Function at 0x14000c484
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xffe0]
mov eax, 0x100e0
call fcn.14001e900
sub rsp, rax
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x10118], rbx
mov qword [rsp + 0x10120], rsi
mov rax, qword [0x140042038]
xor rax, rsp
mov qword [rbp + 0xffd0], rax
mov rsi, rcx
mov qword [rbp - 0x40], rcx
xor r12d, r12d
mov word [rcx], r12w
lea rax, [0x1400376e0]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], r12
mov qword [rcx + 0x20], r12
mov byte [rcx + 0x28], r12b
mov qword [rcx + 0x30], rdx
mov qword [rcx + 0x38], r12
mov qword [rcx + 0x40], r12
mov dword [rcx + 0x48], r12d
mov qword [rcx + 0x50], r12
lea rcx, [0x140038788]
mov qword [rsi + 0x58], rcx
mov qword [rsi + 0x60], r12
mov qword [rsi + 0x68], r12
mov qword [rsi + 0x70], r12
lea rax, [0x1400376e8]
mov qword [rsi + 0x78], rax
mov qword [rsi + 0x80], r12
mov qword [rsi + 0x88], r12
mov qword [rsi + 0x90], r12
lea r15, [rsi + 0x98]
mov qword [r15], rcx
mov qword [r15 + 8], r12
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], r12
mov qword [rsi + 0xc0], r12
lea rax, [0x1400376e8]
mov qword [rsi + 0xc8], rax
mov qword [rsi + 0xd0], r12
mov qword [rsi + 0xd8], r12
mov qword [rsi + 0xe0], r12
mov dword [rsi + 0xe8], 0xb
lea rcx, [rsp + 0x40]
call fcn.140001834
nop
lea rcx, [rsp + 0x40]
call fcn.140011740
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.140011b04
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x78], rax
inc dword [rax]
lea rdx, str...Include
lea rcx, [rsp + 0x60]
call fcn.14000a610
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.140011894
lea rdx, [0x140037940]
lea rcx, [rsp + 0x60]
call fcn.14000a610
mov rcx, qword [rsp + 0x60]
call fcn.1400116d8
lea rcx, [rsp + 0x40]
cmp eax, 0xffffffff
je 0x14000c628
lea rdx, [rsp + 0x60]
call fcn.140003608
jmp 0x14000c634
lea rdx, str.Include_
call fcn.14000a610
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.14000abb4
lea rcx, [rbp - 0x80]
call fcn.140001834
nop
lea rcx, [rbp - 0x80]
call fcn.140001894
mov r14b, r12b
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SoftwareAutoIt_v3AutoIt
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000c84d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Include
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000c761
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140015f3c
mov rdi, rax
mov qword [rbp - 0x60], rax
mov ecx, 8
call fcn.140015f3c
mov rbx, rax
test rax, rax
je 0x14000c6fc
mov qword [rax], 1
mov qword [rbp - 0x58], rax
jmp 0x14000c703
mov rbx, r12
mov qword [rbp - 0x58], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Include
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000c74c
mov eax, dword [rsp + 0x30]
shr eax, 1
mov dword [rsp + 0x30], eax
mov word [rdi + rax*2], r12w
mov rdx, rdi
lea rcx, [rbp - 0x80]
call fcn.140001908
mov r14b, 1
dec qword [rbx]
jne 0x14000c761
mov rcx, rbx
call fcn.140015fa8
mov rcx, rdi
call fcn.140015fa8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14b, r14b
je 0x14000c84d
mov edi, r12d
mov word [rbp - 0x30], r12w
xor edx, edx
lea rcx, [rbp - 0x80]
call fcn.14000a4f4
mov rbx, r12
movzx ecx, word [rax]
mov word [rsp + 0x30], cx
mov word [rsp + 0x32], r12w
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.14000a4f4
cmp word [rax], r12w
je 0x14000c7cd
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.14000a4f4
cmp word [rax], 0x3b
je 0x14000c7cd
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x30]
call fcn.14001784c
jmp 0x14000c837
lea rcx, [rbp - 0x30]
call fcn.1400165e8
test rax, rax
je 0x14000c7fc
lea rcx, [rbp - 0x30]
call fcn.1400165e8
cmp word [rbp + rax*2 - 0x32], 0x5c
je 0x14000c7fc
lea rdx, [0x140037940]
lea rcx, [rbp - 0x30]
call fcn.14001784c
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x60]
call fcn.14000454c
nop
lea rdx, [rbp - 0x60]
mov rcx, r15
call fcn.14000abb4
nop
lea rcx, [rbp - 0x60]
call fcn.1400016b0
mov word [rbp - 0x30], r12w
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.14000a4f4
cmp word [rax], r12w
je 0x14000c84d
inc edi
movsxd rbx, edi
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.14000a4f4
jmp 0x14000c78b
lea rcx, [rbp - 0x80]
call fcn.1400016b0
nop
lea rcx, [rsp + 0x60]
call fcn.1400016b0
nop
lea rcx, [rsp + 0x40]
call fcn.1400016b0
nop
mov rax, rsi
mov rcx, qword [rbp + 0xffd0]
xor rcx, rsp
call fcn.140015ef0
lea r11, [rsp + 0x100e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret