Function at 0x140032f98
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor r12d, r12d
mov sil, dl
mov rbx, rcx
test rcx, rcx
je 0x1400331c4
test dl, dl
je 0x140032fd6
cmp dword [0x140085f38], r12d
mov eax, r12d
sete al
jmp 0x140033004
test byte [rcx + 0x18], 0x10
jne 0x140033001
mov eax, dword [0x140086260]
test eax, eax
je 0x140032fee
cmp eax, 2
sete al
jmp 0x140032ff8
cmp byte [0x140085990], r12b
setne al
test al, al
mov eax, 1
jne 0x140033004
mov eax, r12d
test eax, eax
jne 0x1400331c4
lea rcx, [0x140085120]
mov dword [rbp + 0x30], r12d
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, 1
lock xadd dword [rbp - 0x28], eax
test eax, eax
jne 0x140033046
cmp dword [rbp - 0x24], r12d
jne 0x1400331df
call qword [sym.imp.MSVCP140.dll__Thrd_id]
mov dword [rbp - 0x24], eax
mov eax, dword [rbp + 0x30]
mov edi, r12d
cmp edi, 4
jge 0x1400331b2
mov eax, dword [rbx + 0x1c]
lea rcx, [rbp - 0x20]
mov rdx, qword [rbx + 0x10]
mov r14b, r12b
movzx r15d, sil
mov r9d, r15d
mov qword [rbp + 0x40], r12
shl r9d, 5
mov dword [rsp + 0x20], eax
call fcn.1400314d4
mov rcx, rax
mov eax, dword [rax]
mov dword [rbp + 0x30], eax
mov rax, qword [rcx + 8]
mov qword [rcx + 8], r12
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0x40], rax
test rcx, rcx
je 0x1400330a5
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140015ba5.0]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400330bf
mov qword [rbp - 0x18], r12
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140015ba5.0]
mov eax, dword [rbp + 0x30]
test eax, eax
je 0x14003312e
test sil, sil
je 0x14003312a
mov eax, dword [rbx + 0x1c]
lea r9d, [r15 + r15]
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x20], eax
call fcn.1400314d4
mov rcx, rax
mov eax, dword [rax]
mov dword [rbp + 0x30], eax
mov rax, qword [rcx + 8]
mov qword [rcx + 8], r12
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0x40], rax
test rcx, rcx
je 0x14003310d
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140015ba5.0]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140033127
mov qword [rbp - 8], r12
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140015ba5.0]
mov eax, dword [rbp + 0x30]
test eax, eax
jne 0x14003318a
mov rax, qword [rbp + 0x40]
xor r9d, r9d
mov rdx, qword [rbx]
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov rcx, qword [rax + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 0x30], eax
cmp eax, 0x3f2
je 0x140033165
cmp eax, 0x3fa
je 0x140033165
cmp eax, 6
jne 0x14003318a
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1400838a0]
movzx eax, word [rcx + 0xa]
and eax, 0x1f
shl rax, 5
mov qword [rax + rdx], r12
call fcn.14002fee0
mov eax, dword [rbp + 0x30]
mov r14b, 1
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x1400331a7
mov qword [rbp + 0x40], r12
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140015ba5.0]
mov eax, dword [rbp + 0x30]
inc edi
test r14b, r14b
jne 0x14003304c
test eax, eax
lea rcx, [rbp - 0x30]
sete bl
call fcn.1400063e4
mov al, bl
jmp 0x1400331c6
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor edx, edx
mov ecx, 0x131f4c4
call fcn.140007ee0
int3