Function at 0x140004310
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xe0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov qword [rbp + 0x30], r9
mov qword [rbp + 0x38], r8
mov qword [rbp + 0x40], rdx
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], rcx
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004370
jmp 0x140005002
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x38]
mov r10, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x48]
mov eax, 0x10
mov qword [rbp + 8], rax
call fcn.1400456e0
sub rsp, rax
mov rax, qword [rbp + 8]
mov r11, rsp
call fcn.1400456e0
sub rsp, rax
mov rax, qword [rbp + 8]
mov r9, rsp
mov qword [rbp - 0x20], r9
call fcn.1400456e0
sub rsp, rax
mov rax, qword [rbp + 8]
mov rcx, rsp
mov qword [rbp + 0x18], rcx
call fcn.1400456e0
sub rsp, rax
mov rax, qword [rbp + 8]
mov rcx, rsp
mov qword [rbp - 0x18], rcx
call fcn.1400456e0
sub rsp, rax
mov rax, qword [rbp + 8]
mov rdi, rsp
mov qword [rbp - 0x10], rdi
call fcn.1400456e0
sub rsp, rax
mov rax, qword [rbp + 8]
mov rdi, rsp
mov qword [rbp - 8], rdi
call fcn.1400456e0
sub rsp, rax
mov rax, qword [rbp + 8]
mov rdi, rsp
mov qword [rbp], rdi
call fcn.1400456e0
sub rsp, rax
mov rax, qword [rbp + 8]
mov rdi, rsp
mov qword [rbp + 0x10], rdi
call fcn.1400456e0
sub rsp, rax
mov rax, qword [rbp + 0x18]
mov rdi, rsp
mov qword [rbp + 0x20], rdi
mov qword [r11], rsi
mov qword [r9], r10
mov qword [rax], r8
mov qword [rcx], rdx
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.140008310
add rsp, 0x20
mov qword [rbp + 0x28], rax
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004482
jmp 0x140005002
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400044b4
jmp 0x14000507c
mov rax, qword [rbp - 0x10]
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp - 0x18]
mov rcx, qword [rcx]
xor r8d, r8d
mov r9d, 0x20019
sub rsp, 0x30
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add rsp, 0x30
cmp eax, 0
sete al
mov byte [rbp - 0x21], al
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000451a
jmp 0x14000507c
mov al, byte [rbp - 0x21]
test al, 1
jne 0x14000452a
jmp 0x140004ead
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.140008310
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x38], rcx
mov rax, qword [rax]
mov qword [rbp - 0x30], rax
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004582
jmp 0x1400050ac
mov rax, qword [rbp]
mov r9, qword [rbp - 8]
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
xor r8d, r8d
sub rsp, 0x30
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add rsp, 0x30
cmp eax, 0
sete al
mov byte [rbp - 0x39], al
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400045ec
jmp 0x1400050ac
mov al, byte [rbp - 0x39]
test al, 1
jne 0x1400045fc
jmp 0x140004e2f
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000462e
jmp 0x1400050e0
mov rax, qword [rbp - 8]
cmp dword [rax], 1
sete al
mov byte [rbp - 0x3a], al
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000466d
jmp 0x1400050e0
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000469f
jmp 0x1400050e5
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400046d1
jmp 0x1400050e5
mov al, byte [rbp - 0x3a]
test al, 1
jne 0x1400046e1
jmp 0x140004dc6
mov rcx, qword [rbp + 0x48]
mov rax, qword [rbp]
mov rdx, qword [rbp + 0x10]
mov byte [rdx], 0
mov eax, dword [rax]
mov edx, eax
xor r8d, r8d
sub rsp, 0x20
call fcn.1400085c0
mov rcx, qword [rbp + 0x48]
add rsp, 0x20
xor eax, eax
mov edx, eax
sub rsp, 0x20
call fcn.140008860
add rsp, 0x20
mov qword [rbp - 0x48], rax
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000474f
jmp 0x1400050ea
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.140008310
mov rcx, qword [rbp - 0x10]
mov r10, qword [rbp - 0x48]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp]
mov rcx, qword [rcx]
xor r8d, r8d
mov r9d, r8d
sub rsp, 0x30
mov r8, r9
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add rsp, 0x30
cmp eax, 0
sete al
mov byte [rbp - 0x49], al
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400047d1
jmp 0x1400050ea
mov al, byte [rbp - 0x49]
test al, 1
jne 0x1400047e1
jmp 0x140004976
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004813
jmp 0x140005136
mov rax, qword [rbp]
mov eax, dword [rax]
add eax, 0x43df3beb
sub eax, 1
sub eax, 0x43df3beb
mov dword [rbp - 0x50], eax
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000485b
jmp 0x140005136
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000488d
jmp 0x14000513b
mov eax, dword [rbp - 0x50]
mov eax, eax
mov qword [rbp - 0x58], rax
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400048c8
jmp 0x14000513b
mov rdx, qword [rbp - 0x58]
mov rcx, qword [rbp + 0x48]
sub rsp, 0x20
xor eax, eax
mov r8b, al
call fcn.140008a90
add rsp, 0x20
jmp 0x1400048e7
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004919
jmp 0x140005140
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x20
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004960
jmp 0x140005140
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x10]
mov byte [rcx], 1
mov dword [rax], 1
jmp 0x140004a4d
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400049a8
jmp 0x14000515a
mov rax, qword [rbp + 0x20]
mov dword [rax], 0
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400049e4
jmp 0x14000515a
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004a16
jmp 0x140005169
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004a48
jmp 0x140005169
jmp 0x140004a4d
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004a7f
jmp 0x14000516e
mov rax, qword [rbp + 0x10]
mov al, byte [rax]
mov byte [rbp - 0x59], al
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004aba
jmp 0x14000516e
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004aec
jmp 0x140005173
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004b1e
jmp 0x140005173
mov al, byte [rbp - 0x59]
test al, 1
jne 0x140004c0c
jmp 0x140004b2e
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004b60
jmp 0x140005178
mov rcx, qword [rbp + 0x48]
sub rsp, 0x20
call fcn.1400069b0
add rsp, 0x20
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004ba3
jmp 0x140005178
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004bd5
jmp 0x14000518e
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004c07
jmp 0x14000518e
jmp 0x140004c0c
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004c3e
jmp 0x140005193
mov rax, qword [rbp + 0x20]
mov eax, dword [rax]
mov dword [rbp - 0x60], eax
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004c79
jmp 0x140005193
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004cab
jmp 0x140005198
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004cdd
jmp 0x140005198
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004d0f
jmp 0x14000519d
mov eax, dword [rbp - 0x60]
cmp eax, 1
sete al
mov byte [rbp - 0x61], al
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004d4d
jmp 0x14000519d
mov al, byte [rbp - 0x61]
test al, 1
jne 0x140004f92
jmp 0x140004d5d
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004d8f
jmp 0x1400051a2
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004dc1
jmp 0x1400051a2
jmp 0x140004dc6
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004df8
jmp 0x1400051a7
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004e2a
jmp 0x1400051a7
jmp 0x140004e2f
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x20
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004e76
jmp 0x1400051ac
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004ea8
jmp 0x1400051ac
jmp 0x140004ead
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004edf
jmp 0x1400051b1
mov rcx, qword [rbp + 0x48]
lea rdx, [0x140047a4c]
sub rsp, 0x20
call fcn.1400092d0
add rsp, 0x20
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004f29
jmp 0x1400051b1
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004f5b
jmp 0x1400051ce
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004f8d
jmp 0x1400051ce
jmp 0x140004f92
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004fc4
jmp 0x1400051d3
mov eax, dword [0x14004a33c]
mov ecx, dword [0x14004a340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004ff6
jmp 0x1400051d3
mov rax, qword [rbp + 0x50]
lea rsp, [rbp + 0x60]
pop rdi
pop rsi
pop rbp
ret
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x38]
mov r10, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x48]
mov eax, 0x10
mov qword [rbp - 0x78], rax
call fcn.1400456e0
sub rsp, rax
mov rax, qword [rbp - 0x78]
mov r11, rsp
call fcn.1400456e0
sub rsp, rax
mov rax, qword [rbp - 0x78]
mov r9, rsp
call fcn.1400456e0
sub rsp, rax
mov rax, qword [rbp - 0x78]
mov rcx, rsp
mov qword [rbp - 0x70], rcx
call fcn.1400456e0
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov rcx, rsp
mov qword [r11], rsi
mov qword [r9], r10
mov qword [rax], r8
mov qword [rcx], rdx
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.140008310
add rsp, 0x20
jmp 0x140004370
mov rax, qword [rbp - 0x10]
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp - 0x18]
mov rcx, qword [rcx]
xor r8d, r8d
mov r9d, 0x20019
sub rsp, 0x30
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add rsp, 0x30
jmp 0x1400044b4
mov rax, qword [rbp]
mov r9, qword [rbp - 8]
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
xor r8d, r8d
sub rsp, 0x30
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add rsp, 0x30
jmp 0x140004582
jmp 0x14000462e
jmp 0x14000469f
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.140008310
mov rcx, qword [rbp - 0x10]
mov r10, qword [rbp - 0x48]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp]
mov rcx, qword [rcx]
xor r8d, r8d
mov r9d, r8d
sub rsp, 0x30
mov r8, r9
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add rsp, 0x30
jmp 0x14000474f
jmp 0x140004813
jmp 0x14000488d
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x20
jmp 0x140004919
mov rax, qword [rbp + 0x20]
mov dword [rax], 0
jmp 0x1400049a8
jmp 0x140004a16
jmp 0x140004a7f
jmp 0x140004aec
mov rcx, qword [rbp + 0x48]
sub rsp, 0x20
call fcn.1400069b0
add rsp, 0x20
jmp 0x140004b60
jmp 0x140004bd5
jmp 0x140004c3e
jmp 0x140004cab
jmp 0x140004d0f
jmp 0x140004d8f
jmp 0x140004df8
jmp 0x140004e76
mov rcx, qword [rbp + 0x48]
lea rdx, [0x140047a4c]
sub rsp, 0x20
call fcn.1400092d0
add rsp, 0x20
jmp 0x140004edf
jmp 0x140004f5b
jmp 0x140004fc4