Function at 0x14001b670
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xac0]
sub rsp, 0xbc0
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xc10], rbx
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp + 0xab0], rax
mov r12, rdx
mov rsi, rcx
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x40], rcx
movzx eax, byte [0x1401b4d84]
neg al
sbb rdi, rdi
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
xor r15d, r15d
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], r15d
mov qword [rsp + 0x70], r15
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, [0x140140c08]
test rdx, 0xffffffffffff0000
jne 0x14001b73d
movzx ebx, dx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x14001b748
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400026c0
jmp 0x14001b748
lea rcx, [rsp + 0x58]
call fcn.140003500
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x60]
call fcn.14000f640
nop
lea r8, [0x1401b5068]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14000f640
nop
lea r8, [0x140140b90]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140019ad0
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.14000f640
nop
mov qword [rbp - 0x80], r15
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rax]
lea rcx, [rdi - 0x7ffffffe]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test eax, eax
jne 0x14001b7d1
mov dword [rsp + 0x68], r15d
mov ecx, r15d
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x60], rax
test ecx, ecx
setne bl
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
or r13, 0xffffffffffffffff
lock add dword [rdx + 0x10], r13d
jg 0x14001b7f3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001b80c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001b825
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001b83e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001b857
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14001b8f6
mov eax, dword [0x1401b4d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 1
jne 0x14001b89f
call fcn.1400c84d4
mov ecx, dword [0x1401b4d80]
cmp ecx, eax
jne 0x14001b89f
dec ecx
mov dword [0x1401b4d80], ecx
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001b8b4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], r15d
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14001b8d8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001b8ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x14001be04
mov r8d, dword [0x1401b4d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0x10
jne 0x14001b953
mov ecx, r15d
lea rdx, [rbp - 0x30]
nop word [rax + rax]
mov eax, dword [rdx]
imul eax, eax, 0xef
add r8d, eax
inc ecx
lea rdx, [rdx + 4]
movsxd rax, ecx
cmp rax, 0x2d8
jb 0x14001b930
mov dword [0x1401b4d80], r8d
mov dword [rsp + 0x4c], 0x400
mov word [rbp + 0x2b0], r15w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp + 0x2b2]
call fcn.1400cd020
mov edi, r15d
mov rbx, qword [rsp + 0x60]
nop
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x4c]
lea r8, [rbp + 0x2b0]
mov edx, edi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [rsp + 0x50], eax
inc edi
mov dword [rsp + 0x48], edi
test eax, eax
je 0x14001b9c4
cmp eax, 0x103
jne 0x14001bd69
lea rcx, str._k_f_
mov rdx, qword [str._k_f_]
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
lea rcx, [rbp + 0x2b0]
lea rax, [rbp + 0x2b0]
test rax, 0xffffffffffff0000
jne 0x14001ba21
movzx edi, cx
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14001bb0c
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400026c0
mov rbx, qword [rsp + 0x40]
jmp 0x14001bb0c
lea rax, [rbp + 0x2b0]
mov rdi, r13
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14001ba30
test edi, edi
jne 0x14001ba90
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14001bb0c
cmp dword [rdx + 0x10], 0
jge 0x14001ba6c
cmp dword [rbx - 0xc], 0
jl 0x14001bd72
mov dword [rbx - 0x10], r15d
mov word [rbx], r15w
jmp 0x14001bb0c
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001ba7c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
jmp 0x14001bb0c
mov r14d, dword [rbx - 0x10]
lea rsi, [rbp + 0x2b0]
