Function at 0x1400049c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8030]
mov eax, 0x8130
call fcn.1400286a0
sub rsp, rax
mov rax, qword [0x140067080]
xor rax, rsp
mov qword [rbp + 0x8020], rax
mov qword [rbp - 0x70], r9
mov rsi, r8
mov qword [rsp + 0x48], r8
mov r13, rdx
mov qword [rsp + 0x78], rdx
mov r14, rcx
mov qword [rbp - 0x78], rcx
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov dword [rbp - 0x20], 0x3fff
mov r15d, ebx
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x20]
lea r8, [rbp + 0x20]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1400050ab
mov dword [rbp - 0x28], ebx
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x24]
xor r8d, r8d
lea rdx, [rbp + 0x20]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000506c
mov ecx, dword [rbp - 0x24]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x140004a92
cmp ecx, 7
jne 0x14000506c
xorps xmm0, xmm0
mov edi, dword [rbp - 0x28]
movdqu xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], rbx
test rdi, rdi
je 0x140004b02
cmp rdi, 0x1000
jb 0x140004adb
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x1400050e1
call fcn.140027cd8
mov rcx, rax
test rax, rax
je 0x1400050db
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140004ae3
mov rcx, rdi
call fcn.140027cd8
mov qword [rbp + 8], rax
lea rbx, [rax + rdi]
mov qword [rbp + 0x18], rbx
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.14004d600
mov qword [rbp + 0x10], rbx
xor ebx, ebx
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 8]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x24]
xor r8d, r8d
lea rdx, [rbp + 0x20]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005034
xor r12b, r12b
mov byte [rsp + 0x40], r12b
mov ecx, dword [rbp - 0x24]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x140004e4a
cmp ecx, 7
jne 0x140004cae
mov r15, qword [rbp + 8]
mov eax, dword [rbp - 0x28]
shr rax, 1
lea r14, [r15 + rax*2]
mov qword [rbp - 0x80], r14
cmp r15, r14
jae 0x140004cae
nop dword [rax + rax]
cmp word [r15], 0
je 0x140004ca9
mov rdx, r14
sub rdx, r15
sar rdx, 1
mov rcx, r15
call fcn.14002d768
mov r13, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
mov r8, rax
mov rdx, r15
lea rcx, [rsp + 0x58]
call fcn.14000f4d0
mov rbx, qword [rsi]
mov r12, qword [rsi + 8]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x58]
cmp rbx, r12
je 0x140004c48
mov r14, qword [rsp + 0x68]
mov rax, qword [rbx + 0x50]
lea r9, [rbx + 0x40]
cmp qword [rbx + 0x58], 7
jbe 0x140004be2
mov r9, qword [r9]
lea rcx, [rsp + 0x58]
cmp rsi, 7
cmova rcx, rdi
mov qword [rsp + 0x20], rax
mov rdx, r14
call fcn.14000f2c0
cmp rax, 0xffffffffffffffff
jne 0x140004e39
mov rax, qword [rbx + 0x10]
mov r9, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140004c17
mov r9, qword [rbx]
lea rcx, [rsp + 0x58]
cmp rsi, 7
cmova rcx, rdi
mov qword [rsp + 0x20], rax
mov rdx, r14
call fcn.14000f2c0
cmp rax, 0xffffffffffffffff
jne 0x140004e39
sub rbx, 0xffffffffffffff80
cmp rbx, r12
jne 0x140004bd0
mov r14, qword [rbp - 0x80]
movzx r12d, byte [rsp + 0x40]
cmp rsi, 7
jbe 0x140004c89
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140004c81
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400050e7
mov rcx, rdi
call fcn.140027a30
mov rsi, qword [rsp + 0x48]
test r12b, r12b
jne 0x140004ca9
lea r15, [r15 + r13*2]
add r15, 2
cmp r15, r14
mov ebx, 0
jb 0x140004b70
mov r13, qword [rsp + 0x78]
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
xor eax, eax
mov qword [rbp - 8], rax
mov qword [rbp], rax
lea rax, [rbp + 0x20]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140004cd0
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x18]
call fcn.14000f4d0
nop
mov rbx, qword [rsi]
mov r15, qword [rsi + 8]
mov rsi, qword [rbp]
mov rdi, qword [rbp - 0x18]
cmp rbx, r15
je 0x140004d6b
mov r14, qword [rbp - 8]
mov rax, qword [rbx + 0x50]
lea r9, [rbx + 0x40]
cmp qword [rbx + 0x58], 7
jbe 0x140004d13
mov r9, qword [r9]
lea rcx, [rbp - 0x18]
cmp rsi, 7
cmova rcx, rdi
mov qword [rsp + 0x20], rax
mov rdx, r14
call fcn.14000f2c0
cmp rax, 0xffffffffffffffff
jne 0x140004d74
mov rax, qword [rbx + 0x10]
mov r9, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140004d43
mov r9, qword [rbx]
lea rcx, [rbp - 0x18]
cmp rsi, 7
cmova rcx, rdi
mov qword [rsp + 0x20], rax
mov rdx, r14
call fcn.14000f2c0
cmp rax, 0xffffffffffffffff
jne 0x140004d74
sub rbx, 0xffffffffffffff80
cmp rbx, r15
jne 0x140004d01
test r12b, r12b
je 0x140004feb
mov rcx, qword [r13 + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 1
jb 0x1400050ff
mov r9, r13
cmp qword [r13 + 0x18], 7
jbe 0x140004d9d
mov r9, qword [r13]
mov qword [rsp + 0x30], 1
lea rax, [0x14005c074]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x48]
call fcn.140014430
mov r12d, dword [rsp + 0x50]
or r12d, 1
lea rdx, [rbp - 0x18]
cmp qword [rbp], 7
cmova rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 8]
lea rcx, [rbp - 0x48]
call fcn.140014d60
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 7
mov word [rax], cx
or r12d, 2
mov dword [rsp + 0x50], r12d
mov r15, qword [rbp - 0x70]
mov rdx, qword [r15 + 8]
cmp rdx, qword [r15 + 0x10]
je 0x140004f56
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rbp - 0x68], cx
add qword [r15 + 8], 0x20
jmp 0x140004f66
mov r12b, 1
mov byte [rsp + 0x40], r12b
mov r14, qword [rbp - 0x80]
jmp 0x140004c4e
mov rbx, qword [rbp + 8]
mov edx, dword [rbp - 0x28]
shr rdx, 1
mov rcx, rbx
call fcn.14002d768
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xor ecx, ecx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rcx
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14000f4d0
mov rbx, qword [rsi]
mov r15, qword [rsi + 8]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x58]
cmp rbx, r15
je 0x140004f11
mov r14, qword [rsp + 0x68]
nop dword [rax + rax]
mov rax, qword [rbx + 0x50]
lea r9, [rbx + 0x40]
cmp qword [rbx + 0x58], 7
jbe 0x140004eb2
mov r9, qword [r9]
lea rcx, [rsp + 0x58]
cmp rsi, 7
cmova rcx, rdi
mov qword [rsp + 0x20], rax
mov rdx, r14
call fcn.14000f2c0
cmp rax, 0xffffffffffffffff
jne 0x140004f0e
mov rax, qword [rbx + 0x10]
mov r9, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140004ee3
mov r9, qword [rbx]
lea rcx, [rsp + 0x58]
cmp rsi, 7
cmova rcx, rdi
mov qword [rsp + 0x20], rax
mov rdx, r14
call fcn.14000f2c0
cmp rax, 0xffffffffffffffff
jne 0x140004f0e
sub rbx, 0xffffffffffffff80
cmp rbx, r15
jne 0x140004ea0
jmp 0x140004f11
mov r12b, 1
cmp rsi, 7
jbe 0x140004f4c
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140004f44
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400050ed
mov rcx, rdi
call fcn.140027a30
mov rsi, qword [rsp + 0x48]
jmp 0x140004cae
lea r8, [rbp - 0x68]
mov rcx, r15
call fcn.140015a80
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x140004fa3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400050f3
call fcn.140027a30
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x140004fe3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004fde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400050f9
call fcn.140027a30
mov rdi, qword [rbp - 0x18]
mov rsi, qword [rbp]
cmp rsi, 7
jbe 0x140005026
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000501e
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400050d5
mov rcx, rdi
call fcn.140027a30
mov r15d, dword [rsp + 0x44]
mov r14, qword [rbp - 0x78]
mov rsi, qword [rsp + 0x48]
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x14000506a
mov rdx, qword [rbp + 0x18]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005065
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400050db
call fcn.140027a30
xor ebx, ebx
inc r15d
mov dword [rsp + 0x44], r15d
mov dword [rbp - 0x20], 0x3fff
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x20]
lea r8, [rbp + 0x20]
mov edx, r15d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x140004a51
mov rcx, qword [rbp + 0x8020]
xor rcx, rsp
call fcn.140027a10
mov rbx, qword [rsp + 0x8180]
add rsp, 0x8130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140033f90
nop
call fcn.140033f90
int3
call fcn.140001690
nop
call fcn.140033f90
int3
call fcn.140033f90
nop
call fcn.140033f90
nop
call fcn.140033f90
int3
call fcn.140001730
int3