Function at 0x140086b44
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp + 0x27], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rdi, rdx
mov dword [rbp - 0x39], 1
lea r15, fcn.140084fd0
mov qword [rbp - 0x41], r15
xor r14d, r14d
mov qword [rbp - 0x31], r14
mov byte [rbp - 0x29], 1
lea r8, [rbp - 0x31]
xor edx, edx
call fcn.14008699c
test eax, eax
je 0x140086bb5
mov qword [rbp - 0x41], r15
cmp byte [rbp - 0x29], r14b
je 0x140086bae
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140086bae
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
xor al, al
jmp 0x140086cf7
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140086b94
mov edx, dword [rbp + 0x7f]
inc edx
lea rcx, [rbp - 0x11]
call fcn.140087744
mov esi, r14d
mov rbx, qword [rbp - 0x11]
xor edx, edx
jmp 0x140086c48
test eax, eax
jne 0x140086d0e
mov eax, dword [rbp + 0x77]
mov dword [rbp - 0x21], eax
mov qword [rbp - 0x19], rbx
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x140086db2
mov rax, qword [rcx]
lea r8, [rbp - 0x21]
lea rdx, [rbp - 0x19]
mov rax, qword [rax + 0x10]
call qword [case.0x140118f85.0]
inc esi
mov edx, esi
mov eax, dword [rbp + 0x7f]
inc eax
mov qword [rsp + 0x38], r14
mov dword [rbp - 0x49], eax
mov qword [rsp + 0x30], r14
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov dword [rbp + 0x77], r14d
lea r9, [rbp - 0x49]
mov r8, rbx
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x140086c10
lea r9, str.Successfully_got_the_registry_values
mov edx, 0x3a7
mov ecx, 0x23ca345
mov r8d, 0x32
call fcn.140143574
test rbx, rbx
je 0x140086cdb
mov rcx, rbx
mov rax, qword [rbp - 1]
sub rax, rbx
sar rax, 1
add rax, rax
cmp rax, 0x1000
jb 0x140086cd2
mov rbx, qword [rbx - 8]
sub rcx, rbx
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140086da9
mov rcx, rbx
call fcn.140261814
nop
mov qword [rbp - 0x41], r15
cmp byte [rbp - 0x29], r14b
je 0x140086cf5
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140086cf5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov al, 1
mov rbx, qword [rsp + 0x110]
add rsp, 0xe0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1402b5a00]
mov qword [rbp + 7], rcx
lea rcx, str.RegEnumValue
mov qword [rbp + 0xf], rcx
cdqe
mov qword [rbp + 0x17], rax
mov word [rbp + 0x1f], r14w
lea rax, [rbp + 7]
mov qword [rsp + 0x28], rax
lea rax, str.RegEnumValue_did_not_return_an_expected_result
mov qword [rsp + 0x20], rax
mov edx, 0x3a7
mov ecx, 0x23ca344
mov r8d, 0xf
call fcn.140021310
test rbx, rbx
je 0x140086b94
mov rcx, rbx
mov rax, qword [rbp - 1]
sub rax, rbx
sar rax, 1
add rax, rax
cmp rax, 0x1000
jb 0x140086d8b
mov rbx, qword [rbx - 8]
sub rcx, rbx
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140086da0
mov rcx, rbx
call fcn.140261814
jmp 0x140086b94
call fcn.140261a5c
nop
jmp 0x140086da8
nop
call fcn.140261a5c
nop
jmp 0x140086db1
nop
call fcn.1401a5810
nop
jmp 0x140086dba
nop
nop