Function at 0x1400423f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x140212680]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rsi, r9
mov edi, edx
mov rbx, rcx
mov qword [rbp - 0x59], rcx
xor r15d, r15d
mov dword [rbp - 0x61], r15d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r15
mov r14d, 0xf
mov qword [rcx + 0x18], r14
mov byte [rcx], r15b
mov dword [rbp - 0x61], 1
mov rdx, r8
lea rcx, [rbp - 0x31]
call fcn.14003cea0
mov rdx, rax
cmp qword [rax + 0x18], 7
jbe 0x140042460
mov rdx, qword [rax]
test edi, edi
je 0x14004247b
sub edi, 1
je 0x140042472
mov rcx, 0xffffffff80000001
jmp 0x140042482
mov rcx, 0xffffffff80000002
jmp 0x140042482
mov rcx, 0xffffffff80000000
lea rax, [rbp - 0x69]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
mov rdx, qword [rbp - 0x19]
cmp rdx, 7
jbe 0x1400424dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400424d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004291e
call fcn.140101048
test edi, edi
jne 0x1400428e2
mov rdx, rsi
lea rcx, [rbp - 0x31]
call fcn.14003cea0
cmp qword [rax + 0x18], 7
jbe 0x1400424fa
mov rax, qword [rax]
lea rcx, [rbp - 0x75]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r15
lea rcx, [rbp - 0x71]
mov qword [rsp + 0x20], rcx
mov r9d, 0xffff
mov r8, rax
xor edx, edx
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edi, eax
mov rdx, qword [rbp - 0x19]
cmp rdx, 7
jbe 0x140042568
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042563
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042924
call fcn.140101048
test edi, edi
jne 0x1400428e2
mov edx, dword [rbp - 0x75]
inc edx
lea r8, [rbp - 0x79]
lea rcx, [rbp - 0x31]
call fcn.140041f20
nop
mov eax, dword [rbp - 0x29]
mov rdi, qword [rbp - 0x31]
sub eax, edi
mov dword [rbp - 0x75], eax
mov ecx, dword [rbp - 0x71]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x14004270d
cmp ecx, 4
jne 0x1400428ad
mov rdx, rsi
lea rcx, [rbp - 0x51]
call fcn.14003cea0
cmp qword [rax + 0x18], 7
jbe 0x1400425bd
mov rax, qword [rax]
lea rcx, [rbp - 0x75]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdi
lea rcx, [rbp - 0x71]
mov qword [rsp + 0x20], rcx
mov r9d, 0x10
mov r8, rax
xor edx, edx
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov rdx, qword [rbp - 0x39]
cmp rdx, 7
jbe 0x140042629
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x51]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042624
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004292a
call fcn.140101048
mov r8d, dword [rdi]
lea r10, [rbp - 0x3c]
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140042630
lea r9, [rbp - 0x79]
lea r8, [rbp - 0x3c]
mov rdx, r10
lea rcx, [rbp - 0x11]
call fcn.140005290
lea rax, [rbp - 0x11]
cmp rbx, rax
je 0x1400426c9
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400426b1
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400426ac
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140042918
mov rcx, r8
call fcn.140101048
mov byte [rbx], 0
movups xmm0, xmmword [rbp - 0x11]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 1]
movups xmmword [rbx + 0x10], xmm1
mov byte [rbp - 0x11], 0
jmp 0x1400426cd
mov r14, qword [rbp + 7]
cmp r14, 0xf
jbe 0x1400428ad
lea rdx, [r14 + 1]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400428a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042918
jmp 0x1400428a7
mov rdx, rsi
lea rcx, [rbp + 0xf]
call fcn.14003cea0
cmp qword [rax + 0x18], 7
jbe 0x140042723
mov rax, qword [rax]
lea rcx, [rbp - 0x75]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdi
lea rcx, [rbp - 0x71]
mov qword [rsp + 0x20], rcx
mov r9d, 0xffff
mov r8, rax
xor edx, edx
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov rdx, qword [rbp + 0x27]
cmp rdx, 7
jbe 0x14004278f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004278a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042930
call fcn.140101048
xorps xmm0, xmm0
movups xmmword [rbp - 0x51], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x41], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], 0
jne 0x1400427a5
mov rdx, rdi
lea rcx, [rbp - 0x51]
call fcn.14002e1c0
nop
lea rdx, [rbp - 0x51]
lea rcx, [rbp + 0xf]
call fcn.14003cd70
mov rsi, rax
cmp rbx, rax
je 0x140042830
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14004280c
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140042807
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140042936
mov rcx, r8
call fcn.140101048
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r14
mov byte [rbx], 0
movups xmm0, xmmword [rsi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r14
mov byte [rsi], 0
mov rdx, qword [rbp + 0x27]
cmp rdx, 0xf
jbe 0x14004286c
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042866
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042936
call fcn.140101048
nop
mov rdx, qword [rbp - 0x39]
cmp rdx, 7
jbe 0x1400428ad
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x51]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400428a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004293c
call fcn.140101048
nop
test rdi, rdi
je 0x1400428e2
mov rdx, qword [rbp - 0x21]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400428da
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042912
mov rcx, rdi
call fcn.140101048
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140101160
mov rbx, qword [rsp + 0x128]
add rsp, 0xf0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140107114
nop
call fcn.140107114
nop
call fcn.140107114
int3
call fcn.140107114
nop
call fcn.140107114
int3
call fcn.140107114
nop
call fcn.140107114
nop
call fcn.140107114
int3