sub rsi, rbx
sar rsi, 1
test edi, edi
js 0x14001bdf9
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001bacb
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.1400024c0
mov rbx, qword [rsp + 0x40]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp rsi, r14
lea r14, [rax + rax]
mov r9, r14
ja 0x14001baef
lea r8, [rbx + rsi*2]
call fcn.1400c8404
jmp 0x14001bafb
lea r8, [rbp + 0x2b0]
call fcn.1400c8500
cmp edi, dword [rbx - 0xc]
jg 0x14001bdee
mov dword [rbx - 0x10], edi
mov word [r14 + rbx], r15w
mov r10d, dword [0x1401b4d80]
lea r14d, [r10 + 1]
lea r15d, [r10 + 2]
imul r15d, r14d
imul r15d, r10d
mov eax, 0x66666667
imul r15d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*4]
shl ecx, 2
mov eax, r15d
sub eax, ecx
cmp eax, 2
jne 0x14001bb99
xor edi, edi
mov r8d, 0x83
mov eax, r10d
cdq
sub eax, edx
sar eax, 1
mov esi, eax
test esi, esi
jle 0x14001bb92
mov eax, r10d
cdq
and edx, 3
add eax, edx
sar eax, 2
xor r9d, r9d
mov r11, rsi
nop dword [rax]
test eax, eax
jle 0x14001bb8a
mov ecx, r9d
mov edx, eax
nop dword [rax]
add r8d, ecx
dec ecx
dec rdx
jne 0x14001bb80
add r9d, edi
dec r11
jne 0x14001bb70
inc edi
cmp edi, r8d
jl 0x14001bb57
cmp dword [rbx - 0x10], 0
je 0x14001bc97
mov eax, 0x38e38e39
imul r15d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub r15d, eax
cmp r15d, 7
jne 0x14001bbc6
inc dword [0x1401b5054]
mov rax, qword [r12 + 8]
lea rcx, [rsp + 0x40]
cmp rcx, rax
jae 0x14001bc2d
mov rcx, qword [r12]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
ja 0x14001bc2d
lea rdi, [rsp + 0x40]
sub rdi, rcx
sar rdi, 3
cmp rax, qword [r12 + 0x10]
jne 0x14001bbfe
mov rcx, r12
call fcn.14001c400
mov rax, qword [r12]
lea rcx, [rax + rdi*8]
mov rdi, qword [r12 + 8]
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x48], rdi
test rdi, rdi
je 0x14001bc2b
mov rcx, qword [rcx]
sub rcx, 0x18
call fcn.140002520
add rax, 0x18
mov qword [rdi], rax
jmp 0x14001bc5e
cmp rax, qword [r12 + 0x10]
jne 0x14001bc3c
mov rcx, r12
call fcn.14001c400
mov rdi, qword [r12 + 8]
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x58], rdi
test rdi, rdi
je 0x14001bc5e
lea rcx, [rbx - 0x18]
call fcn.140002520
add rax, 0x18
mov qword [rdi], rax
add qword [r12 + 8], 8
mov r10d, dword [0x1401b4d80]
lea r14d, [r10 + 1]
mov ecx, r14d
imul ecx, r10d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0x11
jne 0x14001bc97
dec dword [0x1401b50ec]
mov dword [rsp + 0x4c], 0x400
imul r14d, r10d
mov eax, 0x2e8ba2e9
imul r14d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r14d, edx
xor r15d, r15d
cmp r14d, 0xe
jne 0x14001bd33
mov ecx, r15d
mov eax, 0x828cbfbf
imul r10d
add edx, r10d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xfb
mov eax, r10d
sub eax, edx
cmp eax, 0xa4
je 0x14001bd2d
nop
mov eax, r10d
or eax, 0xffffffed
add r10d, eax
inc ecx
mov eax, r10d
imul eax, r10d
cmp ecx, eax
jg 0x14001bd2d
mov eax, 0x828cbfbf
imul r10d
add edx, r10d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xfb
mov eax, r10d
sub eax, edx
cmp eax, 0xa4
jne 0x14001bcf0
mov dword [0x1401b4d80], ecx
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x2b0]
call fcn.1400cd020
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001bd5c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rsp + 0x48]
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
test eax, eax
jne 0x14001bd7d
jmp 0x14001b980
mov ecx, 0x80070057
call fcn.140001920
nop
test rbx, rbx
je 0x14001bd93
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r15
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], r15d
test rbx, rbx
je 0x14001bdab
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], r15d
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14001bdcf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x70]
mov rdx, qword [rdx]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001bdea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
jmp 0x14001be04
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
nop
mov rcx, qword [rbp + 0xab0]
xor rcx, rsp
call fcn.1400c7be0
mov rbx, qword [rsp + 0xc10]
add rsp, 0xbc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret