Function at 0x140021ee0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rbx, rdx
mov qword [rsp + 0xa8], rcx
lea rcx, [rsp + 0x40]
mov rdx, r8
mov r8, r9
call fcn.1400205e0
mov dword [rsp + 0x64], 0x800
mov dword [rsp + 0xa4], 0
movzx eax, byte [0x140090df8]
mov edx, 0x800
xor ecx, ecx
call fcn.14004a280
test rax, rax
je 0x14002272a
mov r12, rax
mov qword [rsp + 0x70], 0x800
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 0
mov r14, qword [rsp + 0x48]
lea rsi, [rsp + 0x64]
lea r15, [rsp + 0xa4]
mov r13, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov rbp, qword [rsp + 0x70]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x68], rax
sub rbp, rax
nop dword [rax + rax]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r12
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
mov r9, r15
call r13
cmp eax, 0xea
jne 0x140021fdf
mov r8d, dword [rsp + 0x64]
cmp rbp, r8
jae 0x140021f90
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
call fcn.14006ab80
mov r12, qword [rsp + 0x78]
jmp 0x140021f73
mov edi, eax
test eax, eax
jne 0x140022011
mov esi, dword [rsp + 0x64]
mov qword [rsp + 0x80], rsi
mov ebx, dword [rsp + 0xa4]
cmp ebx, 0xb
jbe 0x140022053
movabs rdi, 0xde00000002
cmp qword [rsp + 0x70], 0
jne 0x140022021
jmp 0x140022035
shl rdi, 0x20
or rdi, 2
cmp qword [rsp + 0x70], 0
je 0x140022035
mov r8, qword [rsp + 0x78]
mov rcx, qword [0x140090d88]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x40], 0
je 0x140022081
mov r8, qword [rsp + 0x48]
mov rcx, qword [0x140090d88]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140022081
mov r15, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
cmp qword [rsp + 0x40], 0
je 0x140022079
mov r8, qword [rsp + 0x48]
mov rcx, qword [0x140090d88]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, r15
neg rax
jno 0x1400220ae
mov rcx, qword [rsp + 0xa8]
mov qword [rcx + 8], rdi
movabs rax, 0x8000000000000000
mov qword [rcx], rax
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp bl, 7
ja 0x140022623
movzx eax, bl
mov ecx, 0x86
bt ecx, eax
jae 0x140022623
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x68], r15
mov r8d, esi
shr r8d, 1
mov r14d, esi
and r14d, 0xfffffffe
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 1
mov qword [rsp + 0x80], 0
shr esi, 2
sub r8, rsi
jne 0x1400226d6
add r14, rdi
xor esi, esi
lea rbx, [rsp + 0x70]
mov rbp, rdi
test sil, 1
jne 0x140022210
nop
cmp rbp, r14
je 0x140022337
movzx eax, word [rbp]
add rbp, 2
mov ecx, eax
and ecx, 0xf800
cmp ecx, 0xd800
jne 0x140022227
movzx ecx, ax
cmp ecx, 0xdbff
ja 0x140022178
cmp rbp, r14
je 0x140022178
movzx ecx, word [rbp]
add rbp, 2
mov edx, ecx
add edx, 0x2000
movzx edx, dx
mov sil, 1
cmp edx, 0xfbff
ja 0x14002218d
mov r13d, ecx
jmp 0x14002217a
xor esi, esi
mov dword [rsp + 0x40], 0
mov r15d, 0xfffd
jmp 0x14002229f
movzx ecx, cx
and eax, 0x3ff
and ecx, 0x3ff
shl rax, 0x1a
movabs rdx, 0x100000000
add rax, rdx
shl ecx, 0x10
or rcx, rax
mov r15, rcx
shr r15, 0x10
mov dword [rsp + 0x40], 0
shr rax, 0x20
je 0x14002229d
mov rax, rcx
shr rax, 0x22
or al, 0xf0
mov byte [rsp + 0x40], al
mov rax, rcx
shr rax, 0x1c
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x41], al
shr ecx, 0x16
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x42], cl
and r15b, 0x3f
or r15b, 0x80
mov byte [rsp + 0x43], r15b
mov r15d, 4
jmp 0x140022299
mov eax, r13d
mov ecx, eax
and ecx, 0xf800
cmp ecx, 0xd800
je 0x140022145
movzx r15d, ax
shl eax, 0x10
cmp eax, 0x800000
jae 0x14002226e
mov rsi, qword [rsp + 0x80]
cmp rsi, qword [rsp + 0x70]
jne 0x14002224c
mov rcx, rbx
call fcn.140023670
mov rax, qword [rsp + 0x78]
mov byte [rax + rsi], r15b
inc rsi
mov qword [rsp + 0x80], rsi
xor esi, esi
test sil, 1
je 0x140022120
jmp 0x140022210
mov dword [rsp + 0x40], 0
cmp eax, 0x8000000
jae 0x14002229d
shr eax, 0x16
or al, 0xc0
mov byte [rsp + 0x40], al
and r15b, 0x3f
or r15b, 0x80
mov byte [rsp + 0x41], r15b
mov r15d, 2
xor esi, esi
jmp 0x1400222cc
xor esi, esi
mov eax, r15d
shr eax, 0xc
or al, 0xe0
mov byte [rsp + 0x40], al
mov eax, r15d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x41], al
and r15b, 0x3f
or r15b, 0x80
mov byte [rsp + 0x42], r15b
mov r15d, 3
mov rax, qword [rsp + 0x70]
mov r12, qword [rsp + 0x80]
sub rax, r12
cmp rax, r15
jb 0x140022310
mov rcx, qword [rsp + 0x78]
add rcx, r12
lea rdx, [rsp + 0x40]
mov r8, r15
call fcn.1400684b0
add r12, r15
mov qword [rsp + 0x80], r12
test sil, 1
je 0x140022120
jmp 0x140022210
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rbx
mov rdx, r12
mov r8, r15
call fcn.14006ab80
mov r12, qword [rsp + 0x80]
jmp 0x1400222e1
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov r14, qword [rsp + 0x80]
mov rbp, r14
neg rbp
test rbp, rbp
je 0x140022373
nop word cs:[rax + rax]
cmp byte [rbx + r14 - 1], 0
jne 0x140022376
dec r14
inc rbp
test rbp, rbp
jne 0x140022360
xor r14d, r14d
cmp dword [rsp + 0x58], 7
jne 0x140022606
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], 0
mov byte [rsp + 0x98], 1
lea rax, [rbx + 8]
mov qword [rsp + 0xb8], rax
neg rbp
mov ecx, 1
xor r12d, r12d
xor esi, esi
mov qword [rsp + 0x58], rsi
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x3f], al
jmp 0x1400223ff
cmp r14, rsi
jb 0x140022650
mov r13, rsi
mov r10, r14
sub r10, rsi
lea r8, [rbx + rsi]
cmp r10, 0xf
ja 0x140022448
cmp r14, r13
je 0x140022650
mov r9, rbp
sub r9, r13
xor r11d, r11d
nop word cs:[rax + rax]
cmp byte [r8 + r11], 0
je 0x140022537
inc r11
cmp r9, r11
jne 0x140022430
jmp 0x140022650
lea r9, [r8 + 7]
and r9, 0xfffffffffffffff8
sub r9, r8
jne 0x1400224c2
mov qword [rsp + 0xb0], rcx
mov rcx, r12
lea r11, [r10 - 0x10]
xor r9d, r9d
mov rax, qword [rsp + 0xb8]
lea rsi, [rax + r13]
nop word cs:[rax + rax]
mov rax, qword [rsi + r9 - 8]
mov r15, qword [rsi + r9]
movabs rdx, 0x101010101010100
mov r12, rdx
sub r12, r15
or r12, r15
sub rdx, rax
or rdx, rax
and rdx, r12
not rdx
movabs rax, 0x8080808080808080
test rdx, rax
jne 0x1400224f7
add r9, 0x10
cmp r9, r11
jbe 0x140022480
jmp 0x1400224f7
xor r11d, r11d
nop word cs:[rax + rax]
cmp byte [r8 + r11], 0
je 0x140022537
inc r11
cmp r9, r11
jne 0x1400224d0
mov qword [rsp + 0xb0], rcx
mov rcx, r12
lea r11, [r10 - 0x10]
cmp r9, r11
jbe 0x140022467
cmp r9, r10
mov r12, rcx
mov rcx, qword [rsp + 0xb0]
je 0x140022648
add r8, r9
mov r10, rbp
sub r10, r13
sub r10, r9
xor r11d, r11d
nop word [rax + rax]
cmp byte [r8 + r11], 0
je 0x140022534
inc r11
cmp r10, r11
jne 0x140022520
jmp 0x140022648
add r11, r9
add r13, r11
mov rsi, r13
inc rsi
je 0x1400223f6
cmp rsi, r14
ja 0x1400223f6
movzx eax, byte [rsp + 0x3f]
cmp byte [rbx + r13], al
jne 0x1400223f6
sub r13, qword [rsp + 0x58]
mov rax, qword [rsp + 0x40]
sub rax, r12
cmp rax, r13
jb 0x1400225b2
mov rdx, qword [rsp + 0x58]
add rdx, rbx
add rcx, r12
mov r8, r13
call fcn.1400684b0
add r12, r13
mov qword [rsp + 0x50], r12
cmp qword [rsp + 0x40], r12
je 0x1400225dd
mov rcx, qword [rsp + 0x48]
mov byte [rcx + r12], 0xa
inc r12
mov qword [rsp + 0x50], r12
cmp r14, rsi
jae 0x1400223e3
jmp 0x140022655
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rsp + 0x40]
mov rdx, r12
mov r8, r13
call fcn.14006ab80
mov rcx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
jmp 0x140022570
mov qword [rsp + 0x20], 1
mov r8d, 1
mov r9d, 1
lea rcx, [rsp + 0x40]
mov rdx, r12
call fcn.14006ab80
mov r12, qword [rsp + 0x50]
jmp 0x140022592
mov rax, qword [rsp + 0xa8]
mov qword [rax], rcx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r14
mov r15, qword [rsp + 0x68]
jmp 0x1400226b6
movabs rax, 0xde00000002
mov rcx, qword [rsp + 0xa8]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rcx], rax
jmp 0x1400226b6
mov qword [rsp + 0x80], r13
mov rsi, qword [rsp + 0x58]
lea rdx, [rbx + rsi]
sub r14, rsi
mov rax, qword [rsp + 0x40]
sub rax, r12
cmp rax, r14
jb 0x1400226f6
mov r15, qword [rsp + 0x68]
add rcx, r12
mov r8, r14
call fcn.1400684b0
add r12, r14
mov qword [rsp + 0x50], r12
movups xmm0, xmmword [rsp + 0x40]
mov rax, qword [rsp + 0xa8]
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
cmp qword [rsp + 0xc0], 0
je 0x1400226b6
mov rcx, qword [0x140090d88]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
test r15, r15
je 0x14002209a
mov rcx, qword [0x140090d88]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14002209a
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0x70]
mov r9d, 1
xor edx, edx
call fcn.14006ab80
jmp 0x140022108
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0x40]
mov r9d, 1
mov rsi, rdx
mov rdx, r12
mov r8, r14
call fcn.14006ab80
mov rdx, rsi
mov rcx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
jmp 0x14002266d
mov ecx, 1
mov edx, 0x800
call fcn.140069052
int3