Function at 0x1400c7940
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x830]
sub rsp, 0x930
mov rax, qword [0x1401b8010]
xor rax, rsp
mov qword [rbp + 0x820], rax
mov r12, rdx
mov r14, rcx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rdx
xor edi, edi
mov dword [rsp + 0x40], edi
call qword [sym.imp.WINMM.dll_timeGetTime]
mov dword [rbp + 0x400], eax
mov r13, 0xffffffffffffffff
mov r9, r13
lea r8, [0x14015f210]
mov edx, 0x102
lea rcx, [rbp + 0x404]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea r8, [0x1401815c4]
mov edx, 0x104
lea rcx, [rbp + 0x404]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov r9, r13
lea r8, [0x14015f210]
mov edx, 0x104
lea rcx, [rbp + 0x60c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov ecx, dword [0x1401c1658]
mov eax, dword [0x1401c165c]
lea ebx, [rdi + 1]
lea r15, str.____s
add ecx, eax
je 0x1400c7a9a
mov dword [rsp + 0x58], edi
call fcn.140005ad0
mov qword [rsp + 0x50], rax
lock inc dword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
test rax, rax
jne 0x1400c7a32
call fcn.140005ad0
mov qword [rsp + 0x50], rax
lock inc dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov dword [rbp - 0x48], 0x20
lea rax, [rbp + 0x404]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
lea rax, [rbp + 0x60c]
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x48]
movsx edx, bx
call fcn.140004c90
nop
mov qword [rsp + 0x50], rdi
mov eax, r13d
lock xadd dword [rsp + 0x58], eax
cmp eax, 1
js 0x1400c7a95
call fcn.140005e40
mov eax, r13d
lock xadd dword [rsp + 0x58], eax
cmp eax, 1
jns 0x1400c7a82
lock inc dword [rsp + 0x58]
mov qword [rbp - 0x50], rdi
mov qword [r14], rdi
mov esi, 0x40
mov edx, esi
mov rcx, r14
call fcn.14001c030
test al, al
je 0x1400c8267
mov rax, qword [r14]
test rax, rax
je 0x1400c7ac6
mov rcx, qword [rax - 0xc]
jmp 0x1400c7ac9
mov rcx, rdi
mov qword [rcx + 8], rdi
mov rax, qword [r14]
mov word [rax], di
mov rcx, qword [r14]
test rcx, rcx
je 0x1400c7b10
mov rax, qword [rcx - 0xc]
test rax, rax
je 0x1400c7b10
cmp dword [rcx - 0x10], 0xabcd
jne 0x1400c8267
cmp dword [rcx - 4], 0xabcd
jne 0x1400c8267
mov rax, qword [rax + 0x10]
cmp dword [rcx + rax*2 + 2], 0xabcd
jne 0x1400c8267
mov dword [rsp + 0x40], ebx
call qword [sym.imp.WINMM.dll_timeGetTime]
mov dword [rbp - 0x20], eax
mov dword [rbp - 0x1c], 0x5b
mov r9, r13
lea r8, [0x14015f2a8]
mov edx, 0x102
lea rcx, [rbp - 0x1a]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea r8, [0x140183930]
mov edx, 0x104
lea rcx, [rbp - 0x1c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov r9, r13
lea r8, [0x14015f2e0]
mov edx, 0x104
lea rcx, [rbp + 0x1ec]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov ecx, dword [0x1401c1658]
mov eax, dword [0x1401c165c]
add ecx, eax
je 0x1400c7c18
mov dword [rsp + 0x68], edi
call fcn.140005ad0
mov qword [rsp + 0x60], rax
lock inc dword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x1400c7baf
call fcn.140005ad0
mov qword [rsp + 0x60], rax
lock inc dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov dword [rbp - 0x44], 0x20
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
lea rax, [rbp + 0x1ec]
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x44]
movsx edx, bx
call fcn.140004c90
nop
mov qword [rsp + 0x60], rdi
mov eax, r13d
lock xadd dword [rsp + 0x68], eax
cmp eax, 1
js 0x1400c7c13
nop dword [rax]
call fcn.140005e40
mov eax, r13d
lock xadd dword [rsp + 0x68], eax
cmp eax, 1
jns 0x1400c7c00
lock inc dword [rsp + 0x68]
lea rcx, [0x1401c15e8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x1401c15e0], 0
jne 0x1400c7c3b
lea rcx, [0x1401c15c0]
call fcn.140047ce0
lea rcx, [0x1401c15e8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp qword [0x1401c15e0], 0
je 0x1400c7caf
lea rcx, [0x1401c15e8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x1401c15e0], 0
jne 0x1400c7c75
lea rcx, [0x1401c15c0]
call fcn.140047ce0
lea rcx, [0x1401c15e8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x1401c15e0]
test rcx, rcx
je 0x1400c7cbd
mov rax, qword [rcx]
lea r8, [0x14015f2a0]
mov edx, 0xcb
mov rax, qword [rax + 0x30]
call qword [case.0x140077645.0]
mov rbx, rax
test rax, rax
jne 0x1400c7cc4
lea rcx, [rbp - 0x20]
call fcn.140004e30
jmp 0x1400c81ca
lea rbx, str._error_interface_not_inited_
cmp word [rbx], 0x3c
je 0x1400c7caf
mov ecx, dword [0x1401c1658]
mov eax, dword [0x1401c165c]
add ecx, eax
je 0x1400c7d4b
mov dword [rsp + 0x78], edi
call fcn.140005ad0
mov qword [rsp + 0x70], rax
lock inc dword [rsp + 0x78]
mov dword [rsp + 0x40], 3
mov rax, qword [rsp + 0x70]
test rax, rax
jne 0x1400c7d0e
call fcn.140005ad0
mov qword [rsp + 0x70], rax
lock inc dword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov dword [rbp - 0x40], 0x10
mov qword [rsp + 0x30], rbx
lea rax, [0x14015f278]
mov qword [rsp + 0x28], rax
lea rax, [0x14015f130]
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x40]
movsx edx, di
call fcn.140004c90
nop
mov eax, dword [rsp + 0x40]
test al, 2
je 0x1400c7d88
and eax, 0xfffffffd
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x70], rdi
mov eax, r13d
lock xadd dword [rsp + 0x78], eax
cmp eax, 1
js 0x1400c7d83
nop dword [rax]
call fcn.140005e40
mov eax, r13d
lock xadd dword [rsp + 0x78], eax
cmp eax, 1
jns 0x1400c7d70
lock inc dword [rsp + 0x78]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c7caf
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], edi
mov rax, qword [r12]
lea r15, [0x1401836d8]
mov rdx, r15
test rax, rax
cmovne rdx, rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c7caf
cmp dword [rsp + 0x48], 1
jne 0x1400c7caf
mov ebx, dword [rsp + 0x44]
shr ebx, 1
inc ebx
mov ecx, dword [0x1401c1658]
mov eax, dword [0x1401c165c]
add ecx, eax
je 0x1400c7e81
mov dword [rbp - 0x78], edi
call fcn.140005ad0
mov qword [rbp - 0x80], rax
lock inc dword [rbp - 0x78]
or dword [rsp + 0x40], 4
mov rax, qword [rbp - 0x80]
test rax, rax
jne 0x1400c7e46
call fcn.140005ad0
mov qword [rbp - 0x80], rax
lock inc dword [rbp - 0x78]
mov rcx, qword [rbp - 0x80]
mov dword [rbp - 0x3c], 0x10
mov dword [rsp + 0x30], ebx
lea rax, [0x14015f108]
mov qword [rsp + 0x28], rax
lea rax, [0x14015f0a0]
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x3c]
movsx edx, di
call fcn.140004c90
nop
mov eax, dword [rsp + 0x40]
test al, 4
je 0x1400c7eb7
and eax, 0xfffffffb
mov dword [rsp + 0x40], eax
mov qword [rbp - 0x80], rdi
mov eax, r13d
lock xadd dword [rbp - 0x78], eax
cmp eax, 1
js 0x1400c7eb3
call fcn.140005e40
mov eax, r13d
lock xadd dword [rbp - 0x78], eax
cmp eax, 1
jns 0x1400c7ea1
lock inc dword [rbp - 0x78]
mov eax, 2
mul rbx
cmovo rax, r13
mov rcx, rax
call qword [sym.imp.mfc140u.dll_operator_1]
mov rdi, rax
lea r8, [rbx + rbx]
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [r12]
mov rdx, r15
test rcx, rcx
cmovne rdx, rcx
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c81b1
test rdi, rdi
je 0x1400c81b1
mov ecx, dword [0x1401c1658]
mov eax, dword [0x1401c165c]
add ecx, eax
je 0x1400c7f97
xor ebx, ebx
mov dword [rbp - 0x68], ebx
call fcn.140005ad0
mov qword [rbp - 0x70], rax
lock inc dword [rbp - 0x68]
or dword [rsp + 0x40], 8
mov rax, qword [rbp - 0x70]
test rax, rax
jne 0x1400c7f5a
call fcn.140005ad0
mov qword [rbp - 0x70], rax
lock inc dword [rbp - 0x68]
mov rcx, qword [rbp - 0x70]
mov dword [rbp - 0x38], 0x10
mov qword [rsp + 0x30], rdi
lea rax, [0x14015f078]
mov qword [rsp + 0x28], rax
lea rax, [0x14015f1b0]
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x38]
movsx edx, bx
call fcn.140004c90
jmp 0x1400c7f99
xor ebx, ebx
mov eax, dword [rsp + 0x40]
test al, 8
je 0x1400c7fd6
and eax, 0xfffffff7
mov dword [rsp + 0x40], eax
mov qword [rbp - 0x70], rbx
mov eax, r13d
lock xadd dword [rbp - 0x68], eax
cmp eax, 1
js 0x1400c7fd2
nop dword [rax]
call fcn.140005e40
mov eax, r13d
lock xadd dword [rbp - 0x68], eax
cmp eax, 1
jns 0x1400c7fc0
lock inc dword [rbp - 0x68]
mov rax, qword [r14]
test rax, rax
cmovne r15, rax
cmp rdi, r15
je 0x1400c80ee
mov rbx, r13
nop dword [rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1400c7ff0
test rax, rax
je 0x1400c8015
mov rdx, qword [rax - 0xc]
test rdx, rdx
je 0x1400c8015
mov rcx, qword [rdx + 0x10]
mov rsi, qword [rdx + 0x18]
xor r15d, r15d
jmp 0x1400c801b
xor r15d, r15d
mov ecx, r15d
cmp rcx, rbx
jb 0x1400c8025
test rcx, rcx
jne 0x1400c8060
mov rax, rbx
sub rax, rcx
cmp rax, rsi
cmovae rsi, rax
mov eax, 0x400
cmp rcx, rax
jae 0x1400c8045
cmp rsi, rcx
cmovb rsi, rcx
jmp 0x1400c804c
cmp rsi, rax
cmovb rsi, rax
lea rdx, [rsi + rcx]
mov rcx, r14
call fcn.14001c030
test al, al
je 0x1400c825d
lea rsi, [rbx + rbx]
mov r8, rsi
mov rdx, rdi
mov rcx, qword [r14]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [r14]
test rax, rax
je 0x1400c8089
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400c8089
mov rdx, qword [rcx + 0x10]
jmp 0x1400c808c
mov rdx, r15
cmp rbx, rdx
ja 0x1400c825d
test rax, rax
je 0x1400c80a0
mov rcx, qword [rax - 0xc]
jmp 0x1400c80a3
mov rcx, r15
mov qword [rcx + 8], rbx
mov rax, qword [r14]
mov word [rsi + rax], r15w
mov rcx, qword [r14]
test rcx, rcx
je 0x1400c80f1
mov rax, qword [rcx - 0xc]
test rax, rax
je 0x1400c80f1
cmp dword [rcx - 0x10], 0xabcd
jne 0x1400c825d
cmp dword [rcx - 4], 0xabcd
jne 0x1400c825d
mov rax, qword [rax + 0x10]
cmp dword [rcx + rax*2 + 2], 0xabcd
jne 0x1400c825d
jmp 0x1400c80f1
xor r15d, r15d
mov ecx, dword [0x1401c1658]
mov eax, dword [0x1401c165c]
add ecx, eax
je 0x1400c81a6
mov dword [rbp - 0x58], r15d
call fcn.140005ad0
mov qword [rbp - 0x60], rax
lock inc dword [rbp - 0x58]
mov rax, qword [rbp - 0x60]
test rax, rax
jne 0x1400c812c
call fcn.140005ad0
mov qword [rbp - 0x60], rax
lock inc dword [rbp - 0x58]
mov rbx, qword [rbp - 0x60]
call qword [sym.imp.WINMM.dll_timeGetTime]
sub eax, dword [rbp - 0x20]
mov dword [rbp - 0x34], 0x20
mov dword [rsp + 0x38], eax
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
lea rax, str.____s___d_
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1ec]
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x34]
movsx edx, r13w
mov rcx, rbx
call fcn.140004c90
mov qword [rbp - 0x60], r15
mov eax, r13d
lock xadd dword [rbp - 0x58], eax
cmp eax, 1
js 0x1400c81a2
nop dword [rax]
call fcn.140005e40
mov eax, r13d
lock xadd dword [rbp - 0x58], eax
cmp eax, 1
jns 0x1400c8190
lock inc dword [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_operator]
jmp 0x1400c81c8
lea rcx, [rbp - 0x20]
call fcn.140004e30
test rdi, rdi
je 0x1400c81c8
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_operator]
xor edi, edi
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1400c81de
mov qword [rbp - 0x50], rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp + 0x400]
call fcn.140004e30
nop
mov rcx, qword [r12]
test rcx, rcx
je 0x1400c821d
mov rax, qword [rcx - 0xc]
test rax, rax
je 0x1400c821d
cmp dword [rcx - 0x10], 0xabcd
jne 0x1400c8253
cmp dword [rcx - 4], 0xabcd
jne 0x1400c8253
mov rax, qword [rax + 0x10]
cmp dword [rcx + rax*2 + 2], 0xabcd
jne 0x1400c8253
mov rcx, r12
call fcn.14001bab0
nop
mov rax, r14
mov rcx, qword [rbp + 0x820]
xor rcx, rsp
call fcn.14007e250
mov rbx, qword [rsp + 0x980]
add rsp, 0x930
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
xor ecx, ecx
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xor edx, edx
xor ecx, ecx
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xor edx, edx
xor ecx, ecx
call sub.VCRUNTIME140.dll__CxxThrowException
int3