Function at 0x1400432f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rsp + 0xf8], rbx
mov rax, qword [0x140127190]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x19], rcx
mov rcx, rdx
call fcn.140042df0
mov r15, rax
test rax, rax
jne 0x140043351
xor esi, esi
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
jmp 0x140043649
mov r9, rbx
mov r10, qword [rbx + 0x18]
cmp r10, 8
jb 0x140043361
mov r9, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rdx, 0xffffffffffffffff
test r8, r8
je 0x140043387
mov rcx, r8
mov rax, r9
cmp word [rax], 0x5c
je 0x1400433e4
add rax, 2
sub rcx, 1
jne 0x140043377
mov rax, rdx
inc rax
movdqa xmm0, xmmword [0x1401087a0]
movdqu xmmword [rbp - 1], xmm0
xor esi, esi
mov word [rbp - 0x11], si
cmp r8, rax
jb 0x140043687
sub r8, rax
cmp r8, rdx
cmovb rdx, r8
cmp r10, 8
jb 0x1400433bc
mov rbx, qword [rbx]
lea r9, [rbx + rax*2]
lea rcx, [rbp - 0x11]
cmp rdx, 7
ja 0x1400433f1
mov qword [rbp - 1], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call fcn.14009a510
mov word [rbp + rbx - 0x11], si
jmp 0x1400433f7
test rax, rax
je 0x140043387
sub rax, r9
sar rax, 1
jmp 0x14004338a
call fcn.14002d410
nop
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x19]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14004348a
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x140043649
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043644
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043675
jmp 0x140043644
mov dword [rbp - 0x21], esi
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x14004349a
mov rdx, qword [r14]
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140043519
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x140043649
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043644
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004367b
jmp 0x140043644
xor eax, eax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rax
mov edx, dword [rbp - 0x21]
lea rcx, [rbp + 0xf]
call fcn.1400436a0
cmp qword [r14 + 0x18], 8
jb 0x14004353d
mov r14, qword [r14]
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov rbx, qword [rbp + 0xf]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400435fa
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
test rbx, rbx
je 0x1400435b9
mov rdx, qword [rbp + 0x1f]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400435b0
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004368d
mov rcx, rbx
call fcn.1400765f0
nop
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x140043649
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043644
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043681
jmp 0x140043644
mov qword [rdi], rbx
mov rax, qword [rbp + 0x17]
mov qword [rdi + 8], rax
mov rax, qword [rbp + 0x1f]
mov qword [rdi + 0x10], rax
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x140043649
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043644
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004366f
call fcn.1400765f0
mov rax, rdi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140076590
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400a3864
int3
call fcn.1400a3864
int3
call fcn.1400a3864
int3
call fcn.1400a3864
int3
call fcn.14002cb90
nop
call fcn.1400a3864
nop
int3