Function at 0x14001a4b4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
xor r13d, r13d
mov rax, rcx
mov qword [r11 - 0x60], r13
lea rcx, [rbp - 0x18]
mov qword [r11 - 0x68], r13
mov rbx, r8
mov qword [r11 - 0x70], rcx
xor r9d, r9d
lea rcx, [rbp + 0x60]
mov dword [rbp + 0x50], r13d
mov qword [r11 - 0x78], rcx
xor r8d, r8d
lea rcx, [rbp + 0x50]
mov dword [rbp + 0x60], r13d
mov qword [r11 - 0x80], rcx
xor edx, edx
mov qword [rsp + 0x30], r13
mov rcx, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov dword [rbp - 0x18], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14001a5b3
test rbx, rbx
je 0x14001a5b3
or rsi, 0xffffffffffffffff
mov ebx, r13d
mov edi, r13d
cmp dword [rbp + 0x50], r13d
jbe 0x14001a6e7
mov ecx, dword [rbp + 0x60]
lea eax, [rsi + 3]
inc ecx
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.14003c310
mov rbx, rax
test rax, rax
je 0x14001a5b3
mov r13d, dword [rbp - 0x18]
lea rcx, [r13 + 2]
call qword [sym.imp.msvcrt.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14001a6d6
mov r15d, dword [rbp + 0x50]
lea r12d, [r15 + 1]
shl r12, 2
mov rcx, r12
call qword [sym.imp.msvcrt.dll_malloc]
mov r14, rax
test rax, rax
jne 0x14001a5c6
mov rcx, rbx
call fcn.14003c2b8
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
xor eax, eax
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r8, r12
mov edx, 0xff
mov rcx, r14
call sub.msvcrt.dll_memset
test r15d, r15d
je 0x14001a69a
lea r12, [r14 + r15*4]
mov eax, dword [rbp + 0x60]
lea edx, [r15 - 1]
mov rcx, qword [rbp + 0x48]
lea r9, [rbp - 0x10]
inc eax
mov r8, rbx
mov dword [rbp - 0x10], eax
lea eax, [r13 + 2]
mov dword [rbp - 0x14], eax
xor r13d, r13d
lea rax, [rbp - 0x14]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0xc]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x14001a69a
lea r8d, [r13 + 4]
mov rcx, rbx
lea rdx, str.WMC_
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x14001a66d
mov eax, dword [rbp - 0xc]
dec eax
cmp eax, 1
ja 0x14001a65d
mov rdx, qword [rbp + 0x58]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14001a680
lea rcx, [rbx + 8]
call qword [sym.imp.msvcrt.dll__wtoi]
mov edi, eax
mov dword [r12], eax
sub r12, 4
add r15d, 0xffffffff
je 0x14001a69a
mov r13d, dword [rbp - 0x18]
jmp 0x14001a5e3
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_free]
mov rax, rbx
jmp 0x14001a5b5
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov edx, dword [rbp + 0x50]
mov ecx, 1
cmp edx, ecx
jb 0x14001a6c5
mov eax, ecx
cmp dword [r14 + rax*4], edi
je 0x14001a6bd
inc ecx
cmp ecx, edx
jbe 0x14001a6af
cmp ecx, edx
ja 0x14001a6c5
inc edi
jmp 0x14001a6a6
mov rcx, r14
call qword [sym.imp.msvcrt.dll_free]
cmp edi, 0x1869f
jle 0x14001a6e3
mov rcx, rbx
call fcn.14003c2b8
jmp 0x14001a5b3
or rsi, 0xffffffffffffffff
cmp dword [rbp + 0x60], 0xe
mov ecx, 8
mov dword [rbp + 0x50], ecx
jae 0x14001a72d
test rbx, rbx
je 0x14001a705
mov rcx, rbx
call fcn.14003c2b8
mov ecx, dword [rbp + 0x50]
lea edx, [rcx + 6]
mov eax, 2
mul rdx
cmovo rax, rsi
mov rcx, rax
call fcn.14003c310
mov rbx, rax
test rax, rax
je 0x14001a5b3
mov ecx, dword [rbp + 0x50]
jmp 0x14001a736
test rbx, rbx
je 0x14001a692
mov r8d, ecx
lea rdx, str.WMC_
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov eax, dword [rbp + 0x50]
mov r8d, 0xa
shr rax, 1
mov ecx, edi
lea rdx, [rbx + rax*2]
call qword [sym.imp.msvcrt.dll__itow]
jmp 0x14001a692