Function at 0x140034390
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3b0
mov qword [rsp + 0x190], 0xfffffffffffffffe
mov qword [rsp + 0x400], rbx
mov rax, qword [0x1401dd3a0]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
mov rbp, r9
mov qword [rsp + 0x150], rdx
mov qword [rsp + 0x158], rcx
mov r14, qword [rsp + 0x410]
mov qword [rsp + 0x138], r14
mov r12, qword [rsp + 0x418]
mov qword [rsp + 0x130], r12
mov qword [rsp + 0x198], r12
mov rax, qword [rsp + 0x420]
mov qword [rsp + 0x170], rax
mov ecx, 8
call fcn.1400ddc18
xor r15d, r15d
test rax, rax
je 0x140034430
lea rcx, [rsp + 0x50]
mov qword [rax], rcx
jmp 0x140034433
mov rax, r15
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
lea rax, [rsp + 0x148]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rbp
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003459f
mov rdi, qword [rsp + 0x68]
test rdi, rdi
jne 0x140034484
mov rdx, r15
jmp 0x140034490
mov rdx, qword [rsp + 0x78]
sub rdx, rdi
sar rdx, 3
mov rcx, qword [rsp + 0x70]
mov rax, rcx
sub rax, rdi
sar rax, 3
cmp rax, rdx
jae 0x1400344bd
mov rax, qword [rsp + 0x148]
mov qword [rcx], rax
lea rax, [rcx + 8]
mov qword [rsp + 0x70], rax
jmp 0x14003459f
mov rbx, rcx
cmp rdi, rcx
jbe 0x1400344d4
call fcn.1400deebc
mov rcx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x50]
mov rsi, rdx
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x98], rbx
mov rax, rcx
sub rax, rdi
test rax, 0xfffffffffffffff8
jne 0x1400344ff
mov rbx, r15
jmp 0x140034524
cmp rdi, rcx
jbe 0x14003450e
call fcn.1400deebc
mov rdx, qword [rsp + 0x50]
test rsi, rsi
je 0x140034518
cmp rsi, rdx
je 0x14003451d
call fcn.1400deebc
sub rbx, rdi
sar rbx, 3
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x120], xmm0
lea r9, [rsp + 0x148]
mov r8d, 1
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x50]
call fcn.1400355f0
mov rsi, qword [rsp + 0x68]
cmp rsi, qword [rsp + 0x70]
jbe 0x140034566
call fcn.1400deebc
mov rdi, qword [rsp + 0x50]
test rdi, rdi
jne 0x14003457a
call fcn.1400deebc
mov r11, r15
jmp 0x14003457d
mov r11, qword [rdi]
lea rcx, [rsi + rbx*8]
cmp rcx, qword [r11 + 0x20]
ja 0x14003459a
test rdi, rdi
je 0x140034591
mov rax, qword [rdi]
jmp 0x140034594
mov rax, r15
cmp rcx, qword [rax + 0x18]
jae 0x14003459f
call fcn.1400deebc
lea rax, [rsp + 0x168]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
mov rdx, rbp
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400346f7
mov rdi, qword [rsp + 0x68]
test rdi, rdi
jne 0x1400345dc
mov rdx, r15
jmp 0x1400345e8
mov rdx, qword [rsp + 0x78]
sub rdx, rdi
sar rdx, 3
mov rcx, qword [rsp + 0x70]
mov rax, rcx
sub rax, rdi
sar rax, 3
cmp rax, rdx
jae 0x140034615
mov rax, qword [rsp + 0x168]
mov qword [rcx], rax
lea rax, [rcx + 8]
mov qword [rsp + 0x70], rax
jmp 0x1400346f7
mov rbx, rcx
cmp rdi, rcx
jbe 0x14003462c
call fcn.1400deebc
mov rcx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x50]
mov rsi, rdx
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x98], rbx
mov rax, rcx
sub rax, rdi
test rax, 0xfffffffffffffff8
jne 0x140034657
mov rbx, r15
jmp 0x14003467c
cmp rdi, rcx
jbe 0x140034666
call fcn.1400deebc
mov rdx, qword [rsp + 0x50]
test rsi, rsi
je 0x140034670
cmp rsi, rdx
je 0x140034675
call fcn.1400deebc
sub rbx, rdi
sar rbx, 3
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x120], xmm0
lea r9, [rsp + 0x168]
mov r8d, 1
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x50]
call fcn.1400355f0
mov rsi, qword [rsp + 0x68]
cmp rsi, qword [rsp + 0x70]
jbe 0x1400346be
call fcn.1400deebc
mov rdi, qword [rsp + 0x50]
test rdi, rdi
jne 0x1400346d2
call fcn.1400deebc
mov r11, r15
jmp 0x1400346d5
mov r11, qword [rdi]
lea rcx, [rsi + rbx*8]
cmp rcx, qword [r11 + 0x20]
ja 0x1400346f2
test rdi, rdi
je 0x1400346e9
mov rax, qword [rdi]
jmp 0x1400346ec
mov rax, r15
cmp rcx, qword [rax + 0x18]
jae 0x1400346f7
call fcn.1400deebc
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbp
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140034854
mov rdi, qword [rsp + 0x68]
test rdi, rdi
jne 0x140034734
mov rdx, r15
jmp 0x140034740
mov rdx, qword [rsp + 0x78]
sub rdx, rdi
sar rdx, 3
mov rcx, qword [rsp + 0x70]
mov rax, rcx
sub rax, rdi
sar rax, 3
cmp rax, rdx
jae 0x14003476d
mov rax, qword [rsp + 0x160]
mov qword [rcx], rax
lea rax, [rcx + 8]
mov qword [rsp + 0x70], rax
jmp 0x140034854
mov rbx, rcx
cmp rdi, rcx
jbe 0x140034784
call fcn.1400deebc
mov rcx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x50]
mov rsi, rdx
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x98], rbx
mov rax, rcx
sub rax, rdi
test rax, 0xfffffffffffffff8
jne 0x1400347af
mov rbx, r15
jmp 0x1400347d4
cmp rdi, rcx
jbe 0x1400347be
call fcn.1400deebc
mov rdx, qword [rsp + 0x50]
test rsi, rsi
je 0x1400347c8
cmp rsi, rdx
je 0x1400347cd
call fcn.1400deebc
sub rbx, rdi
sar rbx, 3
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x120], xmm0
lea r9, [rsp + 0x160]
mov r8d, 1
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x50]
call fcn.1400355f0
mov rsi, qword [rsp + 0x68]
cmp rsi, qword [rsp + 0x70]
jbe 0x140034816
call fcn.1400deebc
mov rdi, qword [rsp + 0x50]
test rdi, rdi
jne 0x14003482a
call fcn.1400deebc
mov r11, r15
jmp 0x140034832
mov rax, qword [rsp + 0x50]
mov r11, qword [rax]
lea rcx, [rsi + rbx*8]
cmp rcx, qword [r11 + 0x20]
ja 0x14003484f
test rdi, rdi
je 0x140034846
mov rax, qword [rdi]
jmp 0x140034849
mov rax, r15
cmp rcx, qword [rax + 0x18]
jae 0x140034854
call fcn.1400deebc
mov rax, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
sub rax, rsi
test rax, 0xfffffffffffffff8
jne 0x1400348a8
test rsi, rsi
je 0x140034876
mov rcx, rsi
call fcn.1400ddb14
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov rcx, qword [rsp + 0x50]
call fcn.1400ddb14
nop
mov rcx, r12
call fcn.140012040
mov rcx, qword [r12]
call fcn.1400ddb14
xor al, al
jmp 0x140035515
xor r13b, r13b
mov byte [rsp + 0x40], r13b
mov r12, qword [rsp + 0x68]
mov qword [rsp + 0xa0], r12
cmp r12, qword [rsp + 0x70]
jbe 0x1400348c9
call fcn.1400deebc
mov rbp, qword [rsp + 0x50]
mov qword [rsp + 0x110], rbp
movzx ebx, byte [rsp + 0x40]
nop dword [rax + rax]
mov rdi, qword [rsp + 0x70]
cmp qword [rsp + 0x68], rdi
jbe 0x1400348f1
call fcn.1400deebc
test rbp, rbp
je 0x1400348fd
cmp rbp, qword [rsp + 0x50]
je 0x140034902
call fcn.1400deebc
cmp r12, rdi
je 0x1400354cd
mov ecx, 8
call fcn.1400ddc18
test rax, rax
je 0x140034929
lea rcx, [rsp + 0xe0]
mov qword [rax], rcx
xor edi, edi
jmp 0x14003492e
xor edi, edi
mov rax, rdi
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x108], rdi
mov r15d, edi
mov esi, edi
mov dword [rsp + 0xa8], edi
test r13b, r13b
jne 0x140034cff
mov rbx, qword [rsp + 0x130]
nop dword [rax + rax]
test r15d, r15d
jne 0x140034cfb
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x140], 0x100
test rbp, rbp
jne 0x14003499b
call fcn.1400deebc
mov rdx, rdi
jmp 0x14003499f
mov rdx, qword [rbp]
cmp r12, qword [rdx + 0x20]
jb 0x1400349aa
call fcn.1400deebc
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x140]
lea r8, [rsp + 0x1a0]
mov edx, esi
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov r15d, eax
mov dword [rsp + 0x80], eax
test eax, eax
jne 0x140034ce9
cmp dword [rsp + 0x44], 1
jne 0x140034ce9
mov word [rsp + 0x4c], di
mov edi, dword [rsp + 0x48]
lea ecx, [rax + 8]
call fcn.1400ddc18
test rax, rax
je 0x140034a24
lea rcx, [rsp + 0xb0]
mov qword [rax], rcx
jmp 0x140034a26
xor eax, eax
mov qword [rsp + 0xb0], rax
lea r8, [rsp + 0x4c]
mov rdx, rdi
lea rcx, [rsp + 0xb0]
call fcn.140035550
nop
mov rax, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xc8]
sub rax, rdi
sar rax, 1
jne 0x140034a69
call fcn.1400deebc
mov rdi, qword [rsp + 0xc8]
test rbp, rbp
jne 0x140034a77
call fcn.1400deebc
xor edx, edx
jmp 0x140034a7b
mov rdx, qword [rbp]
cmp r12, qword [rdx + 0x20]
jb 0x140034a86
call fcn.1400deebc
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x44]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140034cb0
mov rdi, qword [rbx + 0x18]
cmp rdi, qword [rbx + 0x20]
jbe 0x140034ac1
call fcn.1400deebc
mov r12, qword [rbx]
lea r13, [rdi + 0x18]
mov r15, qword [rsp + 0x170]
mov rdi, qword [rbx + 0x20]
cmp qword [rbx + 0x18], rdi
jbe 0x140034adf
call fcn.1400deebc
test r12, r12
je 0x140034ae9
cmp r12, qword [rbx]
je 0x140034aee
call fcn.1400deebc
lea r14, [r13 - 0x18]
cmp r14, rdi
je 0x140034c83
mov rax, qword [rsp + 0xd0]
sub rax, qword [rsp + 0xc8]
sar rax, 1
jne 0x140034b15
call fcn.1400deebc
mov rsi, qword [rsp + 0xc8]
test r12, r12
jne 0x140034b2b
call fcn.1400deebc
xor edx, edx
jmp 0x140034b2f
mov rdx, qword [r12]
cmp r14, qword [rdx + 0x20]
jb 0x140034b3a
call fcn.1400deebc
xor eax, eax
or r9, 0xffffffffffffffff
mov rcx, r9
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdi, qword [r13]
cmp rdi, rdi
cmovb rdi, rdi
cmp qword [r13 + 8], 8
jb 0x140034b6c
lea rbp, [r13 - 0x10]
mov rdx, qword [rbp]
jmp 0x140034b73
lea rbp, [r13 - 0x10]
mov rdx, rbp
dec rcx
cmp rdi, r8
cmovb rcx, rdi
test rcx, rcx
je 0x140034baa
movzx eax, word [rsi]
cmp word [rdx], ax
jne 0x140034b9a
add rdx, 2
add rsi, 2
sub rcx, 1
jne 0x140034b82
jmp 0x140034baa
mov ecx, 1
cmp word [rdx], ax
cmovb ecx, r9d
xor esi, esi
jmp 0x140034bae
xor esi, esi
mov ecx, esi
movsxd rax, ecx
test ecx, ecx
jne 0x140034bc6
cmp rdi, r8
jb 0x140034c5c
mov eax, esi
cmp rdi, r8
setne al
test eax, eax
jne 0x140034c5c
xor eax, eax
mov rcx, r9
mov rdx, qword [rsp + 0x158]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
mov eax, 0x104
cmp rcx, rax
cmova rcx, rax
mov r9, rcx
mov r8, rdx
mov rdx, rax
mov rdi, qword [rsp + 0x150]
mov rcx, rdi
call fcn.1400dddec
mov word [rdi + 0x206], si
mov byte [rsp + 0x40], 1
test r12, r12
jne 0x140034c24
call fcn.1400deebc
mov rdx, rsi
jmp 0x140034c28
mov rdx, qword [r12]
cmp r14, qword [rdx + 0x20]
jb 0x140034c33
call fcn.1400deebc
cmp qword [r13 + 8], 8
jb 0x140034c3e
mov rbp, qword [rbp]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbp
mov rcx, r15
call fcn.140001520
test r12, r12
jne 0x140034c6b
call fcn.1400deebc
mov rdx, rsi
jmp 0x140034c6f
mov rdx, qword [r12]
cmp r14, qword [rdx + 0x20]
jb 0x140034c7a
call fcn.1400deebc
add r13, 0x28
jmp 0x140034ad0
mov r15d, dword [rsp + 0x80]
mov esi, dword [rsp + 0xa8]
mov rbp, qword [rsp + 0x110]
mov r12, qword [rsp + 0xa0]
movzx r13d, byte [rsp + 0x40]
mov r14, qword [rsp + 0x138]
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x140034cc2
call fcn.1400ddb14
xor edi, edi
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xd8], rdi
mov rcx, qword [rsp + 0xb0]
call fcn.1400ddb14
inc esi
mov dword [rsp + 0xa8], esi
test r13b, r13b
je 0x140034970
mov bl, byte [rsp + 0x40]
mov r13d, edi
mov r14d, edi
cmp byte [rsp + 0x40], 0
jne 0x140034fe2
test r13d, r13d
jne 0x140034fe2
mov dword [rsp + 0x80], 0x100
test rbp, rbp
jne 0x140034d33
call fcn.1400deebc
mov rdx, rdi
jmp 0x140034d37
mov rdx, qword [rbp]
cmp r12, qword [rdx + 0x20]
jb 0x140034d42
call fcn.1400deebc
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x1a0]
mov edx, r14d
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov r13d, eax
test eax, eax
jne 0x140034fda
mov qword [rsp + 0xd0], 7
mov qword [rsp + 0xc8], rdi
mov word [rsp + 0xb8], di
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1a0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0xb0]
call fcn.140001520
nop
mov rsi, qword [rsp + 0xf8]
test rsi, rsi
jne 0x140034de6
xor eax, eax
mov r8, rax
movabs r15, 0x6666666666666667
jmp 0x140034e12
mov rcx, qword [rsp + 0x108]
sub rcx, rsi
movabs r15, 0x6666666666666667
mov rax, r15
imul rcx
mov r8, rdx
sar r8, 4
mov rax, r8
shr rax, 0x3f
add r8, rax
mov rdi, qword [rsp + 0x100]
mov rcx, rdi
sub rcx, rsi
mov rax, r15
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, r8
jae 0x140034e6f
xor eax, eax
mov byte [rsp + 0x28], al
mov byte [rsp + 0x20], bl
lea r9, [rsp + 0xf0]
lea r8, [rsp + 0xb0]
lea edx, [rax + 1]
mov rcx, rdi
call fcn.140014930
lea rdx, [rdi + 0x28]
mov qword [rsp + 0x100], rdx
jmp 0x140034fbc
mov r12, rdi
cmp rsi, rdi
jbe 0x140034e8c
call fcn.1400deebc
mov rdi, qword [rsp + 0x100]
mov rsi, qword [rsp + 0xf8]
mov r8, qword [rsp + 0xe0]
mov rbp, r8
mov qword [rsp + 0x120], r8
mov qword [rsp + 0x128], r12
mov rcx, rdi
sub rcx, rsi
mov rax, r15
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x140034eca
xor ebp, ebp
mov rdi, rbp
jmp 0x140034f07
cmp rsi, rdi
jbe 0x140034edc
call fcn.1400deebc
mov r8, qword [rsp + 0xe0]
test rbp, rbp
je 0x140034ee6
cmp rbp, r8
je 0x140034eeb
call fcn.1400deebc
sub r12, rsi
mov rax, r15
imul r12
mov rdi, rdx
sar rdi, 4
mov rax, rdi
shr rax, 0x3f
add rdi, rax
xor ebp, ebp
movaps xmm0, xmmword [rsp + 0x120]
movdqa xmmword [rsp + 0x180], xmm0
lea r9, [rsp + 0xb0]
mov r8d, 1
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0xe0]
call fcn.140012e10
mov r15, qword [rsp + 0xf8]
cmp r15, qword [rsp + 0x100]
jbe 0x140034f52
call fcn.1400deebc
mov rsi, qword [rsp + 0xe0]
test rsi, rsi
jne 0x140034f69
call fcn.1400deebc
mov r11, rbp
jmp 0x140034f74
mov rax, qword [rsp + 0xe0]
mov r11, qword [rax]
lea rax, [rdi + rdi*4]
lea rcx, [r15 + rax*8]
cmp rcx, qword [r11 + 0x20]
ja 0x140034f95
test rsi, rsi
je 0x140034f8c
mov rax, qword [rsi]
jmp 0x140034f8f
mov rax, rbp
cmp rcx, qword [rax + 0x18]
jae 0x140034fac
call fcn.1400deebc
mov rbp, qword [rsp + 0x110]
mov r12, qword [rsp + 0xa0]
jmp 0x140034fbc
mov rbp, qword [rsp + 0x110]
mov r12, qword [rsp + 0xa0]
cmp qword [rsp + 0xd0], 8
jb 0x140034fd8
mov rcx, qword [rsp + 0xb8]
call fcn.1400ddb14
xor edi, edi
jmp 0x140034fda
xor edi, edi
inc r14d
jmp 0x140034d10
mov r15, qword [rsp + 0xf8]
mov qword [rsp + 0x80], r15
cmp r15, qword [rsp + 0x100]
jbe 0x140035001
call fcn.1400deebc
mov r14, qword [rsp + 0xe0]
mov qword [rsp + 0x140], r14
mov r13b, byte [rsp + 0x40]
test r13b, r13b
jne 0x1400353df
mov rbx, qword [rsp + 0x130]
nop word [rax + rax]
mov rdi, qword [rsp + 0x100]
cmp qword [rsp + 0xf8], rdi
jbe 0x140035047
call fcn.1400deebc
test r14, r14
je 0x140035056
cmp r14, qword [rsp + 0xe0]
je 0x14003505b
call fcn.1400deebc
cmp r15, rdi
je 0x1400353d9
test r14, r14
jne 0x140035075
call fcn.1400deebc
xor esi, esi
mov rdx, rsi
jmp 0x14003507a
mov rdx, qword [r14]
xor esi, esi
cmp r15, qword [rdx + 0x20]
jb 0x140035085
call fcn.1400deebc
lea rdi, [r15 + 8]
cmp qword [rdi + 0x18], 8
jb 0x140035093
mov rdi, qword [rdi]
test rbp, rbp
jne 0x1400350a2
call fcn.1400deebc
mov r11, rsi
jmp 0x1400350a6
mov r11, qword [rbp]
cmp r12, qword [r11 + 0x20]
jb 0x1400350b1
call fcn.1400deebc
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400353a5
xor edi, edi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x44], edi
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rsi, qword [rsp + 0x138]
mov rdx, rsi
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140035397
cmp dword [rsp + 0x48], 1
jne 0x140035397
mov word [rsp + 0x4c], di
mov edi, dword [rsp + 0x44]
lea ecx, [rax + 8]
call fcn.1400ddc18
test rax, rax
je 0x14003514c
lea rcx, [rsp + 0xb0]
mov qword [rax], rcx
jmp 0x14003514e
xor eax, eax
mov qword [rsp + 0xb0], rax
lea r8, [rsp + 0x4c]
mov rdx, rdi
lea rcx, [rsp + 0xb0]
call fcn.140035550
nop
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xc8]
sub rax, rcx
sar rax, 1
jne 0x140035191
call fcn.1400deebc
mov rcx, qword [rsp + 0xc8]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003535e
mov r13, qword [rbx + 0x18]
cmp r13, qword [rbx + 0x20]
jbe 0x1400351d0
call fcn.1400deebc
mov rbp, qword [rbx]
mov r14, qword [rsp + 0x170]
mov r15, qword [rsp + 0x158]
mov rdi, qword [rbx + 0x20]
cmp qword [rbx + 0x18], rdi
jbe 0x1400351f2
call fcn.1400deebc
test rbp, rbp
je 0x1400351fc
cmp rbp, qword [rbx]
je 0x140035201
call fcn.1400deebc
cmp r13, rdi
je 0x140035339
mov rax, qword [rsp + 0xd0]
mov r12, qword [rsp + 0xc8]
sub rax, r12
sar rax, 1
jne 0x14003522f
call fcn.1400deebc
mov r12, qword [rsp + 0xc8]
test rbp, rbp
jne 0x140035240
call fcn.1400deebc
xor eax, eax
mov rdx, rax
jmp 0x140035244
mov rdx, qword [rbp]
cmp r13, qword [rdx + 0x20]
jb 0x14003524f
call fcn.1400deebc
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
lea rsi, [r13 + 8]
mov qword [rsp + 0x20], rcx
mov r9, r12
mov r8, qword [rsi + 0x10]
xor edx, edx
mov rcx, r13
call fcn.14002e610
test eax, eax
jne 0x14003530f
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r15
repne scasw ax, word [rdi]
not rcx
mov eax, 0x104
cmp rcx, rax
cmova rcx, rax
mov r9, rcx
mov r8, r15
mov rdx, rax
mov rdi, qword [rsp + 0x150]
mov rcx, rdi
call fcn.1400dddec
xor r12d, r12d
mov word [rdi + 0x206], r12w
mov byte [rsp + 0x40], 1
test rbp, rbp
jne 0x1400352d6
call fcn.1400deebc
mov rdx, r12
jmp 0x1400352da
mov rdx, qword [rbp]
cmp r13, qword [rdx + 0x20]
jb 0x1400352e5
call fcn.1400deebc
cmp qword [rsi + 0x18], 8
jb 0x1400352ef
mov rsi, qword [rsi]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
mov rcx, r14
call fcn.140001520
jmp 0x140035312
xor r12d, r12d
test rbp, rbp
jne 0x140035321
call fcn.1400deebc
mov rdx, r12
jmp 0x140035325
mov rdx, qword [rbp]
cmp r13, qword [rdx + 0x20]
jb 0x140035330
call fcn.1400deebc
add r13, 0x28
jmp 0x1400351e3
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x140]
mov rbp, qword [rsp + 0x110]
mov r12, qword [rsp + 0xa0]
mov r13b, byte [rsp + 0x40]
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x140035370
call fcn.1400ddb14
xor eax, eax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rax
mov rcx, qword [rsp + 0xb0]
call fcn.1400ddb14
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
jne 0x1400353b6
call fcn.1400deebc
xor eax, eax
mov rdx, rax
jmp 0x1400353b9
mov rdx, qword [r14]
cmp r15, qword [rdx + 0x20]
jb 0x1400353c4
call fcn.1400deebc
add r15, 0x28
mov qword [rsp + 0x80], r15
test r13b, r13b
je 0x140035030
mov bl, byte [rsp + 0x40]
xor edi, edi
test rbp, rbp
jne 0x1400353ee
call fcn.1400deebc
mov rdx, rdi
jmp 0x1400353f2
mov rdx, qword [rbp]
cmp r12, qword [rdx + 0x20]
jb 0x1400353fd
call fcn.1400deebc
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
je 0x14003546e
mov rsi, qword [rsp + 0x100]
cmp rcx, rsi
je 0x140035469
lea rdi, [rcx + 0x20]
xor r13d, r13d
nop dword [rax]
cmp qword [rdi], 8
jb 0x14003543f
mov rcx, qword [rdi - 0x18]
call fcn.1400ddb14
mov qword [rdi], 7
mov qword [rdi - 8], r13
mov word [rdi - 0x18], r13w
add rdi, 0x28
lea rax, [rdi - 0x20]
cmp rax, rsi
jne 0x140035430
mov rcx, qword [rsp + 0xf8]
mov r13b, byte [rsp + 0x40]
call fcn.1400ddb14
xor r15d, r15d
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0x100], r15
mov qword [rsp + 0x108], r15
mov rcx, qword [rsp + 0xe0]
call fcn.1400ddb14
test rbp, rbp
jne 0x1400354a5
call fcn.1400deebc
mov rdx, r15
jmp 0x1400354a9
mov rdx, qword [rbp]
cmp r12, qword [rdx + 0x20]
jb 0x1400354b4
call fcn.1400deebc
add r12, 8
mov qword [rsp + 0xa0], r12
mov r14, qword [rsp + 0x138]
jmp 0x1400348e0
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x1400354df
mov rcx, rsi
call fcn.1400ddb14
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov rcx, qword [rsp + 0x50]
call fcn.1400ddb14
nop
mov r12, qword [rsp + 0x130]
mov rcx, r12
call fcn.140012040
mov rcx, qword [r12]
call fcn.1400ddb14
mov al, r13b
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.1400dd780
mov rbx, qword [rsp + 0x400]
add rsp, 0x3b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret