Function at 0x14003b070
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x9340]
mov eax, 0x9440
call fcn.1400be0c0
sub rsp, rax
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x9480], rbx
mov qword [rsp + 0x9488], rsi
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp + 0x9330], rax
mov r15, rdx
xor r12d, r12d
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x58], r12d
mov qword [rsp + 0x60], r12
xor r8d, r8d
mov rdx, rcx
lea rcx, [rsp + 0x68]
call fcn.140039224
nop
mov r9d, 0x2001f
mov r8, qword [rax]
mov rdx, qword [0x14019ad58]
lea rcx, [rsp + 0x50]
call fcn.140018038
test eax, eax
setne bl
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14003b116
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14003b127
mov dil, r12b
mov rbx, qword [rsp + 0x50]
jmp 0x14003b39d
mov dword [rsp + 0x40], 0x4000
mov word [rbp + 0x1330], r12w
xor edx, edx
mov r8d, 0x7ffe
lea rcx, [rbp + 0x1332]
call fcn.1400be450
mov r14d, r12d
mov r8d, dword [0x14019fd80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
mov edi, 1
cmp ecx, 3
jne 0x14003b19d
mov edx, edi
mov eax, edi
mov ecx, 0xf7
lea r8d, [rax + rdx]
lea edx, [rax]
mov eax, r8d
sub ecx, edi
jns 0x14003b189
mov dword [0x14019fd80], r8d
mov rbx, qword [rsp + 0x50]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 8
jne 0x14003b1eb
mov ecx, r12d
lea rdx, [rbp - 0x80]
mov eax, dword [rdx]
imul eax, eax, 0x16
add r8d, eax
add ecx, edi
lea rdx, [rdx + 4]
movsxd rax, ecx
cmp rax, 0x260
jb 0x14003b1cb
mov dword [0x14019fd80], r8d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x1330]
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
add r14d, edi
test eax, eax
je 0x14003b22b
cmp eax, 0x103
jne 0x14003b343
mov edx, dword [0x14019fd80]
lea r8d, [rdx + 2]
lea ecx, [rdx + 1]
imul r8d, ecx
imul r8d, edx
mov eax, 0x66666667
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 0xd
jne 0x14003b2de
mov word [rbp + 0x1e0], r12w
xor edx, edx
mov r8d, 0x1140
lea rcx, [rbp + 0x1e2]
call fcn.1400be450
mov r10, r12
or r9, 0xffffffffffffffff
mov r8, r12
test r10, r10
je 0x14003b2b8
test r8, r8
je 0x14003b2b8
lea rcx, [r9 + r8]
lea rax, [r9 + r8]
movzx edx, word [rbp + rcx*2 + 0x184]
add dx, word [rbp + rax*2 + 0x1e0]
add dx, di
lea rax, [r9 + r8]
mov word [rbp + rax*2 + 0x1e2], dx
add r8, rdi
cmp r8, 0x2f
jl 0x14003b287
add r10, rdi
add r9, 0x2f
cmp r9, 0x8a0
jl 0x14003b284
movsx eax, word [rbp + 0x1320]
mov dword [0x14019fd80], eax
lea rdx, [rbp + 0x1330]
lea rcx, [rsp + 0x48]
call fcn.140001cb0
nop
mov rax, qword [rsp + 0x48]
cmp dword [rax - 0x10], r12d
je 0x14003b308
lea rdx, [rsp + 0x48]
mov rcx, r15
call fcn.140019760
mov dword [rsp + 0x40], 0x4000
xor edx, edx
mov r8d, 0x8000
lea rcx, [rbp + 0x1330]
call fcn.1400be450
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14003b33e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x50]
test esi, esi
jne 0x14003b353
mov r8d, dword [0x14019fd80]
jmp 0x14003b1a2
test rbx, rbx
je 0x14003b369
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r12
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], r12d
mov eax, dword [0x14019fd80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 2
jne 0x14003b39d
sub dword [0x1401a0d14], edi
test rbx, rbx
je 0x14003b3b0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x58], r12d
mov al, dil
mov rcx, qword [rbp + 0x9330]
xor rcx, rsp
call fcn.1400b9010
lea r11, [rsp + 0x9440]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret