Function at 0x140083570
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x490]
sub rsp, 0x590
mov rax, qword [0x140173040]
xor rax, rsp
mov qword [rbp + 0x480], rax
mov rbx, r8
mov r15, rdx
mov r14, rcx
xor r13d, r13d
mov qword [rsp + 0x40], r13
lea rcx, [rsp + 0x40]
call fcn.1400055e0
nop
mov qword [rsp + 0x48], r13
lea rcx, [rsp + 0x48]
call fcn.1400055e0
nop
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.14012ce40
lea rdi, [r13 - 1]
lea r12d, [r13 + 1]
test r15, r15
jne 0x140083681
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
mov rdx, qword [r14 + 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008369c
mov dword [rsp + 0x68], 0x80
mov dword [rsp + 0x6c], r12d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6c]
xor r8d, r8d
lea rdx, [0x14014aae0]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140083662
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14008369c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x80]
mov r8, rdi
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140083670
lea rdx, [rbp - 0x80]
jmp 0x140083692
mov r8, rdi
inc r8
cmp word [r15 + r8*2], 0
jne 0x140083684
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.140005a90
test rbx, rbx
jne 0x1400836d5
mov word [rbp - 0x80], r13w
mov r9d, 0x80
lea r8, [rbp - 0x80]
mov rcx, r14
call fcn.140084ac0
cmp al, r12b
jne 0x1400836f8
lea rax, [rbp - 0x80]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x1400836c4
lea rdx, [rbp - 0x80]
jmp 0x1400836ee
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400836e0
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140005a90
lea rcx, [rsp + 0x48]
call fcn.140005330
mov rsi, qword [rsp + 0x48]
mov rbx, r13
movzx eax, word [rsi]
test ax, ax
je 0x140083796
movzx ecx, ax
call fcn.14010b094
test eax, eax
je 0x140083731
mov rax, rsi
test rbx, rbx
cmovne rax, rbx
mov rbx, rax
jmp 0x140083734
mov rbx, r13
add rsi, 2
movzx eax, word [rsi]
test ax, ax
jne 0x140083716
test rbx, rbx
je 0x140083791
mov rax, qword [rsp + 0x48]
sub rbx, rax
sar rbx, 1
test ebx, ebx
js 0x140083c2e
mov edx, r12d
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, ebx
or ecx, edx
jge 0x140083778
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.140005a20
mov rax, qword [rsp + 0x48]
cmp ebx, dword [rax - 0xc]
jg 0x140083c2e
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rsp + 0x48]
mov word [rax + rcx*2], r13w
mov rsi, qword [rsp + 0x48]
cmp dword [rsi - 0x10], 0
jne 0x1400837a5
lea rdx, [rsi - 0x18]
jmp 0x140083a9c
lea rcx, [rsp + 0x40]
call fcn.140005330
mov rsi, qword [rsp + 0x40]
mov rbx, r13
movzx eax, word [rsi]
test ax, ax
je 0x140083843
movzx ecx, ax
call fcn.14010b094
test eax, eax
je 0x1400837de
mov rax, rsi
test rbx, rbx
cmovne rax, rbx
mov rbx, rax
jmp 0x1400837e1
mov rbx, r13
add rsi, 2
movzx eax, word [rsi]
test ax, ax
jne 0x1400837c3
test rbx, rbx
je 0x14008383e
mov rax, qword [rsp + 0x40]
sub rbx, rax
sar rbx, 1
test ebx, ebx
js 0x140083c2e
mov edx, r12d
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, ebx
or ecx, edx
jge 0x140083825
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.140005a20
mov rax, qword [rsp + 0x40]
cmp ebx, dword [rax - 0xc]
jg 0x140083c2e
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rsp + 0x40]
mov word [rax + rcx*2], r13w
mov rsi, qword [rsp + 0x40]
cmp dword [rsi - 0x10], 0
jne 0x140083868
lea rdx, str.Unspecified
mov r8, rdi
inc r8
cmp word [rdx + r8*2], 0
jne 0x140083853
lea rcx, [rsp + 0x40]
call fcn.140005a90
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x80]
call fcn.14012ce40
lea r8, str.https:__activate.bitsum.com__
mov edx, 0x200
lea rcx, [rbp + 0x80]
call fcn.140114274
mov qword [rsp + 0x58], r13
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x58]
call fcn.14003f4f0
nop
mov rcx, qword [rsp + 0x58]
movsxd rbx, dword [rcx - 0x10]
test ebx, ebx
js 0x140083c23
mov edx, r12d
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, ebx
or eax, edx
jge 0x1400838da
mov edx, ebx
lea rcx, [rsp + 0x58]
call fcn.140005a20
mov rcx, qword [rsp + 0x58]
lea eax, [rbx + 1]
movsxd rdx, eax
call fcn.140115da0
mov rax, qword [rsp + 0x58]
cmp ebx, dword [rax - 0xc]
jg 0x140083c23
mov dword [rax - 0x10], ebx
mov rax, qword [rsp + 0x58]
mov word [rax + rbx*2], r13w
mov qword [rsp + 0x50], r13
lea rcx, [rsp + 0x50]
call fcn.1400055e0
nop
mov word [rbp - 0x80], r13w
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
mov rdx, qword [r14 + 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008397f
mov dword [rsp + 0x70], 0x80
mov dword [rsp + 0x74], r12d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x74]
xor r8d, r8d
lea rdx, str.ItemName
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x80]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140083990
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.140005a90
lea rcx, [rsp + 0x50]
call fcn.140005330
mov rsi, qword [rsp + 0x50]
mov rbx, r13
movzx eax, word [rsi]
test ax, ax
je 0x140083a42
movzx ecx, ax
call fcn.14010b094
test eax, eax
je 0x1400839de
mov rax, rsi
test rbx, rbx
cmovne rax, rbx
mov rbx, rax
jmp 0x1400839e1
mov rbx, r13
add rsi, 2
movzx eax, word [rsi]
test ax, ax
jne 0x1400839c3
test rbx, rbx
je 0x140083a3d
mov rax, qword [rsp + 0x50]
sub rbx, rax
sar rbx, 1
test ebx, ebx
js 0x140083c18
sub r12d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, ebx
or ecx, r12d
jge 0x140083a24
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.140005a20
mov rax, qword [rsp + 0x50]
cmp ebx, dword [rax - 0xc]
jg 0x140083c18
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rsp + 0x50]
mov word [rax + rcx*2], r13w
mov rsi, qword [rsp + 0x50]
cmp dword [rsi - 0x10], 0
jne 0x140083afd
mov rcx, r14
call fcn.140084d80
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140083a74
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140083a93
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140083ab2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140083ace
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, InitCommonControls
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.1400ff350
mov rbx, qword [rsp + 0x5e8]
add rsp, 0x590
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x60], r13
lea rcx, [rsp + 0x60]
call fcn.1400055e0
nop
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, str.edd_actioncheck_license
lea r8, [rbp + 0x80]
lea rdx, str._s_sitem_name_slicense_s
lea rcx, [rsp + 0x60]
call fcn.140005d70
mov byte [r14 + 0x30], 0
mov rdx, qword [rsp + 0x60]
mov rcx, r14
call fcn.140083c40
cmp dword [r14 + 0x18], 1
jne 0x140083b74
test r15, r15
je 0x140083b74
mov r8, r15
mov rcx, r14
call fcn.140084a10
mov r8, r15
mov rcx, r14
call fcn.140084a10
mov ebx, dword [r14 + 0x18]
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140083b97
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140083bb6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140083bd5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140083bf4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140083c11
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
jmp 0x140083ad3
mov ecx, 0x80070057
call fcn.140002b00
nop
mov ecx, 0x80070057
call fcn.140002b00
nop
mov ecx, 0x80070057
call fcn.140002b00
int3