Function at 0x1400985d4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r15, r8
mov rbx, rdx
mov r14, rcx
lea rdi, section..data
mov rcx, qword [section..data]
cmp rcx, rdi
je 0x140098627
test byte [rcx + 0x1c], 1
je 0x140098627
cmp byte [rcx + 0x19], 5
jb 0x140098627
mov edx, 0x37
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.14009a1ac
mov rdx, rbx
mov rcx, r14
call fcn.140098f60
mov esi, eax
mov rcx, qword [section..data]
cmp rcx, rdi
je 0x140098661
test byte [rcx + 0x1c], 2
je 0x140098661
cmp byte [rcx + 0x19], 5
jb 0x140098661
mov edx, 0x38
mov dword [rsp + 0x20], eax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.14009a1ac
xor edi, edi
mov eax, 0x490
test esi, esi
cmove edi, eax
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.140005058
nop
lea rcx, [rbp - 0x28]
call fcn.1400304d8
xor esi, esi
mov qword [rbp - 0x20], rsi
and qword [rbp - 0x18], rsi
and qword [rbp - 0x10], rsi
test edi, edi
jne 0x1400986e1
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, r14
call fcn.140099454
mov edi, eax
mov rcx, qword [section..data]
lea r14, section..data
cmp rcx, r14
je 0x1400986db
test byte [rcx + 0x1c], 2
je 0x1400986db
cmp byte [rcx + 0x19], 4
jb 0x1400986db
lea edx, [rsi + 0x39]
mov r9d, eax
lea r8, [0x1400bd838]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
mov rsi, qword [rbp - 0x20]
jmp 0x1400986e8
lea r14, section..data
and dword [r15], 0
and dword [rbp + 0x40], 0
mov rbx, qword [rbp - 0x28]
test edi, edi
jne 0x140098899
lea r14d, [rdi + 4]
mov dword [rbp + 0x48], r14d
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140098742
mov eax, dword [rbp - 0x30]
sub eax, r14d
neg eax
sbb edi, edi
and edi, 0xd
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x14009878b
test byte [rcx + 0x1c], 2
je 0x14009878b
cmp byte [rcx + 0x19], r14b
jb 0x14009878b
mov edx, 0x3a
mov dword [rsp + 0x28], edi
mov eax, dword [rbp + 0x40]
mov dword [rsp + 0x20], eax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.14009a0e4
mov rcx, qword [section..data]
lea rax, section..data
cmp edi, 2
jne 0x140098859
xor edi, edi
cmp rcx, rax
je 0x140098802
test byte [rcx + 0x1c], 2
je 0x1400987c1
cmp byte [rcx + 0x19], r14b
jb 0x1400987c1
lea edx, [rdi + 0x3b]
lea r8, [0x1400bd838]
mov rcx, qword [rcx + 0x10]
call fcn.1400062b0
mov rcx, qword [section..data]
lea r14, section..data
cmp rcx, r14
je 0x140098802
test byte [rcx + 0x1c], 1
je 0x140098802
movzx r9d, byte [rcx + 0x19]
mov eax, edi
neg eax
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp r9d, edx
jb 0x140098802
mov edx, 0x3d
mov r9d, edi
lea r8, [0x1400bd838]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
nop
test rsi, rsi
je 0x140098817
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140098842
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
mov eax, edi
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
test edi, edi
jne 0x1400987c1
cmp dword [rbp + 0x40], edi
je 0x1400987c1
mov dword [r15], 1
mov rcx, qword [section..data]
cmp rcx, rax
je 0x140098802
test byte [rcx + 0x1c], 2
je 0x1400987c1
cmp byte [rcx + 0x19], r14b
jb 0x1400987c1
lea edx, [rdi + 0x3c]
jmp 0x1400987aa
mov rcx, qword [section..data]
jmp 0x1400987c8