Function at 0x140045480
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400f4080]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor r15d, r15d
mov qword [rsp + 0x58], r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 1]
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140045857
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x70]
call fcn.140088180
mov dword [rsp + 0x60], 0x208
mov dword [rsp + 0x64], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
xor r8d, r8d
lea rdx, [0x1400d4880]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004584c
movdqa xmm0, xmmword [0x1400d6210]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r15w
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x68]
call fcn.140003dc0
nop
lea r9, [rsp + 0x68]
mov r8, qword [rsp + 0x68]
mov r10, qword [rbp - 0x80]
cmp r10, 8
cmovae r9, r8
lea r12, [r15 - 1]
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x1400455c5
mov rcx, rax
mov rdx, r9
mov ebx, r15d
cmp word [r9], 0x2e
je 0x1400455b5
cmp rcx, 1
je 0x1400455b8
dec rcx
add rdx, 2
cmp word [rdx], 0x2e
jne 0x1400455a2
mov rbx, rdx
test rbx, rbx
je 0x1400455c5
sub rbx, r9
sar rbx, 1
jmp 0x1400455c8
mov rbx, r12
lea r14, [rbx + 1]
lea rdx, [rsp + 0x68]
cmp r10, 8
cmovae rdx, r8
cmp r14, rax
jae 0x140045613
sub rax, r14
lea rcx, [rdx + r14*2]
mov rdi, r15
je 0x140045606
cmp word [rcx], 0x2e
je 0x140045603
cmp rax, 1
je 0x140045606
dec rax
add rcx, 2
cmp word [rcx], 0x2e
jne 0x1400455f0
mov rdi, rcx
test rdi, rdi
je 0x140045613
sub rdi, rdx
sar rdi, 1
jmp 0x140045616
mov rdi, r12
cmp rdi, rbx
jbe 0x140045815
cmp rbx, r12
je 0x140045815
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r15w
mov rax, qword [rsp + 0x78]
cmp rax, r14
jb 0x14004588f
sub rdi, rbx
lea rsi, [rdi - 1]
sub rax, r14
cmp rax, rsi
cmovb rsi, rax
lea rax, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rax, qword [rsp + 0x68]
lea r14, [rax + r14*2]
mov r13d, 0xa
cmp rsi, 7
ja 0x1400456af
mov qword [rsp + 0x40], rsi
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r14
lea rcx, [rsp + 0x30]
call fcn.140087d20
mov word [rsp + rbx + 0x30], r15w
mov rdi, qword [rsp + 0x30]
jmp 0x14004575f
movabs rbx, 0x7ffffffffffffffe
cmp rsi, rbx
ja 0x140045895
mov rax, rsi
or rax, 7
cmp rax, rbx
ja 0x1400456d8
mov rbx, rax
cmp rax, r13
cmovb rbx, r13
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x1400456f4
mov rdx, r12
jmp 0x1400456fd
cmp rdx, 0x1000
jb 0x140045724
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r12
call fcn.14006967c
test rax, rax
je 0x14004589b
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140045739
test rdx, rdx
je 0x140045736
mov rcx, rdx
call fcn.14006967c
mov rdi, rax
jmp 0x140045739
mov rdi, r15
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call fcn.140087d20
mov word [rbx + rdi], r15w
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, rdi
mov r8d, r13d
xor edx, edx
call fcn.1400939e8
mov ebx, eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400457bc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400457b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400458a1
call fcn.140069674
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r15w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140045811
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004580c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400458a7
call fcn.140069674
mov eax, ebx
jmp 0x140045859
cmp r10, 8
jb 0x14004584c
lea rdx, [r10*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x140045844
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140045889
mov rcx, r8
call fcn.140069674
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140069650
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400927c0
nop
call fcn.140006a58
nop
call fcn.1400080e0
int3
call fcn.1400927c0
int3
call fcn.1400927c0
nop
call fcn.1400927c0
int3