Function at 0x140014140
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push r12
push r13
lea rbp, [rsp - 0x118]
sub rsp, 0x218
mov rax, qword [0x14022b078]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov eax, dword [0x14022bcfc]
xor ebx, ebx
mov r8, qword [0x140382358]
mov r12, rcx
lea r13d, [rax - 1]
test r8, r8
je 0x1400141af
mov rax, qword [0x140382328]
test rax, rax
je 0x1400141a2
test r8, r8
je 0x1400141a2
mov rcx, qword [0x140382328]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x14022bcfc]
mov qword [0x140382358], rbx
mov r8d, eax
mov rax, qword [0x140382328]
shl r8, 4
test rax, rax
je 0x1400141d7
mov rcx, qword [0x140382328]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [0x140382358], rbx
test rbx, rbx
je 0x14001460d
mov r8d, dword [0x14022bcfc]
xor edx, edx
shl r8, 4
mov rcx, rbx
mov qword [rsp + 0x248], rsi
call fcn.14015e120
movabs rax, 0x1c1b0de9bf1d0000
mov esi, 1
mov qword [rbx], rax
movabs rax, 0x1c1b0de9bf800000
mov qword [rbx + 8], rax
test r13d, r13d
jle 0x140014605
mov qword [rsp + 0x250], rdi
mov qword [rsp + 0x258], r14
lea r14d, [rsi + 0xf]
mov qword [rsp + 0x210], r15
mov r15d, esi
nop dword [rax]
xor edx, edx
mov dword [rsp + 0x30], VariantTimeToDosDateTime
lea rcx, [rbp - 0x30]
lea r8d, [rdx + 0x50]
call fcn.14015e120
movups xmm0, xmmword [str.MgLowerRange]
lea rdx, [0x1401d775c]
xor eax, eax
movsd xmm1, qword [0x1401d7730]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
mov r8d, esi
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
movzx eax, word [0x1401d7738]
mov word [rbp - 0x58], ax
xor eax, eax
mov qword [rbp - 0x56], rax
mov qword [rbp - 0x4e], rax
mov qword [rbp - 0x46], rax
mov qword [rbp - 0x3e], rax
mov word [rbp - 0x36], ax
movzx eax, word [0x1401d7758]
movups xmmword [rbp - 0x70], xmm0
mov word [rsp + 0x68], ax
xor eax, eax
movups xmm0, xmmword [str.MgUpperRange]
mov qword [rsp + 0x6a], rax
movsd qword [rbp - 0x60], xmm1
movsd xmm1, qword [0x1401d7750]
mov qword [rsp + 0x72], rax
mov qword [rsp + 0x7a], rax
mov qword [rbp - 0x7e], rax
mov word [rbp - 0x76], ax
movups xmmword [rsp + 0x50], xmm0
movsd qword [rsp + 0x60], xmm1
call fcn.1400153a0
lea rcx, [rbp - 0x70]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140014310
lea r8, [rsp + 0x38]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140014330
lea rcx, [rsp + 0x50]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140014350
lea r8, [rsp + 0x38]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140014370
lea rcx, [rsp + 0x50]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140014390
add eax, eax
lea r9, [rsp + 0x30]
mov dword [rsp + 0x34], eax
lea rdx, [rbp - 0x70]
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, r12
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400145da
cmp dword [rsp + 0x30], 1
jne 0x1400145da
xor edx, edx
lea r8d, [rax + 0x64]
lea rcx, [rbp + 0x20]
call fcn.14015e120
lea rax, [rbp - 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400143f5
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x20]
call fcn.14016c3e0
mov rdi, qword [0x140382358]
lea r11, [rbp + 0x20]
add rdi, r14
mov ebx, 7
mov qword [rdi], 0
nop word [rax + rax]
xor r9b, r9b
mov r10d, SafeArrayUnlock
xor r8d, r8d
nop dword [rax]
movzx ecx, byte [r11 + r8]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140014451
sub cl, 0x30
jmp 0x140014465
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x14001445d
sub cl, 0x37
jmp 0x140014465
cmp cl, 0x61
jl 0x14001448c
sub cl, 0x57
movzx edx, r10b
mov eax, r10d
movzx ecx, cl
inc r8
imul edx, ecx
add r9b, dl
cdq
and edx, 0xf
lea r10d, [rdx + rax]
sar r10d, 4
cmp r8, 2
jl 0x140014440
jmp 0x14001448f
xor r9b, r9b
mov byte [rbx + rdi], r9b
add r11, 2
dec rbx
cmp rbx, 1
jg 0x140014430
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rbp - 0x30]
mov rcx, r12
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400145c3
cmp dword [rsp + 0x30], 1
jne 0x1400145c3
xor edx, edx
lea r8d, [rax + 0x64]
lea rcx, [rbp + 0x90]
call fcn.14015e120
lea rax, [rbp - 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140014500
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x90]
call fcn.14016c3e0
mov rax, qword [0x140382358]
lea r11, [rbp + 0x90]
lea rdi, [rax + r14]
mov ebx, 7
mov qword [rdi + 8], 0
nop word [rax + rax]
xor r9b, r9b
mov r10d, SafeArrayUnlock
xor r8d, r8d
nop dword [rax]
movzx eax, byte [r11 + r8]
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x140014561
sub al, 0x30
jmp 0x140014573
lea ecx, [rax - 0x41]
cmp cl, 5
ja 0x14001456d
sub al, 0x37
jmp 0x140014573
cmp al, 0x61
jl 0x14001459a
sub al, 0x57
movzx ecx, al
inc r8
movzx edx, r10b
mov eax, r10d
imul edx, ecx
add r9b, dl
cdq
and edx, 0xf
add eax, edx
sar eax, 4
mov r10d, eax
cmp r8, 2
jl 0x140014550
jmp 0x14001459d
xor r9b, r9b
mov byte [rbx + rdi + 8], r9b
add r11, 2
dec rbx
cmp rbx, 1
jg 0x140014540
inc esi
inc r15
add r14, 0x10
cmp esi, r13d
jle 0x140014250
jmp 0x1400145ed
mov rax, qword [0x140382358]
add r15, r15
xor ebx, ebx
mov qword [rax + r15*8], rbx
mov qword [rax + r15*8 + 8], rbx
jmp 0x1400145ed
mov rax, qword [0x140382358]
movsxd rcx, esi
add rcx, rcx
xor ebx, ebx
mov qword [rax + rcx*8], rbx
mov r14, qword [rsp + 0x258]
mov rdi, qword [rsp + 0x250]
mov r15, qword [rsp + 0x210]
mov rsi, qword [rsp + 0x248]
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.14013f550
add rsp, 0x218
pop r13
pop r12
pop rbx
pop rbp
ret