Function at 0x1402247e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov r15, r9
mov r13, r8
mov r12, rdx
xor ebx, ebx
mov dword [rbp + 0x40], ebx
lea r14, [rcx + 0x28]
lea rdi, [rcx + 8]
mov qword [rbp - 0x40], rdi
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9, r14
xor r8d, r8d
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x140224a61
cmp dword [r14], 1
je 0x140224865
cmp dword [r14], 2
je 0x140224865
lea esi, [rbx + 0xd]
jmp 0x140224a6b
mov eax, dword [rbp + 0x40]
lea r8d, [rax + rax + 2]
mov dword [rbp - 0x50], r8d
mov r9d, 1
mov rdx, r15
lea rcx, [rbp - 0x30]
call fcn.14000bd14
lea r9, [rbp - 0x50]
mov r8, qword [rax + 8]
mov rdx, r12
mov rcx, rdi
call fcn.1400347fc
mov esi, eax
mov eax, dword [rbp - 0x20]
mov rdi, qword [rbp - 0x30]
cmp eax, 0xffffffff
jne 0x1402248b9
mov rcx, qword [rdi]
test rcx, rcx
jne 0x1402248b0
mov eax, ebx
jmp 0x1402248c1
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x140224a56
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x140224a56
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rdi]
mov word [rax + rcx*2], bx
cmp esi, 0xd
jne 0x1402249af
mov eax, dword [rbp + 0x40]
lea eax, [rax + rax + 2]
mov dword [rbp - 0x50], eax
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x48], rdi
mov edx, dword [rbp - 0x50]
test edx, edx
jns 0x140224918
mov ecx, 0x80070057
call fcn.14000cbb8
int3
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, edx
or eax, ecx
jge 0x140224936
lea rcx, [rbp - 0x48]
call fcn.14000c998
mov rdi, qword [rbp - 0x48]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9, r14
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rbp - 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400beaac
test eax, eax
js 0x1402249a4
cmp eax, dword [rdi - 0xc]
jg 0x1402249a4
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], bx
lea rdx, [rbp - 0x48]
mov rcx, r15
call fcn.14000c244
nop
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402249af
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1402249af
mov ecx, 0x80070057
call fcn.14000cbb8
nop
cmp esi, 0xea
jne 0x140224a61
mov edi, ebx
cmp edi, 5
jge 0x140224a61
mov r8d, dword [rbp + 0x40]
add r8d, 2
mov dword [rbp + 0x40], r8d
mov r9d, 1
mov rdx, r15
lea rcx, [rbp - 0x18]
call fcn.14000bd14
lea r9, [rbp + 0x40]
mov r8, qword [rax + 8]
mov rdx, r12
mov rcx, qword [rbp - 0x40]
call fcn.1400347fc
mov esi, eax
mov eax, dword [rbp - 8]
mov r12, qword [rbp - 0x18]
cmp eax, 0xffffffff
jne 0x140224a1c
mov rcx, qword [r12]
test rcx, rcx
jne 0x140224a13
mov eax, ebx
jmp 0x140224a20
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x140224a4b
mov rcx, qword [r12]
cmp eax, dword [rcx - 0xc]
jg 0x140224a4b
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [r12]
mov word [rax + rcx*2], bx
inc edi
cmp esi, 0xea
mov r12, qword [rbp + 0x48]
je 0x1402249bd
jmp 0x140224a61
mov ecx, 0x80070057
call fcn.14000cbb8
int3
mov ecx, 0x80070057
call fcn.14000cbb8
int3
cmp esi, 2
je 0x140224a6b
cmp esi, 0xd
jne 0x140224a97
mov dword [r14], 1
test r13, r13
je 0x140224a89
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea ebx, [rcx - 1]
mov r8d, ebx
mov rdx, r13
mov rcx, r15
call fcn.14000c9f8
mov eax, esi
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret