Function at 0x14003f194
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
movsxd r15, edx
mov r13, rcx
mov rbx, r15
mov r14, r8
shl rbx, 2
mov rcx, rbx
call fcn.14015319c
mov qword [rbp - 0x18], rax
mov r12, rax
test rax, rax
je 0x14003f442
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.140130a00
xor ebx, ebx
mov esi, ebx
test r15d, r15d
jle 0x14003f43a
lea rdi, [r13 + 0x18]
cmp dword [rdi - 0x18], ebx
jne 0x14003f423
cmp dword [r12], ebx
jne 0x14003f423
mov rdx, qword [rdi]
cmp byte [rdx], bl
jne 0x14003f21e
mov r10, r14
mov qword [rbp - 0x28], r14
jmp 0x14003f247
lea rax, [rbp - 0x28]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r10, qword [rbp - 0x28]
test eax, eax
cmovne r10, rbx
mov qword [rbp - 0x28], r10
cmp esi, r15d
jge 0x14003f410
movsxd rax, esi
lea rbx, [rdi + 8]
mov r9, r12
mov qword [rbp - 0x30], r12
lea rcx, [rax + rax*4]
lea r13, [r13 + rcx*8]
mov ecx, r15d
sub ecx, esi
add r13, 8
mov qword [rbp - 0x20], rcx
xor r15d, r15d
mov rax, qword [rbx - 8]
mov r8, qword [rdi]
sub r8, rax
movzx ecx, byte [rax]
movzx edx, byte [rax + r8]
sub ecx, edx
jne 0x14003f294
inc rax
test edx, edx
jne 0x14003f281
test ecx, ecx
jne 0x14003f3e7
mov dword [r9], 1
cmp dword [rbx - 0x20], r15d
jne 0x14003f3e3
mov r10, qword [rbp - 0x28]
test r10, r10
je 0x14003f3e7
mov ecx, dword [rbx - 0xc]
test ecx, ecx
je 0x14003f3ad
sub ecx, 1
je 0x14003f3a3
sub ecx, 1
je 0x14003f378
cmp ecx, 1
jne 0x14003f3e7
mov rdx, qword [rbx]
lea r9, [rbp - 0x34]
mov dword [rsp + 0x20], ecx
lea r8, [rbp + 0x60]
mov rcx, r10
mov qword [rbp + 0x60], r15
call fcn.14003f454
test eax, eax
je 0x14003f3df
mov r14, qword [rbp + 0x60]
or r9d, 0xffffffff
mov r8, r14
mov dword [rsp + 0x28], r15d
xor edx, edx
mov qword [rsp + 0x20], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rcx, eax
add rcx, rcx
mov dword [rbp + 0x60], eax
call fcn.14015319c
mov qword [rbx - 0x18], rax
mov rcx, rax
test rax, rax
je 0x14003f369
mov eax, dword [rbp + 0x60]
or r9d, 0xffffffff
mov dword [rsp + 0x28], eax
mov r8, r14
mov qword [rsp + 0x20], rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [rbp + 0x60]
mov dword [rbx - 0x20], 1
lea eax, [rcx + rcx]
mov dword [rbx - 0x10], eax
test r14, r14
je 0x14003f3df
mov rcx, r14
call fcn.140152ed8
jmp 0x14003f3df
mov dword [rsp + 0x20], 3
mov rdx, qword [rbx]
lea r9, [r13 + 8]
mov r8, r13
mov rcx, r10
call fcn.14003f454
mov r9, qword [rbp - 0x30]
test eax, eax
je 0x14003f3e3
mov dword [rbx - 0x20], 1
jmp 0x14003f3e3
mov dword [rsp + 0x20], 1
jmp 0x14003f380
mov rdx, qword [rbx]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov rcx, r10
mov dword [rbp - 0x38], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14003f3df
mov dword [rbx - 0x20], 1
mov r9, qword [rbp - 0x30]
mov r10, qword [rbp - 0x28]
add r9, 4
add r13, 0x28
add rbx, 0x28
mov qword [rbp - 0x30], r9
sub qword [rbp - 0x20], 1
jne 0x14003f277
mov r15d, dword [rbp + 0x50]
xor ebx, ebx
mov r14, qword [rbp + 0x58]
mov r13, qword [rbp + 0x48]
cmp r10, r14
je 0x14003f423
test r10, r10
je 0x14003f423
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
add r12, 4
add rdi, 0x28
cmp esi, r15d
jl 0x14003f1fb
mov r12, qword [rbp - 0x18]
mov rcx, r12
call fcn.140152ed8
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret