Function at 0x1400419b0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
lea rax, [0x14017cfe7]
mov qword [rsp + 0x50], rax
lea rax, [0x14017d013]
mov qword [rsp + 0x58], rax
mov word [rsp + 0x60], 0
mov dword [rsp + 0x68], 1
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x50]
call fcn.14004ee70
add rsi, rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x60], 0
mov dword [rsp + 0x68], 1
lea rcx, [rsp + 0x88]
lea rsi, [rsp + 0x50]
mov rdx, rsi
call fcn.14004ee70
mov rdi, qword [rsp + 0xa8]
call fcn.140063410
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], rsi
mov rcx, 0xffffffff80000002
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x20019
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x140041a9d
movabs rax, 0x8000000000000000
mov qword [rbx], rax
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x140041ca7
mov rcx, qword [rsp + 0x90]
add rdx, rdx
mov r8d, 2
jmp 0x140041ca2
mov rsi, qword [rsp + 0x50]
mov dword [rsp + 0x34], 0x800
mov rax, qword [0x1401a9e18]
movzx eax, byte [rax]
mov ecx, 0x800
mov edx, 1
call fcn.140011db0
test rax, rax
je 0x140041d2c
mov r15, rax
mov qword [rsp + 0x70], 0x800
mov qword [rsp + 0x78], rax
mov r14, qword [rsp + 0x90]
mov dword [rsp + 0x38], 0
lea r12, [rsp + 0x34]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x140041bd4
lea r13, [rsp + 0x38]
lea rbp, [rsp + 0x70]
jmp 0x140041b5c
mov r15, qword [rsp + 0x78]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
mov r9, r13
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x140041bd4
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14006e4f0
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], edx
mov qword [rsp + 0x50], 1
cmp edx, 0x800700ea
jne 0x140041cda
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], 0x800700ea
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x80], rdx
mov r8d, dword [rsp + 0x34]
test r8, r8
je 0x140041bbe
mov rcx, rbp
call fcn.1400429a0
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140041b30
mov rcx, r13
call fcn.14006ef90
jmp 0x140041b30
mov r12d, dword [rsp + 0x34]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], 0
mov r8d, r12d
shr r8d, 2
bt r12d, 1
adc r8, 0
je 0x140041c12
lea rcx, [rsp + 0x38]
xor edx, edx
call fcn.1400429a0
and r12d, 0xfffffffe
add r12, r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r12
mov word [rsp + 0x60], 0
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x38]
call fcn.140023f10
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140041c5c
nop dword [rax]
cmp byte [rcx + rdx - 1], 0
jne 0x140041c5e
dec rdx
jne 0x140041c50
xor edx, edx
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140041c81
mov r8d, 1
mov rcx, r15
call fcn.140011dc0
mov rcx, rsi
call sub.advapi32.dll_RegCloseKey
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x140041ca7
add rdx, rdx
mov r8d, 2
mov rcx, r14
call fcn.140011dc0
mov rdx, qword [rsp + 0xa0]
test rdx, rdx
je 0x140041cc5
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140011dc0
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs rcx, 0x8000000000000000
mov qword [rbx], rcx
test rax, rax
je 0x140041cf6
lea rcx, [rsp + 0x58]
call fcn.14006ef90
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140041d0e
mov r8d, 1
mov rcx, r15
call fcn.140011dc0
mov rcx, rsi
call sub.advapi32.dll_RegCloseKey
mov rdx, qword [rsp + 0x88]
test rdx, rdx
jne 0x140041a87
jmp 0x140041ca7
mov ecx, 1
mov edx, 0x800
call fcn.1400f33e0
ud2