Function at 0x140027860
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
push r15
lea rbp, [rsp - 0x9c8]
sub rsp, 0xac8
mov r15, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x208
mov rdi, r9
call fcn.1400452a0
mov dword [rsp + 0x74], 0x104
mov dword [rsp + 0x6c], 0
test rbx, rbx
je 0x140027b57
lea rax, [rbp - 0x70]
xor r9d, r9d
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x74]
lea rax, [rbp - 0x80]
mov rcx, rbx
mov qword [rsp + 0x50], rax
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140027b57
mov eax, dword [rsp + 0x68]
mov qword [rsp + 0xaf8], rsi
lea rsi, [rax*2 + 2]
mov rcx, rsi
call fcn.1400462e4
mov rbx, rax
test rax, rax
je 0x140027b55
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x6c]
mov dword [rdi], eax
xor edi, edi
mov eax, dword [rsp + 0x64]
mov qword [rsp + 0xac0], r12
mov r12, qword [rbp + 0xa10]
mov qword [rsp + 0xab0], r14
mov dword [r12], edi
test eax, eax
je 0x140027b19
mov qword [rsp + 0xab8], r13
mov r14d, edi
mov r13, qword [rbp + 0xa18]
mov dword [rsp + 0x70], edi
nop
mov dword [rsp + 0x60], 0x3fff
test rbx, rbx
je 0x1400279a0
mov word [rbx], di
mov rcx, qword [rbp + 0x9f0]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x38], rdi
mov r8, rbx
mov qword [rsp + 0x30], rdi
mov edx, r14d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1400279e4
mov rdx, r15
mov rcx, rbx
call fcn.140045430
cmp rbx, rax
jne 0x1400279e4
inc dword [r12]
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x140027af6
mov r12, qword [rbp + 0xa00]
xor r14d, r14d
nop word [rax + rax]
mov dword [rsp + 0x60], 0x3fff
test rbx, rbx
je 0x140027a11
mov word [rbx], r14w
mov rcx, qword [rbp + 0x9f0]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x38], r14
mov r8, rbx
mov qword [rsp + 0x30], r14
mov edx, edi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140027adc
xor edx, edx
mov dword [rsp + 0x7c], 1
mov r8d, 0x800
lea rcx, [rbp + 0x1b0]
call fcn.1400452a0
lea rax, [rbp + 0x9f0]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r12
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140027adc
mov rcx, qword [rbp + 0x9f0]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x7c]
lea rax, [rbp + 0x1b0]
mov dword [rsp + 0x78], 0x400
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140027adc
test rbx, rbx
je 0x140027adc
mov r8, rsi
xor edx, edx
mov rcx, rbx
call fcn.1400452a0
mov rcx, rbx
call fcn.1400462d0
mov rbx, r14
mov eax, dword [rsp + 0x64]
inc edi
cmp edi, eax
jb 0x140027a00
mov r14d, dword [rsp + 0x70]
mov r12, qword [rbp + 0xa10]
inc r14d
mov edi, 0
mov dword [rsp + 0x70], r14d
cmp r14d, eax
jb 0x140027990
mov r13, qword [rsp + 0xab8]
test rbx, rbx
je 0x140027b2e
mov r8, rsi
xor edx, edx
mov rcx, rbx
call fcn.1400452a0
mov rcx, rbx
call fcn.1400462d0
mov r12, qword [rsp + 0xac0]
xor al, al
mov r14, qword [rsp + 0xab0]
mov rsi, qword [rsp + 0xaf8]
add rsp, 0xac8
pop r15
pop rdi
pop rbx
pop rbp
ret
jmp 0x140027b40
xor al, al
add rsp, 0xac8
pop r15
pop rdi
pop rbx
pop rbp
ret