Function at 0x140051934
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rbp + 0x18], rax
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov qword [rsp + 0x78], rdx
mov rbx, rcx
call fcn.140002950
mov rcx, rax
xor r12d, r12d
test rax, rax
je 0x140052026
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x70], rax
call fcn.140002950
mov rcx, rax
test rax, rax
je 0x140052026
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x68], rax
call fcn.140002950
mov rcx, rax
test rax, rax
je 0x140052026
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], r12
mov dword [rbp - 0x2c], r12d
mov dword [rbp + 8], r12d
mov dword [rbp - 0x30], r12d
mov dword [rdi], r12d
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x140051aa0
lfence
mov rdx, rsi
lea rcx, [rbp - 0x70]
call fcn.1400068a0
lea r13, [rbx + 0x40]
mov rax, qword [r13]
lea rdx, [rbp - 0x70]
mov rcx, r13
call qword [rax]
lea r15, [rbx + 0x18]
mov qword [rsp + 0x70], r15
lea rdx, [rbp - 0x70]
mov rcx, r15
call fcn.140058210
mov edi, eax
test eax, eax
js 0x140051aa0
lfence
mov eax, dword [rbp - 0x30]
add eax, 2
mov dword [rbp - 0x44], eax
mov ecx, eax
call fcn.140026f10
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x50], rax
test rax, rax
jne 0x140051acb
mov edi, 0x8007000e
mov rcx, qword [rbp + 0x10]
call fcn.140002ef0
nop
lea rcx, [rbp - 0x70]
call fcn.140013dac
mov eax, edi
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.140001020
add rsp, 0x128
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov esi, r12d
mov dword [rsp + 0x60], r12d
cmp dword [rbp - 0x2c], r12d
jbe 0x140051a96
mov edx, dword [rbp + 8]
add edx, 1
mov dword [rbp - 0x7c], edx
mov eax, dword [rbp - 0x30]
mov dword [rbp - 0x80], eax
js 0x140052018
mov r8, qword [rbp - 0x68]
mov ecx, 1
sub ecx, dword [r8 - 8]
mov eax, dword [r8 - 0xc]
sub eax, edx
or eax, ecx
jge 0x140051b15
lfence
lea rcx, [rbp - 0x68]
call fcn.140002d40
mov r8, qword [rbp - 0x68]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xc]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x7c]
mov edx, esi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x140051a96
mov eax, dword [rbp - 0x7c]
cmp eax, 0xffffffff
jne 0x140051b70
mov rcx, qword [rbp - 0x68]
movsxd rdx, dword [rcx - 0xc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
test eax, eax
js 0x140052018
mov rcx, qword [rbp - 0x68]
cmp eax, dword [rcx - 0xc]
jg 0x140052018
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbp - 0x68]
mov word [rax + rcx*2], r12w
mov ecx, dword [rbp - 0x80]
mov dword [rbp - 0x48], ecx
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r12
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0xa
mov eax, dword [rbp + 0xc]
mov r14d, 0x80004005
sub eax, 1
je 0x140051dea
sub eax, 1
je 0x140051dc2
sub eax, 1
je 0x140051db9
sub eax, 1
je 0x140051d83
sub eax, 3
je 0x140051c36
cmp eax, 4
jne 0x140051e2b
mov dword [rbp - 0x60], 5
movsxd rax, ecx
mov rcx, qword [rbp - 0x50]
test rax, rax
je 0x140051e2b
test rcx, rcx
je 0x140051ea4
cmp rax, 8
ja 0x140051ea4
mov rdx, rcx
lea rcx, [rbp - 0x38]
mov r8, rax
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140051e2b
mov dword [rbp - 0x60], 2
mov rax, qword [rbp - 0x50]
mov byte [rcx + rax], r12b
mov ecx, dword [rbp - 0x80]
inc ecx
mov rax, qword [rbp - 0x50]
mov byte [rcx + rax], r12b
mov rbx, qword [rbp - 0x50]
test rbx, rbx
je 0x140051f41
cmp qword [rbp - 0x18], r12
ja 0x140051f41
cmp word [rbx], r12w
je 0x140051cc7
mov qword [rsp + 0x68], r12
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140002f00
mov rdx, qword [rsp + 0x68]
lea rcx, [rbp - 0x28]
call fcn.140008cc0
mov rax, qword [rsp + 0x68]
movsxd rcx, dword [rax - 0x10]
lea rbx, [rbx + rcx*2]
add rbx, 2
lea rdx, [rax - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051cbd
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp word [rbx], r12w
jne 0x140051c6f
mov rbx, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x28]
test rdi, rdi
je 0x140051ceb
mov rdx, rdi
mov rdi, qword [rdi]
add rdx, 0x10
mov rcx, r13
call fcn.14001603c
test rdi, rdi
jne 0x140051cd0
mov rbx, qword [rbp - 0x50]
movsxd rdi, dword [rbp - 0x44]
shr rdi, 1
test rbx, rbx
je 0x140051f41
mov r12, rbx
mov rsi, qword [rbp - 0x28]
xor r9d, r9d
test rsi, rsi
je 0x140051d63
lea r15, [rsi]
mov rsi, qword [rsi]
mov r8, qword [r15 + 0x10]
mov eax, dword [r8 - 0x10]
test eax, eax
je 0x140051f34
add eax, 2
cmp eax, edi
jg 0x140051f2d
movsxd rdx, edi
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s
xor r9d, r9d
test eax, eax
jne 0x140051f28
mov rax, qword [r15 + 0x10]
mov edx, dword [rax - 0x10]
lea eax, [rdx + 1]
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
or eax, 0xffffffff
sub eax, edx
add edi, eax
test rsi, rsi
jne 0x140051d0a
mov r15, qword [rsp + 0x70]
mov word [rbx], r9w
add rbx, 2
sub rbx, r12
sar rbx, 1
lea eax, [rbx + rbx]
mov dword [rbp - 0x48], eax
mov esi, dword [rsp + 0x60]
xor r12d, r12d
jmp 0x140051e2b
mov dword [rbp - 0x60], 4
movsxd rax, ecx
mov rcx, qword [rbp - 0x50]
test rax, rax
je 0x140051e2b
test rcx, rcx
je 0x140051f48
cmp rax, 4
ja 0x140051f48
mov rdx, rcx
lea rcx, [rbp - 0x40]
jmp 0x140051c29
mov dword [rbp - 0x60], 3
jmp 0x140051e2b
mov dword [rbp - 0x60], 1
mov rax, qword [rbp - 0x50]
mov byte [rcx + rax], r12b
mov rdx, qword [rbp - 0x50]
test rdx, rdx
je 0x140051dff
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], r12w
jne 0x140051dde
jmp 0x140051e12
mov dword [rbp - 0x60], r12d
mov rax, qword [rbp - 0x50]
mov byte [rcx + rax], r12b
mov rdx, qword [rbp - 0x50]
test rdx, rdx
jne 0x140051e04
mov eax, r12d
jmp 0x140051e12
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], r12w
jne 0x140051e08
mov r8d, eax
lea rcx, [rbp - 0x58]
call fcn.140002c00
mov rax, qword [r13]
lea rdx, [rbp - 0x58]
mov rcx, r13
call qword [rax]
lea rdx, [rbp - 0x70]
mov rcx, r15
call fcn.140058210
mov edi, eax
test eax, eax
js 0x140051f3c
jmp 0x140051e60
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x140052035
mov rax, qword [rdx]
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x28]
call fcn.1400089e4
cmp qword [rbp - 0x18], r12
ja 0x140051e43
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 8], r12
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140051e8b
mov rbx, qword [rcx]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, rbx
test rbx, rbx
jne 0x140051e7b
inc esi
mov dword [rsp + 0x60], esi
cmp esi, dword [rbp - 0x2c]
jae 0x140051a96
mov r14, qword [rsp + 0x78]
jmp 0x140051ad9
xor edx, edx
mov qword [rbp - 0x38], rdx
test rcx, rcx
jne 0x140051ebc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayAccessData
jmp 0x140051ecd
cmp rax, 8
jbe 0x140051ed2
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [rax], SafeArrayAllocDescriptor
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo
mov edi, r14d
jmp 0x140051ef4
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x140052035
mov rax, qword [rdx]
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x28]
call fcn.1400089e4
cmp qword [rbp - 0x18], r12
ja 0x140051ed7
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 8], r12
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140051a96
mov rbx, qword [rcx]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, rbx
test rbx, rbx
jne 0x140051f13
jmp 0x140051a96
mov edi, r14d
jmp 0x140051f39
mov edi, 0x8007007a
jmp 0x140051f39
mov edi, 0x80070057
xor r12d, r12d
jmp 0x140051fe4
mov edi, 0x80070057
jmp 0x140051f3c
xor edx, edx
mov dword [rbp - 0x40], edx
test rcx, rcx
jne 0x140051f5f
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayAccessData
jmp 0x140051f70
cmp rax, 4
jbe 0x140051f75
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [rax], SafeArrayAllocDescriptor
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo
mov edi, r14d
jmp 0x140051f97
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x140052035
mov rax, qword [rdx]
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x28]
call fcn.1400089e4
cmp qword [rbp - 0x18], r12
ja 0x140051f7a
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 8], r12
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140051a96
mov rbx, qword [rcx]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, rbx
test rbx, rbx
jne 0x140051fb6
jmp 0x140051a96
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x140052035
mov rax, qword [rdx]
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x28]
call fcn.1400089e4
cmp qword [rbp - 0x18], r12
ja 0x140051fcb
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 8], r12
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140051a96
mov rbx, qword [rcx]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, rbx
test rbx, rbx
jne 0x140052003
jmp 0x140051a96
mov ecx, 0x80070057
call fcn.1400327c0
nop
jmp 0x140052025
nop
mov ecx, 0x80004005
call fcn.1400327c0
nop
jmp 0x140052034
nop
mov ecx, r14d
call fcn.1400327c0
int3