Function at 0x140001104
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x78]
sub rsp, 0x178
mov rax, qword [0x14000a2a8]
xor rax, rsp
mov qword [rbp + 0x60], rax
xor ebx, ebx
mov qword [rsp + 0x60], rcx
mov rcx, r9
mov dword [rsp + 0x54], ebx
mov qword [rbp - 0x38], rbx
mov rsi, r9
mov qword [rbp - 0x68], rbx
mov r13d, r8d
mov qword [rbp - 0x60], rbx
mov r14, rdx
mov qword [rsp + 0x68], rbx
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x40], rbx
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x70], r8d
call fcn.1400029f0
mov qword [rbp - 0x50], rax
lea r12d, [rbx + 2]
mov qword [rbp - 0x48], rbx
mov edi, ebx
mov dword [rsp + 0x44], ebx
test rax, rax
je 0x140001192
cmp word [rax], bx
je 0x140001192
add rax, r12
inc edi
cmp word [rax], bx
jne 0x140001184
mov dword [rsp + 0x44], edi
test rsi, rsi
je 0x1400011b2
mov rax, qword [rsi + 0x20]
test rax, rax
je 0x1400011b2
mov r15d, ebx
jmp 0x1400011ab
add rax, r12
inc r15d
cmp word [rax], bx
jne 0x1400011a5
jmp 0x1400011b5
mov r15d, ebx
xor ecx, ecx
mov rax, r14
test r14, r14
je 0x1400011cf
cmp word [r14], cx
je 0x1400011cf
add rax, r12
inc ebx
cmp word [rax], cx
jne 0x1400011c5
mov qword [rsp + 0x78], rcx
mov edx, r13d
mov rcx, rsi
call fcn.1400019fc
mov dword [rbp - 0x78], eax
lea eax, [rdi + 0x104]
cmp eax, 0x104
jb 0x14000196c
add rax, 3
mov edx, 0xffffffff
cmp rax, rdx
ja 0x14000196c
lea ecx, [rax + r15]
cmp ecx, eax
jb 0x14000196c
mov eax, ecx
xor r13d, r13d
add rax, r12
cmp rax, rdx
ja 0x14000196f
mov eax, eax
add rax, rax
shr rax, 0x20
test eax, eax
jne 0x14000196f
lea eax, [r15 + rdi]
lea ecx, [rax + 0x108]
mov dword [rsp + 0x58], eax
mov eax, ebx
add rax, 7
mov dword [rsp + 0x4c], ecx
cmp rax, rdx
ja 0x14000196f
mov eax, eax
add rax, rax
shr rax, 0x20
test eax, eax
jne 0x14000196f
lea r13d, [rcx + 1]
xor ecx, ecx
mov edx, r13d
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
mov ecx, 0xffffffff
mov eax, dword [rsp + 0x4c]
inc rax
cmp rax, rcx
ja 0x140001900
mov eax, eax
xor ecx, ecx
add rax, rax
shr rax, 0x20
test eax, eax
jne 0x140001900
add ebx, 7
mov edx, ebx
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, r13d
xor ecx, ecx
add rdx, rdx
mov qword [rsp + 0x78], rax
mov dword [rbp - 0x74], r13d
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, qword [rsp + 0x78]
mov qword [rbp - 0x70], rax
test rcx, rcx
je 0x140001754
test rdi, rdi
je 0x140001754
test rax, rax
je 0x140001900
mov r8d, ebx
lea rdx, [0x140009850]
call fcn.140002b94
mov rcx, qword [rsp + 0x78]
mov r8d, ebx
mov rdx, r14
call fcn.140002b6c
mov rbx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
test eax, eax
jne 0x140001754
mov eax, dword [rsp + 0x70]
mov edx, 0xffffffff
cmp eax, edx
je 0x14000181a
cmp dword [rbp + 0xe0], ecx
je 0x14000181a
lea edx, [rcx + 4]
cmp eax, edx
jae 0x140001754
lea rax, [rax + rax*8]
lea rdx, str.WinWord
mov qword [rbp - 0x58], rax
mov rbx, qword [rdx + rax*8 + 8]
cmp word [rbx], cx
jne 0x140001395
mov rcx, qword [rsp + 0x68]
call fcn.140002804
mov qword [rbp - 0x48], rax
test rax, rax
je 0x140001754
mov rbx, rax
xor r9d, r9d
lea rdx, [fcn.140007a2c]
lea rcx, [rsp + 0x48]
lea r8d, [r9 + 0x10]
call sub.USER32.dll_DdeInitializeW
test eax, eax
jne 0x140001754
mov ecx, dword [rsp + 0x48]
mov r8d, 0x4b0
mov rdx, rbx
call sub.USER32.dll_DdeCreateStringHandleW
xor ebx, ebx
mov qword [rbp - 0x38], rax
test rax, rax
je 0x140001815
mov ecx, dword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rax
call sub.USER32.dll_DdeConnectList
mov qword [rbp - 0x68], rax
test rax, rax
je 0x140001815
mov rdx, qword [0x14000c1f8]
mov rcx, r14
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x60], 1
call fcn.140002b14
test eax, eax
je 0x140001449
mov rdx, qword [str.OpenAsReadOnly]
mov rcx, r14
call fcn.140002b14
test eax, eax
je 0x140001449
mov rdx, qword [rbp - 0x58]
lea rax, str.WinWord
mov r8d, r13d
mov rcx, rdi
mov rdx, qword [rax + rdx*8 + 0x28]
call fcn.140002b94
jmp 0x14000144c
mov word [rdi], bx
xor ecx, ecx
mov rax, rdi
cmp word [rdi], cx
je 0x140001460
add rax, r12
inc ebx
cmp word [rax], cx
jne 0x140001456
add ebx, ebx
mov dword [rsp + 0x40], ebx
cmp dword [rbp - 0x78], ecx
je 0x140001524
mov r8d, r13d
lea rdx, str._Activate___1___
mov rcx, rdi
call fcn.140002b94
mov ebx, 0x20
mov dword [rsp + 0x40], ebx
mov r14d, dword [rsp + 0x44]
xor r13d, r13d
test r15d, r15d
je 0x140001600
lea rdx, str.__1_
mov rcx, rdi
call fcn.140002cd8
mov r9, rax
test rax, rax
jne 0x1400014cd
lea rdx, [0x14000983c]
mov rcx, rdi
call fcn.140002cd8
mov r9, rax
test rax, rax
je 0x140001600
mov rcx, qword [rsi + 0x20]
cmp word [rcx], 0x22
jne 0x1400014e7
mov eax, r15d
cmp word [rcx + rax*2 - 2], 0x22
mov eax, 1
je 0x1400014ea
mov eax, r13d
cmp word [r9], 0x22
mov esi, 4
mov r8d, dword [rsp + 0x4c]
cmove r12d, esi
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
mov rcx, rdi
shr ebx, 1
mov edx, ebx
mov dword [rsp + 0x20], r12d
call fcn.140001a64
test eax, eax
je 0x140001757
jmp 0x1400015fa
test ebx, ebx
jne 0x14000148a
mov r14d, dword [rsp + 0x44]
mov r9d, 0x20019
mov rdx, qword [str.ddeexec]
xor r8d, r8d
mov rcx, qword [rsp + 0x68]
lea eax, [r14 + 0x104]
add eax, eax
mov dword [rsp + 0x40], eax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x1400015e2
cmp dword [rsp + 0x50], 1
mov rcx, qword [rbp - 0x60]
jne 0x140001575
mov byte [rdi], bl
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400015e2
test r15d, r15d
je 0x1400015f3
xor edx, edx
mov rcx, rdi
call fcn.140002c10
mov rbx, rax
test rax, rax
je 0x1400015d9
mov r8d, r13d
mov rdx, rax
mov rcx, rdi
call fcn.140002b6c
mov rcx, rbx
call fcn.140003310
mov eax, dword [rsp + 0x40]
lea ebx, [rax*2 - 2]
mov dword [rsp + 0x40], ebx
jmp 0x14000148f
mov ebx, dword [rsp + 0x40]
jmp 0x14000148f
mov ebx, dword [rsp + 0x40]
xor r13d, r13d
mov dword [rsp + 0x60], r13d
jmp 0x140001492
xor r13d, r13d
lea esi, [r13 + 4]
mov ebx, dword [rsp + 0x40]
jmp 0x140001605
mov esi, 4
lea rdx, str.__1_
mov rcx, rdi
call fcn.140002cd8
mov r9, rax
test rax, rax
jne 0x140001637
lea rdx, [0x14000983c]
mov rcx, rdi
call fcn.140002cd8
mov r9, rax
test rax, rax
je 0x140001757
cmp word [r9], 0x22
cmove r12d, esi
test ebx, ebx
jne 0x140001649
mov ecx, r13d
jmp 0x14000164d
mov ecx, ebx
shr ecx, 1
lea eax, [rcx + r15]
cmp eax, ecx
jb 0x140001757
mov r8, qword [rbp - 0x50]
mov rcx, rdi
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], r8
mov r8d, dword [rsp + 0x4c]
shr ebx, 1
mov dword [rsp + 0x20], r12d
lea edx, [r15 + rbx]
call fcn.140001a64
test eax, eax
je 0x140001757
cmp dword [rsp + 0x60], r13d
je 0x140001757
mov r13d, dword [rsp + 0x70]
mov eax, 0xbb8
mov r12, qword [rbp - 0x68]
cmp r13d, 1
mov esi, 0xffffffff
mov rcx, r12
cmove esi, eax
xor edx, edx
call sub.USER32.dll_DdeQueryNextServer
mov rbx, rax
test rax, rax
je 0x140001754
mov r15d, dword [rsp + 0x58]
mov ecx, 0xffffffff
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
cmp r15d, r14d
jb 0x140001754
lea rax, [r15 + 1]
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x140001754
mov ecx, eax
xor r8d, r8d
add rcx, rcx
mov rax, rcx
shr rax, 0x20
test eax, eax
jne 0x140001754
mov edx, dword [rsp + 0x40]
lea eax, [rcx + rdx]
cmp eax, ecx
jb 0x140001754
mov qword [rsp + 0x38], r8
lea edx, [rdx + r15*2]
mov dword [rsp + 0x30], esi
add edx, 2
mov dword [rsp + 0x28], 0x4050
xor r9d, r9d
mov dword [rsp + 0x20], r8d
mov rcx, rdi
mov r8, rbx
call sub.USER32.dll_DdeClientTransaction
mov qword [rbp - 0x40], rax
test rax, rax
jne 0x140001771
cmp r13d, 1
je 0x140001771
mov rdx, rbx
mov rcx, r12
call sub.USER32.dll_DdeQueryNextServer
mov rbx, rax
test rax, rax
jne 0x1400016c7
xor r13d, r13d
mov rbx, qword [rbp - 0x70]
test rbx, rbx
je 0x140001903
mov rcx, rbx
call fcn.140003310
jmp 0x140001903
mov rax, qword [rbp - 0x58]
lea rcx, str.WinWord
xor r13d, r13d
mov dword [rsp + 0x54], 1
cmp dword [rcx + rax*8 + 0x34], r13d
je 0x140001757
mov esi, 0x90
lea rcx, [rbp - 0x30]
mov r8d, esi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x30], esi
lea r8, [rbp - 0x30]
mov esi, 0xffffffff
mov rcx, rbx
mov edx, esi
call sub.USER32.dll_DdeQueryConvInfo
mov rbx, qword [rbp + 0x58]
mov rcx, rbx
jmp 0x1400017cf
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
jne 0x1400017c0
cmp qword [rbp + 0x58], r13
je 0x140001757
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1400017ff
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x140001757
mov rbx, qword [rsp + 0x60]
mov rdx, qword [0x14000c1f0]
lea rax, [rbp - 0x80]
mov rcx, qword [rsp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], 0x208
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r13d, r13d
test eax, eax
jne 0x140001757
cmp dword [rsp + 0x50], 1
mov rcx, qword [rbp - 0x80]
jne 0x14000185f
mov byte [rdi], r13b
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001757
lea rax, [rbp - 0x74]
mov r9, r14
mov qword [rsp + 0x28], rax
mov r8, rbx
mov rax, qword [rbp - 0x70]
mov edx, r12d
mov ecx, 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringByKeyW]
test eax, eax
js 0x140001757
test rsi, rsi
je 0x1400018bf
mov rcx, qword [rsi + 0x28]
jmp 0x1400018c2
mov rcx, r13
test rsi, rsi
je 0x1400018cd
mov rax, qword [rsi + 0x20]
jmp 0x1400018d0
mov rax, r13
mov r9d, dword [rsp + 0x44]
mov rdx, rdi
mov r8, qword [rbp - 0x50]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp - 0x70]
mov qword [rsp + 0x20], rax
call fcn.140001bbc
mov ecx, r13d
test eax, eax
setne cl
mov dword [rsp + 0x54], ecx
jmp 0x140001757
xor r13d, r13d
test rdi, rdi
je 0x140001910
mov rcx, rdi
call fcn.140003310
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x140001921
mov rcx, rax
call fcn.140003310
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x140001933
mov rcx, rax
call fcn.140003310
mov rax, qword [rbp - 0x40]
test rax, rax
je 0x140001944
mov rcx, rax
call sub.USER32.dll_DdeFreeDataHandle
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x140001959
mov ecx, dword [rsp + 0x48]
mov rdx, rax
call sub.USER32.dll_DdeFreeStringHandle
mov rax, qword [rbp - 0x68]
test rax, rax
je 0x14000196f
mov rcx, rax
call sub.USER32.dll_DdeDisconnectList
jmp 0x14000196f
xor r13d, r13d
mov ecx, dword [rsp + 0x48]
test ecx, ecx
je 0x14000197c
call sub.USER32.dll_DdeUninitialize
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14000198b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
mov qword [rbp - 0x80], r13
test rcx, rcx
je 0x14000199f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x60]
mov qword [rsp + 0x68], r13
test rcx, rcx
je 0x1400019b3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x54]
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140006dd0
add rsp, 0x178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret