Function at 0x1400628c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1404680d8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r9
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x48], r15d
mov rdx, r8
cmp qword [r8 + 0x18], 8
jb 0x140062913
mov rdx, qword [r8]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
je 0x140062a29
cmp eax, 2
je 0x140062a19
lea rcx, [rsp + 0x50]
call fcn.1400e4560
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14006295d
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x1404784e0]
call fcn.14003fb60
lea rdx, str.d:jenkinsworkspace_a_mbam3_updaterexe_srcmbupdatr_registry.cpp
mov rcx, rax
call fcn.14002fb80
mov rcx, rax
lea rdx, [0x1403b9014]
call fcn.14002fb80
mov rcx, rax
mov edx, reloc.WS2_32.dll_recvfrom
call fcn.140026f80
mov rcx, rax
lea rdx, [0x1403b8034]
call fcn.14002fb80
mov rcx, rax
lea rdx, str.Failed_to_read_value_for
call fcn.14002fb80
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x1400629c3
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.14003fb60
lea rdx, [0x1403b8034]
mov rcx, rax
call fcn.14002fb80
mov rcx, rax
mov edx, esi
call fcn.140026f80
mov rbx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.14002bcc0
movzx edx, ax
mov rcx, rbx
call fcn.140056640
mov rcx, rbx
call fcn.14000bf70
nop
lea rcx, [rsp + 0x50]
call fcn.14000c340
mov rdx, r14
mov rcx, rdi
call fcn.1400256d0
jmp 0x140062bf1
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x140062be6
mov ecx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140283380
mov rsi, rax
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140062a62
mov rdx, qword [rbx]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, eax
test eax, eax
jne 0x140062b00
mov r8d, dword [rsp + 0x48]
shr r8, 1
dec r8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x1403e1a30]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r15w
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.14000d3a0
nop
mov rcx, rsi
call fcn.140282c34
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rdi + 0x10], xmm1
movdqa xmm0, xmmword [0x1403e1a30]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r15w
mov dword [rsp + 0x30], 1
lea rcx, [rsp + 0x50]
call fcn.14000c340
jmp 0x140062bf9
cmp ebp, 2
je 0x140062bde
lea rcx, [rsp + 0x50]
call fcn.1400e4560
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140062b22
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x1404784e0]
call fcn.14003fb60
lea rdx, str.d:jenkinsworkspace_a_mbam3_updaterexe_srcmbupdatr_registry.cpp
mov rcx, rax
call fcn.14002fb80
mov rcx, rax
lea rdx, [0x1403b9014]
call fcn.14002fb80
mov rcx, rax
mov edx, 0x21
call fcn.140026f80
mov rcx, rax
lea rdx, [0x1403b8034]
call fcn.14002fb80
mov rcx, rax
lea rdx, str.Failed_to_read_value_for
call fcn.14002fb80
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x140062b88
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.14003fb60
lea rdx, [0x1403b8034]
mov rcx, rax
call fcn.14002fb80
mov rcx, rax
mov edx, ebp
call fcn.140026f80
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14002bcc0
movzx edx, ax
mov rcx, rbx
call fcn.140056640
mov rcx, rbx
call fcn.14000bf70
nop
lea rcx, [rsp + 0x50]
call fcn.14000c340
mov rcx, rsi
call fcn.140282c34
mov rdx, r14
mov rcx, rdi
call fcn.1400256d0
mov dword [rsp + 0x30], 1
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140282c10
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret