Function at 0x14008b498
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor r12d, r12d
mov sil, dl
mov rbx, rcx
test rcx, rcx
je 0x14008b6c3
test dl, dl
je 0x14008b4d6
cmp dword [0x1403ce130], r12d
mov eax, r12d
sete al
jmp 0x14008b504
test byte [rcx + 0x18], 0x10
jne 0x14008b501
mov eax, dword [0x1403ce460]
test eax, eax
je 0x14008b4ee
cmp eax, 2
sete al
jmp 0x14008b4f8
cmp byte [0x1403ce6c8], r12b
setne al
test al, al
mov eax, 1
jne 0x14008b504
mov eax, r12d
test eax, eax
jne 0x14008b6c3
lea rcx, [0x1403ce9a8]
mov dword [rbp + 0x30], r12d
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, 1
lock xadd dword [rbp - 0x28], eax
test eax, eax
jne 0x14008b545
cmp dword [rbp - 0x24], r12d
jne 0x14008b6de
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [rbp - 0x24], eax
mov eax, dword [rbp + 0x30]
mov edi, r12d
cmp edi, 4
jge 0x14008b6b1
mov eax, dword [rbx + 0x1c]
lea rcx, [rbp - 0x20]
mov rdx, qword [rbx + 0x10]
mov r14b, r12b
movzx r15d, sil
mov r9d, r15d
mov qword [rbp + 0x40], r12
shl r9d, 5
mov dword [rsp + 0x20], eax
call fcn.1400896c4
mov rcx, rax
mov eax, dword [rax]
mov dword [rbp + 0x30], eax
mov rax, qword [rcx + 8]
mov qword [rcx + 8], r12
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0x40], rax
test rcx, rcx
je 0x14008b5a4
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14008b5be
mov qword [rbp - 0x18], r12
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
mov eax, dword [rbp + 0x30]
test eax, eax
je 0x14008b62d
test sil, sil
je 0x14008b629
mov eax, dword [rbx + 0x1c]
lea r9d, [r15 + r15]
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x20], eax
call fcn.1400896c4
mov rcx, rax
mov eax, dword [rax]
mov dword [rbp + 0x30], eax
mov rax, qword [rcx + 8]
mov qword [rcx + 8], r12
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0x40], rax
test rcx, rcx
je 0x14008b60c
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14008b626
mov qword [rbp - 8], r12
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
mov eax, dword [rbp + 0x30]
test eax, eax
jne 0x14008b689
mov rax, qword [rbp + 0x40]
xor r9d, r9d
mov rdx, qword [rbx]
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov rcx, qword [rax + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 0x30], eax
cmp eax, 0x3f2
je 0x14008b664
cmp eax, 0x3fa
je 0x14008b664
cmp eax, 6
jne 0x14008b689
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1403c35d0]
movzx eax, word [rcx + 0xa]
and eax, 0x1f
shl rax, 5
mov qword [rax + rdx], r12
call fcn.140084fdc
mov eax, dword [rbp + 0x30]
mov r14b, 1
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14008b6a6
mov qword [rbp + 0x40], r12
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
mov eax, dword [rbp + 0x30]
inc edi
test r14b, r14b
jne 0x14008b54b
test eax, eax
lea rcx, [rbp - 0x30]
sete bl
call fcn.1400261e0
mov al, bl
jmp 0x14008b6c5
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor edx, edx
mov ecx, 0x131f4c4
call fcn.140025d34
int3