Function at 0x14004cd00
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x120
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rsi, r9
mov rdi, r8
mov r15, rdx
mov r14, rcx
mov r9d, dword [0x1401cbd80]
lea r10d, [r9 + 2]
lea eax, [r9 + 1]
imul r10d, eax
imul r10d, r9d
mov eax, 0x38e38e39
imul r10d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub r10d, eax
cmp r10d, 8
jne 0x14004cd78
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor r12d, r12d
mov ebx, r12d
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004cf73
mov dword [rsp + 0x48], r12d
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rbx
mov rax, qword [r14]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, 0x800
or eax, ecx
jge 0x14004cdec
mov edx, 0x800
mov rcx, r14
call fcn.1400023b0
mov rsi, qword [r14]
cmp dword [rsi - 0xc], 0x800
jge 0x14004ce03
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rsi - 0x10], 0x800
mov rax, qword [r14]
mov word [rax + 0x1000], r12w
mov dword [rsp + 0x30], 0x1000
mov ebp, r12d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14004ce8b
mov eax, dword [rsp + 0x38]
dec eax
cmp eax, 1
jbe 0x14004ce5b
mov edi, 0xd
jmp 0x14004ce8b
mov ecx, dword [rsp + 0x30]
test rsi, rsi
je 0x14004ce84
test ecx, ecx
je 0x14004ce80
test cl, 1
jne 0x14004ce79
mov eax, ecx
shr rax, 1
cmp word [rsi + rax*2 - 2], bp
je 0x14004ce84
mov edi, 0xd
jmp 0x14004ce8b
mov word [rsi], r12w
mov ebp, ecx
shr ebp, 1
mov edi, r12d
call fcn.1400493c0
test al, al
jne 0x14004cea9
mov edx, 0xe8
lea r8d, [rdx + 1]
lea rcx, str._d__d_n
call fcn.1400d1f8c
lea eax, [rbp - 1]
cmp eax, 0xffffffff
jne 0x14004cec7
mov rcx, qword [r14]
test rcx, rcx
jne 0x14004cebe
mov eax, r12d
jmp 0x14004cecf
movsxd rdx, dword [rcx - 0xc]
call fcn.1400d226c
test eax, eax
js 0x14004cf68
mov rcx, qword [r14]
cmp eax, dword [rcx - 0xc]
jg 0x14004cf68
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [r14]
mov word [rax + rcx*2], r12w
test rbx, rbx
je 0x14004ceff
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r12
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], r12d
mov ecx, dword [0x1401cbd80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 0x11
jne 0x14004cf60
mov eax, 0x94
mov r8d, 0x80
test r8d, r8d
je 0x14004cf57
mov ecx, r8d
cdq
idiv r8d
mov r8d, edx
mov eax, ecx
test ecx, ecx
jne 0x14004cf42
add eax, r8d
mov dword [0x1401cbd80], eax
test edi, edi
sete dil
jmp 0x14004cf76
mov ecx, 0x80070057
call fcn.140001920
int3
xor dil, dil
test rbx, rbx
je 0x14004cf89
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x48], r12d
movzx eax, dil
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x120
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret