Function at 0x140038690
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rbx, rcx
mov dword [rsp + 0x40], 0
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x1400389eb
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x40], 1
mov edx, 0xa5
lea rcx, [rsp + 0x48]
call fcn.1400177a0
cmp qword [rax + 0x18], 8
jb 0x1400386f1
mov rax, qword [rax]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
sete dil
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14003875c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038757
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400389f6
call fcn.140133e68
test dil, dil
je 0x1400389d7
mov dword [rbp + 0x1b0], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.140137f50
mov dword [rbp + 0x1a8], 0x208
mov edx, 0xa6
lea rcx, [rsp + 0x48]
call fcn.1400177a0
cmp qword [rax + 0x18], 8
jb 0x1400387a4
mov rax, qword [rax]
lea rcx, [rbp + 0x1a8]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x1b0]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete dil
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14003881a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038815
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400389fc
call fcn.140133e68
test dil, dil
je 0x140038833
lea r8, [rsp + 0x70]
lea rdx, [0x14026ce94]
mov rcx, rbx
call fcn.140008c18
mov rax, qword [rbx]
cmp dword [rax - 0x10], 3
jl 0x1400389cc
cmp word [rax], 0x36
jne 0x1400389cc
movzx eax, word [rax + 4]
sub ax, 0x32
cmp ax, 1
ja 0x1400389cc
mov dword [rsp + 0x30], 0
mov dword [rbp + reloc.OLEAUT32.dll_VarUI8FromDec], 0
mov dword [rbp + 0x1b0], 4
mov dword [rbp + 0x1a8], 4
mov edx, 0xa7
lea rcx, [rsp + 0x48]
call fcn.1400177a0
cmp qword [rax + 0x18], 8
jb 0x14003889b
mov rax, qword [rax]
lea rcx, [rbp + 0x1a8]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x1b0]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete dil
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140038911
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003890c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038a02
call fcn.140133e68
mov dword [rbp + 0x1b0], 4
mov dword [rbp + 0x1a8], 4
mov edx, 0xa8
lea rcx, [rsp + 0x48]
call fcn.1400177a0
cmp qword [rax + 0x18], 8
jb 0x14003893e
mov rax, qword [rax]
lea rcx, [rbp + 0x1a8]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + reloc.OLEAUT32.dll_VarUI8FromDec]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x1b0]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400389ac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400389a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400389e5
call fcn.140133e68
test dil, dil
je 0x1400389cc
mov r9d, dword [rbp + reloc.OLEAUT32.dll_VarUI8FromDec]
mov r8d, dword [rsp + 0x30]
lea rdx, str._d._d
mov rcx, rbx
call fcn.140008c18
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
add rsp, 0x280
pop rdi
pop rbx
pop rbp
ret
call fcn.1401462a8
int3
mov ecx, 0x80004005
call fcn.14000c3ac
int3
call fcn.1401462a8
int3
call fcn.1401462a8
int3
call fcn.1401462a8
int3