Function at 0x1400a2b40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rbx, qword [0x140103f30]
mov r15, r9
mov r14, r8
mov byte [rsp + 0x20], 1
mov rsi, rdx
mov r12, rcx
mov rdi, 0xffffffffffffffff
mov rcx, rbx
mov r8, rdi
xor r9d, r9d
xor edx, edx
call fcn.1400afca0
test rsi, rsi
jne 0x1400a2bcf
mov esi, 0x57
mov ecx, esi
mov rax, qword [0x1400fe060]
test esi, esi
setne dl
mov dword [rax + 0x40], ecx
mov rcx, r12
call fcn.140046680
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rax, qword [0x1400fe060]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
mov r9d, dword [rax + 0x110]
lea rax, [rbp - 0x38]
or r9d, 0x20019
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x1400a2cb2
mov rcx, qword [rbp - 0x38]
lea r9, [rbp - 0x40]
xor r13d, r13d
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov rdx, r15
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x1400a2ca8
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x1400a2c54
cmp eax, 2
jbe 0x1400a2e17
cmp eax, 3
je 0x1400a2cc8
cmp eax, 4
je 0x1400a2c68
cmp eax, 7
je 0x1400a2e17
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x65e
jmp 0x1400a2b98
mov rcx, qword [rbp - 0x38]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp - 0x3c]
mov dword [rbp + 0x38], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x1400a2ca8
mov edx, dword [rbp - 0x3c]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1400014c0
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0xffffffff
jne 0x1400a2b98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1400a2b9a
mov rcx, qword [rbp - 0x38]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov rdx, r15
mov dword [rbp + 0x38], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x1400a2ca8
mov eax, dword [rbp + 0x38]
test eax, eax
je 0x1400a2ca8
lea r8d, [rax + rax]
mov byte [rsp + 0x20], 1
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call fcn.1400afca0
cmp eax, 1
jne 0x1400a2e6e
xor r8d, r8d
mov edx, eax
mov rcx, rbx
call fcn.1400016b0
mov r14, rax
xor r9d, r9d
xor r8d, r8d
mov word [rax], r13w
mov edx, dword [rbp + 0x38]
mov rcx, qword [rbp - 0x38]
lea edi, [rdx + rdx]
add rdi, rdi
sub rdi, rdx
mov rdx, r15
add rdi, rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x38]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1400a2cb2
mov r9d, r13d
movzx eax, word [0x1400ec340]
mov r8d, r13d
mov word [rbp - 0x10], ax
movups xmm0, xmmword [str.0123456789ABCDEF]
movups xmm1, xmmword [0x1400ec330]
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm1
cmp dword [rbp + 0x38], r13d
jbe 0x1400a2dd4
mov rdx, r14
mov eax, r8d
lea rdx, [rdx + 4]
add r9d, 2
inc r8d
movzx ecx, byte [rax + rdi]
mov eax, ecx
shr rcx, 4
and eax, 0xf
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rdx - 2], ax
movzx eax, word [rbp + rcx*2 - 0x30]
mov word [rdx - 4], ax
cmp r8d, dword [rbp + 0x38]
jb 0x1400a2da1
movsxd rax, r9d
mov word [r14 + rax*2], r13w
cmp byte [rbx + 0x23], r13b
jne 0x1400a2de6
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 2
jne 0x1400a2e0e
cmp qword [0x140105dd8], r13
je 0x1400a2e0e
lea rcx, [0x140105dc0]
call fcn.140005fa0
test eax, eax
jne 0x1400a2b98
jmp 0x1400a2bb1
and byte [rbx + 0x21], 0x86
jmp 0x1400a2b98
mov rcx, qword [rbp - 0x38]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov rdx, r15
mov dword [rbp + 0x38], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x1400a2ca8
mov eax, dword [rbp + 0x38]
test eax, eax
je 0x1400a2ca8
shr eax, 1
xor r9d, r9d
xor edx, edx
mov byte [rsp + 0x20], 1
mov rcx, rbx
lea r8d, [rax + 2]
call fcn.1400afca0
cmp eax, 1
je 0x1400a2e7f
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400a2bb1
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.1400016b0
mov rcx, qword [rbp - 0x38]
mov r14, rax
lea rax, [rbp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x38]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1400a2efa
mov edx, dword [rbp + 0x38]
test edx, edx
je 0x1400a2efa
shr edx, 1
lea eax, [rdx + 1]
mov word [r14 + rdx*2], r13w
mov word [r14 + rax*2], r13w
cmp dword [rbp - 0x40], 7
jne 0x1400a2f00
mov rax, r14
lea ecx, [rsi + 0xa]
cmp word [rax], r13w
jne 0x1400a2ef4
mov word [rax], cx
cmp word [rax + 2], r13w
je 0x1400a2f00
add rax, 2
jmp 0x1400a2ee4
mov word [r14], r13w
nop
cmp word [r14 + rdi*2 + 2], r13w
lea rdi, [rdi + 1]
jne 0x1400a2f00
cmp byte [rbx + 0x23], r13b
jne 0x1400a2f18
mov r14, qword [rbx + 0x10]
jmp 0x1400a2f1b
mov r14, rbx
cmp byte [r14 + 0x23], 1
jne 0x1400a2f37
test byte [r14 + 0x21], 8
je 0x1400a2f31
mov rcx, r14
call fcn.140001560
add r14, 0x10
jmp 0x1400a2f3e
lea r14, [0x140107728]
lea rax, [rdi + rdi]
mov qword [r14], rax
cmp byte [rbx + 0x23], r13b
jne 0x1400a2f4f
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 2
jne 0x1400a2f77
cmp qword [0x140105dd8], r13
je 0x1400a2f77
lea rcx, [0x140105dc0]
call fcn.140005fa0
test eax, eax
jne 0x1400a2cb2
jmp 0x1400a2bb1
and byte [rbx + 0x21], 0x86
jmp 0x1400a2cb2