Function at 0x140051000
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x19a40]
mov eax, 0x19b40
call fcn.1400d8890
sub rsp, rax
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x19b78], rbx
mov qword [rsp + 0x19b80], rsi
mov qword [rsp + 0x19b88], rdi
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp + 0x19a30], rax
mov r13, rcx
mov qword [rbp - 0x80], rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x68], r14d
mov qword [rsp + 0x70], r14
mov eax, dword [0x1401d5d60]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 9
jne 0x1400510aa
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov qword [rsp + 0x50], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Pathschrome.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400513ae
mov dword [rsp + 0x68], r14d
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x60], r12
mov word [rbp - 0x70], r14w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp - 0x6e]
call fcn.1400d8c20
lea rcx, str.__r_
mov rax, qword [str.__r_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x40], 0x800
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, [0x14015ca7c]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or rsi, 0xffffffffffffffff
test eax, eax
jne 0x140051298
mov eax, dword [rsp + 0x78]
dec eax
cmp eax, 1
ja 0x140051298
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14005118b
test al, 1
jne 0x140051298
shr rax, 1
cmp word [rbp + rax*2 - 0x72], 0
je 0x140051190
jmp 0x140051298
mov word [rbp - 0x70], r14w
lea rax, [rbp - 0x70]
mov rdi, rsi
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400511a0
test edi, edi
jne 0x14005120f
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140051298
cmp dword [rdx + 0x10], 0
jge 0x1400511e3
cmp dword [rbx - 0xc], 0
jge 0x1400511d6
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rbx - 0x10], r14d
mov word [rbx], r14w
jmp 0x140051298
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400511f3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov r12, qword [rsp + 0x50]
jmp 0x140051298
mov r15d, dword [rbx - 0x10]
lea r14, [rbp - 0x70]
sub r14, rbx
sar r14, 1
test edi, edi
jns 0x14005122c
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14005124e
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.140002560
mov rbx, qword [rsp + 0x58]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp r14, r15
lea r15, [rax + rax]
mov r9, r15
ja 0x140051272
lea r8, [rbx + r14*2]
call fcn.1400d400c
jmp 0x14005127b
lea r8, [rbp - 0x70]
call fcn.1400d41cc
cmp edi, dword [rbx - 0xc]
jg 0x14005128d
mov dword [rbx - 0x10], edi
xor r14d, r14d
mov word [r15 + rbx], r14w
jmp 0x140051298
mov ecx, 0x80070057
call fcn.140001920
int3
test r12, r12
je 0x1400512ab
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x68], r14d
mov eax, dword [0x1401d5d60]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0xd
jne 0x140051360
mov word [rbp + 0x790], r14w
xor edx, edx
mov r8d, 0x19290
lea rcx, [rbp + 0x792]
call fcn.1400d8c20
mov r10, r14
mov r9, rsi
nop dword [rax]
mov r8, r14
test r10, r10
je 0x140051334
test r8, r8
je 0x140051334
lea rcx, [r9 + r8]
lea rax, [r9 + r8]
movzx edx, word [rbp + rcx*2 + 0x5cc]
inc dx
add dx, word [rbp + rax*2 + 0x790]
lea rax, [r9 + r8]
mov word [rbp + rax*2 + 0x792], dx
inc r8
cmp r8, 0xe3
jl 0x140051303
inc r10
add r9, 0xe3
cmp r9, 0xc948
jl 0x140051300
movsx eax, word [rbp + 0x19a20]
mov dword [0x1401d5d60], eax
lea rcx, [rbx - 0x18]
call fcn.1400025c0
add rax, 0x18
mov qword [r13], rax
mov dword [rsp + 0x30], 1
lock add dword [rbx - 8], 0xffffffff
jg 0x140051390
mov rcx, qword [rbx - 0x18]
mov r8, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400515c3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r14
jmp 0x1400515c3
lea rcx, [rsp + 0x38]
call fcn.14002d3a0
nop
call fcn.14004f460
mov edi, dword [0x1401d5d60]
test al, al
jne 0x14005141a
mov r8d, 0x74
mov r11d, r14d
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
nop word [rax + rax]
test ebx, ebx
jle 0x140051412
mov eax, edi
cdq
and edx, 3
add eax, edx
sar eax, 2
mov r9d, r14d
mov r10, rbx
test eax, eax
jle 0x14005140a
mov ecx, r9d
mov edx, eax
nop
add r8d, ecx
dec ecx
dec rdx
jne 0x140051400
add r9d, r11d
dec r10
jne 0x1400513f5
inc r11d
cmp r11d, r8d
jl 0x1400513e0
mov rcx, qword [rsp + 0x38]
or rsi, 0xffffffffffffffff
cmp dword [rcx - 0x10], 0
je 0x14005154d
lea r8d, [rdi + 1]
imul r8d, edi
mov eax, 0x66666667
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub r8d, eax
cmp r8d, 3
jne 0x14005148f
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub edi, edx
add edi, 0x7b
movsxd rcx, edi
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400d2e28
mov rcx, rax
call fcn.1400d3f08
mov rcx, qword [rsp + 0x38]
mov edx, dword [rcx - 0x10]
lea eax, [rdx - 1]
test eax, eax
js 0x140051542
cmp eax, edx
jg 0x140051542
cdqe
cmp word [rcx + rax*2], 0x5c
je 0x1400514c5
mov r8d, 1
lea rdx, [0x14015ca64]
lea rcx, [rsp + 0x38]
call fcn.1400109d0
lea r8, str.GoogleChromeApplicationchrome.exe
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.14001b320
nop
lea rcx, [rsp + 0x48]
call fcn.14002d760
test al, al
je 0x140051527
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
call fcn.1400025c0
add rax, 0x18
mov qword [r13], rax
mov dword [rsp + 0x30], 1
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140051522
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x1400515a9
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005154d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14005154d
mov ecx, 0x80070057
call fcn.140001920
int3
lea rcx, str.__r_
mov rax, qword [str.__r_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r13], rax
lea rdx, [0x14015ca8c]
test rdx, 0xffffffffffff0000
jne 0x140051595
movzx ebx, dx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x1400515a1
mov r8d, ebx
mov rdx, rax
mov rcx, r13
call fcn.140002760
jmp 0x1400515a1
xor r8d, r8d
mov rcx, r13
call fcn.140002470
nop
mov dword [rsp + 0x30], 1
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400515c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov dword [rsp + 0x68], r14d
mov rax, r13
mov rcx, qword [rbp + 0x19a30]
xor rcx, rsp
call fcn.1400d37e0
lea r11, [rsp + 0x19b40]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret