Function at 0x14001a688
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x7f8]
sub rsp, 0x8c0
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
mov r15, rdx
mov r14, rcx
mov qword [rbp - 0x60], rcx
mov al, byte [0x1401a3d84]
neg al
sbb rdi, rdi
mov r8d, dword [0x1401a3d80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov ebx, 0x66666667
mov eax, ebx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
mov esi, 1
xor r12d, r12d
cmp ecx, 8
jne 0x14001a721
test r8d, r8d
cmove r8d, esi
mov dword [0x1401a3d80], r8d
lea rcx, [0x14019b9a8]
mov rdx, qword [0x14019b9a8]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov r8d, dword [0x1401a3d80]
mov ecx, r8d
imul ecx, r8d
mov eax, ebx
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0x12
jne 0x14001a783
mov ecx, esi
cmp r8d, esi
jle 0x14001a77a
mov eax, r8d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r8d
jl 0x14001a76b
mov r8d, ecx
mov dword [0x1401a3d80], ecx
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0x10
jne 0x14001a7cd
mov ecx, 4
call fcn.1400bb888
mov rbx, rax
call fcn.1400bba88
mov dword [rbx], eax
mov dword [0x1401a3d80], eax
mov rcx, rbx
call fcn.1400bb0b4
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x58], r12
lea rdx, [0x140134108]
lea rcx, [rbp - 0x80]
call fcn.140002d94
nop
mov r8, rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.14000dac8
nop
lea r8, [0x1401a41b8]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14000dac8
nop
lea r8, [0x140134098]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140018bf8
nop
mov r8, r14
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.14000dac8
nop
mov r9d, esi
mov r8, qword [rax]
lea rdx, [rdi - 0x7ffffffe]
lea rcx, [rsp + 0x48]
call fcn.1400199a4
test eax, eax
setne bl
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
or r13d, 0xffffffff
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001a87a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001a89b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001a8bd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001a8df
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001a8ff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14001a965
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001a918
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001a93f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001a95e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x14001ab2b
mov dword [rsp + 0x40], 0x400
mov word [rbp - 0x50], r12w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp - 0x4e]
call fcn.1400c0510
mov esi, r12d
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x50]
mov edx, esi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
inc esi
test eax, eax
je 0x14001a9c6
cmp eax, 0x103
jne 0x14001aaac
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x60]
call fcn.1400020f8
nop
mov r8d, dword [0x1401a3d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 0xb
jne 0x14001aa1b
mov edx, 0xe1
lea r8d, [rdx + 1]
lea rcx, str._d__d_n
call fcn.1400bb9dc
mov r8d, dword [0x1401a3d80]
mov rax, qword [rsp + 0x60]
cmp dword [rax - 0x10], r12d
je 0x14001aa3a
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.14001af6c
mov r8d, dword [0x1401a3d80]
mov dword [rsp + 0x40], 0x400
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 2
jne 0x14001aa74
dec dword [0x1401a420c]
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x50]
call fcn.1400c0510
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001aaa7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x48]
test edi, edi
je 0x14001a98b
test rbx, rbx
je 0x14001aaca
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r12
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], r12d
test rbx, rbx
je 0x14001aae2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001ab09
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov ecx, r13d
lock xadd dword [rdx + 0x10], ecx
add ecx, r13d
test ecx, ecx
jg 0x14001ab29
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, 1
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.1400bb0d0
mov rbx, qword [rsp + 0x910]
add rsp, 0x8c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret