte [rdi + 0xa], 0
cmp rdi, 0xfffffffffffffff5
je 0x1400f0b3f
mov byte [rdi + 0xb], 0
cmp rdi, 0xfffffffffffffff4
je 0x1400f0b3f
mov byte [rdi + 0xc], 0
cmp rdi, 0xfffffffffffffff3
je 0x1400f0b3f
mov byte [rdi + 0xd], 0
cmp rdi, 0xfffffffffffffff2
je 0x1400f0b3f
mov byte [rdi + 0xe], 0
cmp rdi, 0xfffffffffffffff1
je 0x1400f0b3f
mov byte [rdi + 0xf], 0
cmp rdi, 0xfffffffffffffff0
je 0x1400f0b3f
mov byte [rdi + 0x10], 0
cmp rdi, 0xffffffffffffffef
je 0x1400f0b3f
mov byte [rdi + 0x11], 0
cmp rdi, 0xffffffffffffffee
je 0x1400f0b3f
mov byte [rdi + 0x12], 0
cmp rdi, 0xffffffffffffffed
je 0x1400f0b3f
mov byte [rdi + 0x13], 0
cmp rdi, 0xffffffffffffffec
je 0x1400f0b3f
mov byte [rdi + 0x14], 0
cmp rdi, 0xffffffffffffffeb
je 0x1400f0b3f
mov byte [rdi + 0x15], 0
cmp rdi, 0xffffffffffffffea
je 0x1400f0b3f
mov byte [rdi + 0x16], 0
cmp rdi, 0xffffffffffffffe9
je 0x1400f0b3f
mov rbx, rdi
add rbx, 0x18
mov byte [rdi + 0x17], 0
xor ebp, ebp
lea r8, [rsp + 0x4c]
lea rdx, [rsp + 0x50]
mov r13, rbx
mov r15d, dword [rsp + 0x4c]
mov r12, r13
sub r12, rdi
mov rax, r15
sub rax, r12
ja 0x1400f0b58
jb 0x1400f0c76
mov eax, dword [rsp + 0x4c]
mov r15, r8
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], eax
mov rcx, r14
mov r12, rdx
mov r8d, 1
mov r9, rdi
call sub.ntdll.dll_NtQueryValueKey
cmp eax, 0x80000005
je 0x1400f0b45
cmp eax, 0xc0000023
je 0x1400f0b45
test eax, eax
js 0x1400f0b41
mov eax, dword [rdi + 4]
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov r9d, dword [rdi + 0xc]
test r9, r9
je 0x1400f0b7a
mov edx, dword [rdi + 8]
add rdx, rdi
lea r8, [rdx + r9]
mov rcx, rsi
call fcn.14003a670
mov sil, 1
test rdi, rdi
je 0x1400f0c45
mov rax, r13
sub rax, rdi
dec r13
cmp rax, r13
jbe 0x1400f0c3d
ud2
xor esi, esi
jmp 0x1400f0b24
inc ebp
cmp ebp, 5
mov r8, r15
mov rdx, r12
jne 0x1400f0aa9
jmp 0x1400f0b41
mov rcx, rbx
sub rcx, r13
cmp rcx, rax
jb 0x1400f0b95
test r13, r13
je 0x1400f0b3f
mov byte [r13], 0
inc r13
dec rax
jne 0x1400f0b63
jmp 0x1400f0ac6
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov rdx, rcx
sub rdx, rax
dec rcx
cmp rdx, rcx
ja 0x1400f0b3f
mov qword [rsi + 8], rax
jmp 0x1400f0b21
mov qword [rsp + 0x38], rsi
sub rbx, rdi
lea rsi, [rbx + rbx]
cmp rsi, r15
cmovbe rsi, r15
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
movabs rax, 0x7fffffffffffffff
cmovae rsi, rax
mov rcx, rsi
call fcn.1401ef3e0
mov r13, rax
mov rcx, rax
mov rbx, rsi
add rbx, rax
mov rsi, r12
mov rax, r13
add rax, rsi
je 0x1400f0b3f
mov byte [rax], 0
inc rsi
cmp r15, rsi
jne 0x1400f0bda
cmp r12, 3
jne 0x1400f0c2d
mov al, byte [rdi + 2]
mov r15, rcx
mov byte [rcx + 2], al
movzx eax, word [rdi]
mov word [rcx], ax
add r13, rsi
test rdi, rdi
je 0x1400f0c16
mov rcx, rdi
call fcn.1401ef41c
mov rdi, r15
mov rsi, qword [rsp + 0x38]
lea r8, [rsp + 0x4c]
lea rdx, [rsp + 0x50]
jmp 0x1400f0ac6
mov r15, rcx
mov rdx, rdi
mov r8, r12
call fcn.1402357f0
jmp 0x1400f0c06
mov rcx, rdi
call fcn.1401ef41c
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401f08b0
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400efc70
test al, al
jne 0x1400f0918
xor esi, esi
jmp 0x1400f0c45
add r15, rdi
mov rax, r13
sub rax, r15
dec r13
cmp rax, r13
ja 0x1400f0b3f
mov rcx, rdx
mov r13, r15
mov rdx, rcx
jmp 0x1400f0ac6