Function at 0x14003fe50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rax, qword [0x14020b948]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rdi, r9
mov ebx, edx
mov rsi, rcx
mov qword [rbp - 0x61], rcx
xor r13d, r13d
mov dword [rsp + 0x58], r13d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], 0xf
mov byte [rcx], r13b
mov dword [rsp + 0x58], 1
mov rdx, r8
lea rcx, [rbp - 0x39]
call fcn.14003a290
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x14003fec4
mov rdx, qword [rax]
test ebx, ebx
je 0x14003fedf
sub ebx, 1
je 0x14003fed6
mov rcx, 0xffffffff80000001
jmp 0x14003fee6
mov rcx, 0xffffffff80000002
jmp 0x14003fee6
mov rcx, 0xffffffff80000000
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x14003ff41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ff3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040449
call fcn.1400fc768
test ebx, ebx
jne 0x140040408
mov rdx, rdi
lea rcx, [rbp - 0x39]
call fcn.14003a290
cmp qword [rax + 0x18], 8
jb 0x14003ff5f
mov rax, qword [rax]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r13
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, 0xffff
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, eax
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x14003ffd0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ffcb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004044f
call fcn.1400fc768
test ebx, ebx
jne 0x140040408
mov edx, dword [rsp + 0x40]
inc edx
lea r8, [rsp + 0x44]
lea rcx, [rbp - 0x79]
call fcn.14003f920
nop
mov rax, qword [rbp - 0x71]
mov r14, qword [rbp - 0x79]
sub rax, r14
mov dword [rsp + 0x40], eax
mov ecx, dword [rsp + 0x48]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x140040228
cmp ecx, 4
jne 0x1400403d3
mov rdx, rdi
lea rcx, [rbp - 0x39]
call fcn.14003a290
cmp qword [rax + 0x18], 8
jb 0x14004002b
mov rax, qword [rax]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, 0x10
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x14004009a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040095
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040455
call fcn.1400fc768
mov r8d, dword [r14]
lea r12, [rbp + 0x1c]
dec r12
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r12], r8b
mov r8d, edx
test edx, edx
jne 0x1400400a1
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
lea rax, [rbp + 0x1c]
cmp r12, rax
jne 0x1400400f1
mov qword [rbp - 0x49], r13
mov edi, 0xf
mov qword [rbp - 0x41], rdi
mov byte [rbp - 0x59], dl
jmp 0x140040182
lea r15, [rbp + 0x1c]
sub r15, r12
movabs rdi, 0x7fffffffffffffff
cmp r15, rdi
ja 0x14004045b
cmp r15, 0x10
jae 0x140040138
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x41], 0xf
mov r8, r15
mov rdx, r12
lea rcx, [rbp - 0x59]
call fcn.1400fe780
mov byte [rbp + r15 - 0x59], 0
mov rdi, qword [rbp - 0x41]
jmp 0x140040182
mov rax, r15
or rax, 0xf
cmp rax, rdi
ja 0x140040153
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rdx, [rdi + 1]
lea rcx, [rbp - 0x59]
call fcn.140008ef0
mov rbx, rax
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x41], rdi
mov r8, r15
mov rdx, r12
mov rcx, rax
call fcn.1400fe780
mov byte [rbx + r15], 0
lea rax, [rbp - 0x59]
cmp rsi, rax
je 0x1400401e8
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x1400401c5
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x1400401c0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140040443
mov rcx, r8
call fcn.1400fc768
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
movups xmm0, xmmword [rbp - 0x59]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbp - 0x49]
movups xmmword [rsi + 0x10], xmm1
mov edi, 0xf
mov byte [rbp - 0x59], 0
cmp rdi, 0x10
jb 0x1400403d3
lea rdx, [rdi + 1]
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400403cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040443
jmp 0x1400403cd
mov rdx, rdi
lea rcx, [rbp - 0x19]
call fcn.14003a290
cmp qword [rax + 0x18], 8
jb 0x14004023e
mov rax, qword [rax]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, 0xffff
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x1400402ad
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400402a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040461
call fcn.1400fc768
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp word [r14 + r8*2], 0
jne 0x1400402c3
mov rdx, r14
lea rcx, [rbp - 0x39]
call fcn.14003f850
nop
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x19]
call fcn.14003a160
mov rbx, rax
cmp rsi, rax
je 0x140040356
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14004032a
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x140040325
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140040467
mov rcx, r8
call fcn.1400fc768
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x140040392
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004038c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040467
call fcn.1400fc768
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x1400403d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400403cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004046d
call fcn.1400fc768
nop
test r14, r14
je 0x140040408
mov rdx, qword [rbp - 0x69]
sub rdx, r14
mov rax, r14
cmp rdx, 0x1000
jb 0x140040400
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004043d
mov rcx, r14
call fcn.1400fc768
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rsi
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1400fc880
mov rbx, qword [rsp + 0x148]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1401033e4
nop
call fcn.1401033e4
nop
call fcn.1401033e4
int3
call fcn.1401033e4
nop
call fcn.1401033e4
int3
call fcn.140008eb0
int3
call fcn.1401033e4
nop
call fcn.1401033e4
nop
call fcn.1401033e4
int3