Function at 0x140051130
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r12, r9
mov r15, r8
mov r13, rdx
mov dword [rbp - 0x34], 4
mov r11d, dword [0x1401ddd80]
lea r10d, [r11 + 2]
lea eax, [r11 + 1]
imul r10d, eax
imul r10d, r11d
mov eax, 0x2aaaaaab
imul r10d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub r10d, eax
mov edi, 1
cmp r10d, 0xb
jne 0x1400511c7
mov edx, edi
mov eax, edi
mov ecx, 0xd8
lea r11d, [rax + rdx]
lea edx, [rax]
mov eax, r11d
dec ecx
jns 0x1400511b3
mov dword [0x1401ddd80], r11d
mov dword [rbp - 0x50], 0
mov r8d, r11d
imul r8d, r11d
mov eax, 0x88888889
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub r8d, edx
cmp r8d, 3
jne 0x14005121e
lea ecx, [r8 + 1]
call fcn.1400d7a58
mov rbx, rax
call fcn.1400d7b94
mov dword [rbx], eax
mov dword [0x1401ddd80], eax
mov rcx, rbx
call fcn.1400d7280
mov r11d, dword [0x1401ddd80]
lea ecx, [r11 + 2]
lea eax, [r11 + 1]
imul ecx, eax
imul ecx, r11d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0xe
jne 0x140051256
test r11d, r11d
cmove r11d, edi
mov dword [0x1401ddd80], r11d
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x48], rbx
mov r14, qword [rbp + 0x50]
mov rax, qword [r14]
or edi, 0xffffffff
cmp dword [rax - 0x10], 0
je 0x1400512fc
lea r8, [0x140163e2c]
mov rdx, r14
lea rcx, [rbp - 0x28]
call fcn.14001c2d0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400512e4
cmp dword [rbx + 0x10], 0
jl 0x1400512d6
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400512d6
call fcn.1400028c0
mov rsi, rax
lock add dword [rbx + 0x10], edi
jg 0x1400512cc
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rbp - 0x48], rax
jmp 0x1400512e4
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x48]
call fcn.140002770
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400512fc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x40], rbx
xor r8d, r8d
mov rdx, r15
lea rcx, [rbp - 0x20]
call fcn.14004f1a0
nop
mov r8, rax
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x18]
call fcn.1400109e0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140051388
cmp dword [rbx + 0x10], 0
jl 0x14005137a
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14005137a
call fcn.1400028c0
mov rsi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x140051370
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rbp - 0x40], rax
jmp 0x140051388
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x40]
call fcn.140002770
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400513a1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400513b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rbp - 0x40]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14005142f
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400513f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x140051411
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140051428
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x14005151f
lea rax, [rbp - 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x38]
xor r8d, r8d
mov rdx, qword [r13]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov ecx, dword [rbp - 0x50]
mov rax, qword [rbp + 0x30]
mov dword [rax], ecx
mov r8d, dword [0x1401ddd80]
imul r8d, r8d
mov eax, 0x66666667
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
cmp r8d, 7
jne 0x1400514b5
mov eax, 0xd1
mov r8d, 0x6e
test r8d, r8d
je 0x1400514ac
mov ecx, r8d
cdq
idiv r8d
mov r8d, edx
mov eax, ecx
test ecx, ecx
jne 0x140051497
add eax, r8d
mov dword [0x1401ddd80], eax
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1400514ce
cmp dword [rbp - 0x38], 4
jne 0x1400514ce
mov sil, 1
jmp 0x1400514d1
xor sil, sil
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400514e6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x140051503
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005151b
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, sil
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret