Function at 0x14003deec
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x82f0]
mov eax, 0x83f0
call fcn.1400c29d0
sub rsp, rax
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x8440], rbx
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp + 0x82e0], rax
mov r14, rdx
mov qword [rbp - 0x80], rdx
mov r10, rcx
xor r12d, r12d
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], r12d
mov qword [rsp + 0x68], r12
call fcn.14003ab24
lea edi, [r12 + 1]
test al, al
jne 0x14003df69
mov eax, dword [0x1401aad80]
test eax, eax
cmove eax, edi
mov dword [0x1401aad80], eax
xor r8d, r8d
mov rdx, r10
lea rcx, [rsp + 0x78]
call fcn.14003bb40
nop
mov r9d, 0x2001f
mov r8, qword [rax]
mov rdx, qword [0x1401a5d58]
lea rcx, [rsp + 0x58]
call fcn.140019dc4
test eax, eax
setne bl
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14003dfb2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14003dfc3
mov dil, r12b
mov rbx, qword [rsp + 0x58]
jmp 0x14003e1a5
mov dword [rsp + 0x40], 0x4000
mov word [rbp + 0x2e0], r12w
xor edx, edx
mov r8d, 0x7ffe
lea rcx, [rbp + 0x2e2]
call fcn.1400c2d60
mov r15d, r12d
call fcn.14003abe8
test al, al
jne 0x14003dff9
sub dword [0x1401ac1fc], edi
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x2e0]
mov edx, r15d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
mov dword [rsp + 0x44], eax
add r15d, edi
mov dword [rsp + 0x48], r15d
test eax, eax
je 0x14003e047
cmp eax, 0x103
jne 0x14003e14b
lea rdx, [rbp + 0x2e0]
lea rcx, [rsp + 0x50]
call fcn.140001f6c
nop
mov rcx, qword [rsp + 0x50]
cmp dword [rcx - 0x10], r12d
je 0x14003e071
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.14001b514
mov dword [rsp + 0x40], 0x4000
mov r10d, dword [0x1401aad80]
lea ecx, [r10 + 1]
imul ecx, r10d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 5
jne 0x14003e118
xor esi, esi
mov r8d, esi
lea r9, [rbp - 0x70]
mov bl, r10b
sub bl, r8b
mov r11d, edi
mov r14d, 5
mov r12, rsi
mov eax, r10d
cdq
idiv r11d
mov dword [rsp + 0x70], edx
mov r13d, edi
mov r15d, edx
mov eax, r10d
cdq
idiv r13d
mov ecx, eax
mov al, bl
imul cl
mov cl, al
mov al, r15b
imul cl
mov byte [r9 + r12], al
add r13d, edi
add r12, rdi
cmp r12, 0xe
jl 0x14003e0cf
add r11d, edi
add r9, 0xe
sub r14, rdi
jne 0x14003e0bb
add r8d, edi
cmp r8d, 0xc
jl 0x14003e0ac
mov esi, dword [rsp + 0x44]
mov r15d, dword [rsp + 0x48]
mov r14, qword [rbp - 0x80]
xor r12d, r12d
xor edx, edx
mov r8d, 0x8000
lea rcx, [rbp + 0x2e0]
call fcn.1400c2d60
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14003e146
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x58]
mov eax, dword [0x1401aad80]
lea r8d, [rax + 1]
imul r8d, eax
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 5
jne 0x14003e182
call fcn.1400be2e0
mov dword [0x1401aad80], eax
test esi, esi
je 0x14003dffe
test rbx, rbx
je 0x14003e1a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r12
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], r12d
test rbx, rbx
je 0x14003e1b8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], r12d
mov al, dil
mov rcx, qword [rbp + 0x82e0]
xor rcx, rsp
call fcn.1400bd920
mov rbx, qword [rsp + 0x8440]
add rsp, 0x83f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret