Function at 0x140008360
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1402d9850]
xor rax, rsp
mov qword [rbp + 0x27], rax
lea rax, vtable.CRegistryEdit.0
mov qword [rbp - 0x29], rax
xor edi, edi
mov dword [rbp - 0x21], edi
mov qword [rbp - 0x41], rdi
mov esi, edi
mov dword [rbp - 0x49], edi
mov qword [rbp - 1], 7
mov qword [rbp - 9], rdi
mov word [rbp - 0x19], di
or r12, 0xffffffffffffffff
mov ecx, 0x13880
call fcn.14012a230
mov rbx, rax
mov rcx, qword [rbp - 0x41]
test rcx, rcx
jne 0x140008419
lea rax, [rbp - 0x41]
mov qword [rsp + 0x20], rax
lea r9d, [rcx + 8]
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionGroup_Policy
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140008415
test rbx, rbx
je 0x140008411
mov rcx, rbx
call fcn.14012a238
xor al, al
jmp 0x140008478
mov rcx, qword [rbp - 0x41]
mov r9d, 0x9c3f
mov r8, rbx
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x140008441
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x41], rdi
jmp 0x140008404
test eax, eax
jne 0x140008404
cmp word [rbx], ax
jne 0x14000844f
mov r8, rdi
jmp 0x14000845d
mov r8, r12
inc r8
cmp word [rbx + r8*2], 0
jne 0x140008452
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.140007090
inc esi
mov dword [rbp - 0x49], esi
mov rcx, rbx
call fcn.14012a238
mov al, 1
test al, al
je 0x140008658
mov qword [rbp + 0x1f], 7
mov qword [rbp + 0x17], rdi
mov word [rbp + 7], di
mov r8d, 9
lea rdx, str.S_1_5_21_
lea rcx, [rbp + 7]
call fcn.140007090
nop
lea r14, [rbp + 7]
mov r11, qword [rbp + 7]
mov r13, qword [rbp + 0x1f]
cmp r13, 8
cmovae r14, r11
mov r15, qword [rbp - 9]
mov rsi, qword [rbp + 0x17]
test rsi, rsi
je 0x140008604
test r15, r15
je 0x140008589
cmp rsi, r15
ja 0x140008589
mov r10, r15
sub r10, rsi
inc r10
lea rbx, [rbp - 0x19]
mov r12, qword [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rbx, r12
test r10, r10
je 0x140008516
mov rcx, r10
mov rax, rbx
movzx edx, word [r14]
cmp word [rax], dx
je 0x140008519
add rax, 2
sub rcx, 1
jne 0x140008507
mov rax, rdi
test rax, rax
je 0x140008585
mov rdx, rsi
mov r8, r14
mov r9, rax
test rsi, rsi
je 0x140008570
movzx ecx, word [r8]
cmp word [r9], cx
jne 0x140008544
add r9, 2
add r8, 2
sub rdx, 1
jmp 0x14000852a
mov edx, 1
cmp word [r9], cx
mov rcx, 0xffffffffffffffff
cmovb edx, ecx
test edx, edx
je 0x140008570
mov rdx, rax
sub rdx, rbx
sar rdx, 1
sub rcx, rdx
add r10, rcx
lea rbx, [rax + 2]
jmp 0x1400084f8
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, r12
sub rax, rcx
sar rax, 1
je 0x140008600
or r12, 0xffffffffffffffff
cmp r13, 8
mov esi, dword [rbp - 0x49]
jb 0x1400083c6
lea rax, [r13 + 1]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x1400085fa
add rax, rax
cmp rax, 0x1000
jb 0x1400085d5
test byte [rbp + 7], 0x1f
jne 0x1400085f4
mov rax, qword [r11 - 8]
cmp rax, r11
jae 0x1400085ee
sub r11, rax
cmp r11, 8
jb 0x1400085e8
cmp r11, 0x27
ja 0x1400085e2
mov r11, rax
mov rcx, r11
call fcn.140129a9c
jmp 0x1400083c6
call fcn.14012eec0
int3
call fcn.14012eec0
int3
call fcn.14012eec0
int3
call fcn.14012eec0
int3
call fcn.14012eec0
nop
or r12, 0xffffffffffffffff
lea rcx, [r15 + 1]
mov eax, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.14012a230
mov rdi, rax
lea r8, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae r8, qword [rbp - 0x19]
mov rdx, qword [rbp - 9]
inc rdx
mov rcx, rax
call fcn.14013291c
nop
mov r8, qword [rbp + 0x1f]
cmp r8, 8
jb 0x140008658
inc r8
mov rdx, qword [rbp + 7]
lea rcx, [rbp + 7]
call fcn.140007540
nop
mov r8, qword [rbp - 1]
cmp r8, 8
jb 0x140008673
inc r8
mov rdx, qword [rbp - 0x19]
lea rcx, [rbp - 0x19]
call fcn.140007540
nop
mov rax, rdi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14012a1e0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret