Function at 0x140039000
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xb8
movsxd r12, r9d
mov rbx, qword [rbp + 0x77]
mov byte [rbp + 0x4f], 1
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x140039543
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x49], rax
mov r14, 0xffffffffffffffff
test rbx, rbx
je 0x14003908e
mov rdi, rbx
shr rdi, 0x10
test rdi, rdi
jne 0x14003907e
movzx esi, bx
mov edx, esi
lea rcx, [rbp - 0x49]
call fcn.1400058a0
jmp 0x1400390a7
mov r8, r14
inc r8
cmp word [rbx + r8*2], 0
jne 0x140039081
jmp 0x140039091
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 0x49]
call fcn.140005a90
mov rdi, rbx
shr rdi, 0x10
movzx esi, bx
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x14003954e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x51], rax
test rbx, rbx
je 0x1400390f0
test rdi, rdi
jne 0x1400390e0
movzx esi, si
mov edx, esi
lea rcx, [rbp - 0x51]
call fcn.1400058a0
jmp 0x140039102
mov r8, r14
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400390e3
jmp 0x1400390f3
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 0x51]
call fcn.140005a90
movzx esi, si
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x140039559
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x59], rax
test rbx, rbx
je 0x14003914d
test rdi, rdi
jne 0x140039138
mov edx, esi
lea rcx, [rbp - 0x59]
call fcn.1400058a0
jmp 0x14003915d
mov r8, r14
nop dword [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140039140
jmp 0x140039150
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 0x59]
call fcn.140005a90
nop
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x140039538
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x41], rax
test rbx, rbx
je 0x1400391ad
test rdi, rdi
jne 0x140039193
mov edx, esi
lea rcx, [rbp - 0x41]
call fcn.1400058a0
jmp 0x1400391bd
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400391a0
jmp 0x1400391b0
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 0x41]
call fcn.140005a90
nop
mov r8d, 7
lea rdx, str.Version
lea rcx, [rbp - 0x49]
call fcn.140005c50
mov r8d, 5
lea rdx, str.Order
lea rcx, [rbp - 0x51]
call fcn.140005c50
mov r8d, 5
lea rdx, str.Sizes
lea rcx, [rbp - 0x59]
call fcn.140005c50
mov r8d, 4
lea rdx, str.Sort
lea rcx, [rbp - 0x41]
call fcn.140005c50
xor r9d, r9d
lea r8, [rbp - 0x29]
mov rdx, qword [rbp - 0x49]
lea rcx, [0x14017c4f0]
call fcn.1400736a0
mov rdi, qword [rbp - 0x51]
mov rsi, qword [rbp - 0x59]
mov rbx, qword [rbp - 0x41]
mov eax, dword [rbp - 0x29]
cmp dword [rbp + 0x6f], eax
je 0x140039282
mov r9, rdi
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000001
call fcn.140088840
mov r9, rsi
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000001
call fcn.140088840
mov r9, rbx
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000001
call fcn.140088840
mov r15, r12
mov eax, 4
mul r12
cmovo rax, r14
mov rcx, rax
call fcn.1400ff0c4
mov qword [rbp - 0x31], rax
mov eax, 4
mul r12
cmovo rax, r14
mov rcx, rax
call fcn.1400ff0c4
mov r13, rax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400392ff
xor sil, sil
jmp 0x1400394a1
mov dword [rbp - 0x5d], 3
lea r12d, [r12*4]
mov dword [rbp - 0x61], r12d
lea rax, [rbp - 0x61]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x31]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x5d]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003938a
cmp dword [rbp - 0x5d], 3
jne 0x14003938a
lea rdi, [r15*4]
mov eax, dword [rbp - 0x61]
cmp rax, rdi
jne 0x14003938a
mov r9, qword [rbp - 0x31]
mov r8, r15
mov edx, 0x103a
mov rcx, qword [rbp + 0x57]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp qword [rbp + 0x5f], 0
je 0x140039397
mov r9, qword [rbp - 0x31]
mov r8, r15
mov edx, 0x103a
mov r15, qword [rbp + 0x5f]
mov rcx, r15
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14003939b
xor al, al
mov byte [rbp + 0x4f], al
lea rdi, [r15*4]
mov r15, qword [rbp + 0x5f]
mov dword [rbp - 0x5d], 3
mov dword [rbp - 0x61], r12d
lea rax, [rbp - 0x61]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x5d]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140039530
cmp dword [rbp - 0x5d], 3
jne 0x140039530
mov eax, dword [rbp - 0x61]
cmp rax, rdi
jne 0x140039530
mov r9d, r12d
mov r8, r13
mov edi, dword [rbp + 0x67]
mov edx, edi
mov rcx, qword [rbp + 0x57]
call fcn.14007e090
test r15, r15
je 0x14003940f
mov r9d, r12d
mov r8, r13
mov edx, edi
mov rcx, r15
call fcn.14007e090
movzx esi, byte [rbp + 0x4f]
mov rdi, qword [rbp + 0x7f]
mov eax, dword [rdi]
mov dword [rbp - 0x21], eax
lea rax, [rbp - 0x61]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x5d]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003947b
cmp dword [rbp - 0x61], 0xc
jne 0x14003947b
cmp dword [rbp - 0x19], 0x10909090
jne 0x14003947b
movsxd rax, dword [rbp - 0x21]
mov r8, rax
cmp rax, 0x1f
jae 0x14003947b
mov rcx, qword [rbp + 0x87]
test rcx, rcx
je 0x14003947b
mov dword [rdi], eax
cmp dword [rbp - 0x1d], 0
setne al
mov byte [r8 + rcx], al
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 4
mov rcx, qword [rbp - 0x31]
call fcn.1400ff054
mov edx, 4
mov rcx, r13
call fcn.1400ff054
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400394bc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400394db
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400394fa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140039518
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, sil
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor sil, sil
jmp 0x140039413
mov ecx, 0x80004005
call fcn.140002b00
nop
mov ecx, 0x80004005
call fcn.140002b00
nop
mov ecx, 0x80004005
call fcn.140002b00
nop
mov ecx, 0x80004005
call fcn.140002b00
int3