Function at 0x1400bc4fc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
lea r14, [0x140106190]
mov rcx, qword [0x140106190]
cmp rcx, r14
je 0x1400bc557
test byte [rcx + 0x1c], 1
je 0x1400bc557
cmp byte [rcx + 0x19], 5
jb 0x1400bc557
mov edx, 0x1d
lea r8, [0x1400e7b90]
mov rcx, qword [rcx + 0x10]
call fcn.140003574
xor r12d, r12d
cmp qword [rsi], r12
je 0x1400bc58a
mov ebx, r12d
cmp dword [rsi + 8], r12d
jle 0x1400bc57e
movsxd rcx, ebx
shl rcx, 5
add rcx, qword [rsi]
call fcn.140042cf8
inc ebx
cmp ebx, dword [rsi + 8]
jl 0x1400bc568
mov rcx, qword [rsi]
call qword [sym.imp.msvcrt.dll_free]
mov qword [rsi], r12
mov qword [rsi + 8], r12
mov ebx, 0x54f
mov rdx, qword [rdi + 8]
cmp dword [rdx - 0x10], r12d
je 0x1400bcad4
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], r12
lea rcx, [rbp - 0x29]
call fcn.1400bd414
mov ebx, eax
mov r13d, 4
mov rcx, qword [0x140106190]
cmp rcx, r14
je 0x1400bc5ed
test byte [rcx + 0x1c], 2
je 0x1400bc5ed
cmp byte [rcx + 0x19], r13b
jb 0x1400bc5ed
lea edx, [r13 + 0x1a]
mov r9d, eax
lea r8, [0x1400e7b90]
mov rcx, qword [rcx + 0x10]
call fcn.140003634
mov qword [rbp - 0x61], r12
mov qword [rbp - 0x59], r12
test ebx, ebx
jne 0x1400bcabb
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x29]
call fcn.1400b3638
mov ebx, eax
mov rcx, qword [0x140106190]
cmp rcx, r14
je 0x1400bc63c
test byte [rcx + 0x1c], 2
je 0x1400bc63c
cmp byte [rcx + 0x19], r13b
jb 0x1400bc63c
mov edx, 0x1f
mov r9d, eax
lea r8, [0x1400e7b90]
mov rcx, qword [rcx + 0x10]
call fcn.140003634
test ebx, ebx
jne 0x1400bcabb
mov r14d, r12d
mov eax, dword [rbp - 0x59]
test eax, eax
jle 0x1400bcab4
mov r15, r12
mov rdi, r12
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x41], r12
mov qword [rbp - 0x39], r12
test r15, r15
js 0x1400bcaa9
cmp r14d, eax
jge 0x1400bcaa9
mov rax, qword [rbp - 0x61]
mov qword [rbp - 0x31], r12
lea rcx, [rbp - 0x31]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20119
xor r8d, r8d
mov rdx, qword [rax + r15]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400bc6af
mov ebx, r12d
mov rdi, qword [rbp - 0x31]
mov qword [rbp - 0x49], rdi
mov rcx, qword [0x140106190]
lea rax, [0x140106190]
cmp rcx, rax
je 0x1400bc6e6
test byte [rcx + 0x1c], 2
je 0x1400bc6e6
cmp byte [rcx + 0x19], r13b
jb 0x1400bc6e6
mov edx, 0x20
mov r9d, ebx
lea r8, [0x1400e7b90]
mov rcx, qword [rcx + 0x10]
call fcn.140003634
test ebx, ebx
jne 0x1400bca15
mov rax, qword [0x140108fd0]
lea rbx, [0x140108fd0]
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [case.0x14006e230.0]
add rax, 0x18
mov qword [rbp - 0x51], rax
mov rax, qword [0x140108fd0]
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [case.0x14006e230.0]
add rax, 0x18
mov qword [rbp - 0x69], rax
mov rax, qword [0x140108fd0]
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [case.0x14006e230.0]
add rax, 0x18
mov qword [rbp + 0x7f], rax
mov dword [rbp + 0x67], r13d
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f]
xor r8d, r8d
lea rdx, str.Reason
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1400bc789
mov eax, dword [rbp + 0x6f]
sub eax, r13d
neg eax
sbb ebx, ebx
and ebx, 0xd
mov rcx, qword [0x140106190]
lea rdi, [0x140106190]
cmp rcx, rdi
je 0x1400bc7c0
test byte [rcx + 0x1c], 2
je 0x1400bc7c0
cmp byte [rcx + 0x19], r13b
jb 0x1400bc7c0
mov edx, 0x21
mov r9d, ebx
lea r8, [0x1400e7b90]
mov rcx, qword [rcx + 0x10]
call fcn.140003634
test ebx, ebx
jne 0x1400bc8a6
lea r8, [rbp - 0x51]
lea rdx, [0x1400e7b58]
lea rcx, [rbp - 0x49]
call fcn.1400b3940
mov ebx, eax
mov rcx, qword [0x140106190]
cmp rcx, rdi
je 0x1400bc80e
test byte [rcx + 0x1c], 2
je 0x1400bc80e
cmp byte [rcx + 0x19], r13b
jb 0x1400bc80e
mov edx, 0x22
mov r9d, eax
lea r8, [0x1400e7b90]
mov rcx, qword [rcx + 0x10]
call fcn.140003634
test ebx, ebx
jne 0x1400bc8a6
lea r8, [rbp - 0x69]
lea rdx, [0x1400e7b60]
lea rcx, [rbp - 0x49]
call fcn.1400b3940
mov ebx, eax
mov rcx, qword [0x140106190]
cmp rcx, rdi
je 0x1400bc85c
test byte [rcx + 0x1c], 2
je 0x1400bc85c
cmp byte [rcx + 0x19], r13b
jb 0x1400bc85c
mov edx, 0x23
mov r9d, eax
lea r8, [0x1400e7b90]
mov rcx, qword [rcx + 0x10]
call fcn.140003634
test ebx, ebx
jne 0x1400bc8a6
lea r8, [rbp + 0x7f]
lea rdx, str.Scope
lea rcx, [rbp - 0x49]
call fcn.1400b3940
mov ebx, eax
mov rcx, qword [0x140106190]
cmp rcx, rdi
je 0x1400bc8a6
test byte [rcx + 0x1c], 2
je 0x1400bc8a6
cmp byte [rcx + 0x19], r13b
jb 0x1400bc8a6
mov edx, 0x24
mov r9d, eax
lea r8, [0x1400e7b90]
mov rcx, qword [rcx + 0x10]
call fcn.140003634
lea rdx, str.ignored
mov rcx, qword [rbp - 0x69]
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1400bc8f0
lea rcx, [rbp - 0x69]
call fcn.140004d3c
mov rcx, qword [0x140106190]
cmp rcx, rdi
je 0x1400bc8f0
test byte [rcx + 0x1c], 2
je 0x1400bc8f0
cmp byte [rcx + 0x19], r13b
jb 0x1400bc8f0
mov edx, 0x25
lea r8, [0x1400e7b90]
mov rcx, qword [rcx + 0x10]
call fcn.140003574
lea rdx, str.ignored
mov rcx, qword [rbp + 0x7f]
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1400bc93a
lea rcx, [rbp + 0x7f]
call fcn.140004d3c
mov rcx, qword [0x140106190]
cmp rcx, rdi
je 0x1400bc93a
test byte [rcx + 0x1c], 2
je 0x1400bc93a
cmp byte [rcx + 0x19], r13b
jb 0x1400bc93a
mov edx, 0x26
lea r8, [0x1400e7b90]
mov rcx, qword [rcx + 0x10]
call fcn.140003574
test ebx, ebx
jne 0x1400bc99d
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x69]
mov r8, qword [rbp - 0x51]
mov edx, dword [rbp + 0x77]
lea rcx, [rbp - 9]
call fcn.1400bbcdc
nop
mov rdx, rax
mov rcx, rsi
call fcn.1400bd650
nop
lea rcx, [rbp - 9]
call fcn.140042cf8
mov rcx, qword [0x140106190]
cmp rcx, rdi
je 0x1400bc99d
test byte [rcx + 0x1c], 2
je 0x1400bc99d
cmp byte [rcx + 0x19], r13b
jb 0x1400bc99d
lea edx, [rbx + 0x27]
lea r8, [0x1400e7b90]
mov rcx, qword [rcx + 0x10]
call fcn.140003574
nop
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400bc9c6
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006e230.0]
nop
mov rdx, qword [rbp - 0x69]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400bc9ec
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006e230.0]
nop
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400bca11
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006e230.0]
mov rdi, qword [rbp - 0x49]
test rdi, rdi
je 0x1400bca2a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r12
mov qword [rbp - 0x49], r12
cmp r14d, dword [rbp - 0x59]
jge 0x1400bca9e
mov rdx, qword [rbp - 0x61]
mov rdx, qword [rdx + r15]
lea rcx, [rbp - 0x29]
call fcn.1400b3b90
mov ebx, eax
mov rcx, qword [0x140106190]
lea rax, [0x140106190]
cmp rcx, rax
je 0x1400bca7b
test byte [rcx + 0x1c], 2
je 0x1400bca7b
cmp byte [rcx + 0x19], r13b
jb 0x1400bca7b
mov edx, 0x28
mov r9d, ebx
lea r8, [0x1400e7b90]
mov rcx, qword [rcx + 0x10]
call fcn.140003634
nop
test rdi, rdi
je 0x1400bca89
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r14d
add r15, 8
mov eax, dword [rbp - 0x59]
cmp r14d, eax
jl 0x1400bc655
jmp 0x1400bcab4
mov ecx, 0xc000008c
call fcn.140005064
int3
mov ecx, 0xc000008c
call fcn.140005064
nop
lea r14, [0x140106190]
lea rcx, [rbp - 0x61]
call fcn.1400185e8
nop
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x1400bcad4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x140106190]
cmp rcx, r14
je 0x1400bcb14
test byte [rcx + 0x1c], 1
je 0x1400bcb14
movzx r9d, byte [rcx + 0x19]
mov eax, ebx
neg eax
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp r9d, edx
jl 0x1400bcb14
mov edx, 0x29
mov r9d, ebx
lea r8, [0x1400e7b90]
mov rcx, qword [rcx + 0x10]
call fcn.140003634
mov eax, ebx
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret