Function at 0x1400c6d10
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
lea r14, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, r14
je 0x1400c6d6b
test byte [rcx + 0x1c], 1
je 0x1400c6d6b
cmp byte [rcx + 0x19], 5
jb 0x1400c6d6b
mov edx, 0x1d
lea r8, [0x140127600]
mov rcx, qword [rcx + 0x10]
call fcn.140003614
xor r13d, r13d
cmp qword [rsi], r13
je 0x1400c6d9e
mov ebx, r13d
cmp dword [rsi + 8], r13d
jle 0x1400c6d92
movsxd rcx, ebx
shl rcx, 5
add rcx, qword [rsi]
call fcn.1400454f4
inc ebx
cmp ebx, dword [rsi + 8]
jl 0x1400c6d7c
mov rcx, qword [rsi]
call qword [sym.imp.msvcrt.dll_free]
mov qword [rsi], r13
mov qword [rsi + 8], r13
mov ebx, 0x54f
mov rdx, qword [rdi + 8]
cmp dword [rdx - 0x10], r13d
je 0x1400c734f
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x19], r13
lea rcx, [rbp - 0x29]
call fcn.1400c7cc4
mov ebx, eax
mov rcx, qword [0x14014dd40]
cmp rcx, r14
je 0x1400c6dfc
test byte [rcx + 0x1c], 2
je 0x1400c6dfc
cmp byte [rcx + 0x19], 4
jb 0x1400c6dfc
mov edx, 0x1e
mov r9d, eax
lea r8, [0x140127600]
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
mov qword [rbp - 0x61], r13
mov qword [rbp - 0x59], r13
test ebx, ebx
jne 0x1400c7336
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x29]
call fcn.1400bd880
mov ebx, eax
mov rcx, qword [0x14014dd40]
cmp rcx, r14
je 0x1400c6e4b
test byte [rcx + 0x1c], 2
je 0x1400c6e4b
cmp byte [rcx + 0x19], 4
jb 0x1400c6e4b
mov edx, 0x1f
mov r9d, eax
lea r8, [0x140127600]
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
test ebx, ebx
jne 0x1400c7336
mov r15d, r13d
mov eax, dword [rbp - 0x59]
test eax, eax
jle 0x1400c7336
mov r12, r13
mov rdi, r13
mov qword [rbp - 0x49], r13
mov qword [rbp - 0x41], r13
mov qword [rbp - 0x39], r13
test r12, r12
js 0x1400c732b
cmp r15d, eax
jge 0x1400c732b
mov rax, qword [rbp - 0x61]
mov qword [rbp - 0x31], r13
lea rcx, [rbp - 0x31]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20119
xor r8d, r8d
mov rdx, qword [rax + r12]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400c6ebe
mov ebx, r13d
mov rdi, qword [rbp - 0x31]
mov qword [rbp - 0x49], rdi
mov rcx, qword [0x14014dd40]
cmp rcx, r14
je 0x1400c6eee
test byte [rcx + 0x1c], 2
je 0x1400c6eee
cmp byte [rcx + 0x19], 4
jb 0x1400c6eee
mov edx, 0x20
mov r9d, ebx
lea r8, [0x140127600]
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
test ebx, ebx
jne 0x1400c729e
mov rax, qword [0x14014e920]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140009050]
lea rcx, [0x14014e920]
call rbx
add rax, 0x18
mov qword [rbp - 0x51], rax
mov rax, qword [0x14014e920]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140009050]
lea rcx, [0x14014e920]
call rbx
add rax, 0x18
mov qword [rbp - 0x69], rax
mov rax, qword [0x14014e920]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140009050]
lea rcx, [0x14014e920]
call rbx
add rax, 0x18
mov qword [rbp + 0x7f], rax
mov dword [rbp + 0x67], 4
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f]
xor r8d, r8d
lea rdx, str.Reason
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1400c6fa8
mov eax, dword [rbp + 0x6f]
sub eax, 4
neg eax
sbb ebx, ebx
and ebx, 0xd
mov rcx, qword [0x14014dd40]
mov dil, 2
cmp rcx, r14
je 0x1400c6fdb
test byte [rcx + 0x1c], dil
je 0x1400c6fdb
cmp byte [rcx + 0x19], 4
jb 0x1400c6fdb
mov edx, 0x21
mov r9d, ebx
lea r8, [0x140127600]
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
test ebx, ebx
jne 0x1400c70c1
lea r8, [rbp - 0x51]
lea rdx, [0x140127638]
lea rcx, [rbp - 0x49]
call fcn.1400bdba4
mov ebx, eax
mov rcx, qword [0x14014dd40]
cmp rcx, r14
je 0x1400c7029
test byte [rcx + 0x1c], dil
je 0x1400c7029
cmp byte [rcx + 0x19], 4
jb 0x1400c7029
mov edx, 0x22
mov r9d, eax
lea r8, [0x140127600]
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
test ebx, ebx
jne 0x1400c70c1
lea r8, [rbp - 0x69]
lea rdx, [0x140127640]
lea rcx, [rbp - 0x49]
call fcn.1400bdba4
mov ebx, eax
mov rcx, qword [0x14014dd40]
cmp rcx, r14
je 0x1400c7077
test byte [rcx + 0x1c], dil
je 0x1400c7077
cmp byte [rcx + 0x19], 4
jb 0x1400c7077
mov edx, 0x23
mov r9d, eax
lea r8, [0x140127600]
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
test ebx, ebx
jne 0x1400c70c1
lea r8, [rbp + 0x7f]
lea rdx, str.Scope
lea rcx, [rbp - 0x49]
call fcn.1400bdba4
mov ebx, eax
mov rcx, qword [0x14014dd40]
cmp rcx, r14
je 0x1400c70c1
test byte [rcx + 0x1c], dil
je 0x1400c70c1
cmp byte [rcx + 0x19], 4
jb 0x1400c70c1
mov edx, 0x24
mov r9d, eax
lea r8, [0x140127600]
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
lea rdx, str.ignored
mov rcx, qword [rbp - 0x69]
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1400c710b
lea rcx, [rbp - 0x69]
call fcn.140004f24
mov rcx, qword [0x14014dd40]
cmp rcx, r14
je 0x1400c710b
test byte [rcx + 0x1c], dil
je 0x1400c710b
cmp byte [rcx + 0x19], 4
jb 0x1400c710b
mov edx, 0x25
lea r8, [0x140127600]
mov rcx, qword [rcx + 0x10]
call fcn.140003614
lea rdx, str.ignored
mov rcx, qword [rbp + 0x7f]
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1400c7155
lea rcx, [rbp + 0x7f]
call fcn.140004f24
mov rcx, qword [0x14014dd40]
cmp rcx, r14
je 0x1400c7155
test byte [rcx + 0x1c], dil
je 0x1400c7155
cmp byte [rcx + 0x19], 4
jb 0x1400c7155
mov edx, 0x26
lea r8, [0x140127600]
mov rcx, qword [rcx + 0x10]
call fcn.140003614
test ebx, ebx
jne 0x1400c7204
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x69]
mov r8, qword [rbp - 0x51]
mov edx, dword [rbp + 0x77]
lea rcx, [rbp - 9]
call fcn.1400c64ac
mov rdi, rax
mov ebx, dword [rsi + 8]
cmp ebx, dword [rsi + 0xc]
jne 0x1400c71bc
cmp dword [rsi + 0xc], r13d
jne 0x1400c7192
mov ebx, 1
jmp 0x1400c7196
add ebx, ebx
js 0x1400c71cd
movsxd rdx, ebx
cmp rdx, 0x3ffffff
ja 0x1400c71cd
mov r8d, 0x20
mov rcx, qword [rsi]
call qword [0x14014d020]
test rax, rax
je 0x1400c71cd
mov dword [rsi + 0xc], ebx
mov qword [rsi], rax
mov r8, rdi
mov edx, dword [rsi + 8]
mov rcx, rsi
call fcn.1400c7f0c
inc dword [rsi + 8]
lea rcx, [rbp - 9]
call fcn.1400454f4
mov rcx, qword [0x14014dd40]
cmp rcx, r14
je 0x1400c7204
test byte [rcx + 0x1c], 2
je 0x1400c7204
cmp byte [rcx + 0x19], 4
jb 0x1400c7204
mov edx, 0x27
lea r8, [0x140127600]
mov rcx, qword [rcx + 0x10]
call fcn.140003614
nop
mov r14, qword [rbp + 0x7f]
or eax, 0xffffffff
lock xadd dword [r14 - 8], eax
sub eax, 1
jg 0x1400c7234
mov rdi, qword [r14 - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140009050]
lea rdx, [r14 - 0x18]
mov rcx, rdi
call rbx
nop
mov r14, qword [rbp - 0x69]
or eax, 0xffffffff
lock xadd dword [r14 - 8], eax
sub eax, 1
jg 0x1400c7264
mov rdi, qword [r14 - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140009050]
lea rdx, [r14 - 0x18]
mov rcx, rdi
call rbx
nop
mov r14, qword [rbp - 0x51]
or eax, 0xffffffff
lock xadd dword [r14 - 8], eax
sub eax, 1
jg 0x1400c7293
mov rdi, qword [r14 - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140009050]
lea rdx, [r14 - 0x18]
mov rcx, rdi
call rbx
lea r14, [0x14014dd40]
mov rdi, qword [rbp - 0x49]
test rdi, rdi
je 0x1400c72b3
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r13
mov qword [rbp - 0x49], r13
cmp r15d, dword [rbp - 0x59]
jge 0x1400c7320
mov rdx, qword [rbp - 0x61]
mov rdx, qword [rdx + r12]
lea rcx, [rbp - 0x29]
call fcn.1400bddf4
mov ebx, eax
mov rcx, qword [0x14014dd40]
cmp rcx, r14
je 0x1400c72fd
test byte [rcx + 0x1c], 2
je 0x1400c72fd
cmp byte [rcx + 0x19], 4
jb 0x1400c72fd
mov edx, 0x28
mov r9d, eax
lea r8, [0x140127600]
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
nop
test rdi, rdi
je 0x1400c730b
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r15d
add r12, 8
mov eax, dword [rbp - 0x59]
cmp r15d, eax
jl 0x1400c6e64
jmp 0x1400c7336
mov ecx, 0xc000008c
call fcn.1400052e8
int3
mov ecx, 0xc000008c
call fcn.1400052e8
nop
lea rcx, [rbp - 0x61]
call fcn.140019c20
nop
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x1400c734f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x14014dd40]
cmp rcx, r14
je 0x1400c738f
test byte [rcx + 0x1c], 1
je 0x1400c738f
movzx r9d, byte [rcx + 0x19]
mov eax, ebx
neg eax
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp r9d, edx
jl 0x1400c738f
mov edx, 0x29
mov r9d, ebx
lea r8, [0x140127600]
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
mov eax, ebx
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret