Function at 0x1400388d9
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov rax, r8
mov rbx, rdx
mov ebx, edx
mov rsi, rcx
mov esi, ecx
lea rdi, [rsp + 0xc8]
mov r8d, 0xb
mov rcx, rdi
mov rdx, rax
call fcn.140062c10
lea r9, [rsp + 0x5c]
and dword [r9], 0
lea r15, [rsp + 0x3c]
lea edi, [rsp + 0x3c]
and dword [r15], 0
mov rdi, qword [rdi + 8]
mov qword [rsp + 0x28], r15
sub byte [rax - 0x7d], cl
and al, 0x20
add byte [rax - 0x77], cl
invalid
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x140038983
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
and qword [rsi + 8], 0
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
mov rcx, qword [rsp + 0xc8]
mov rdx, rdi
call fcn.1400a6c3e
nop
add rsp, 0xf8
add byte [rax], al
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [rsp + 0x5c]
dec eax
cmp eax, 0xa
ja case.0x1400389a0.5
lea rcx, [0x140a963d8]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov edx, dword [rsp + 0x3c]
shr edx, 1
lea r14, [rsp + 0x80]
mov rcx, r14
call fcn.1400a6a48
invalid
add byte [rbp - 0x75], cl
jbe 0x1400389c4
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov ecx, ebx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x140038b66
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
and qword [rsi + 8], 0
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
jmp 0x140038bc8
mov edx, dword [rsp + 0x3c]
lea r14, [rsp + 0x60]
mov rcx, r14
call fcn.140008b6b
mov r14, qword [r14 + 8]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x140038bd5
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
and qword [rsi + 8], 0
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
mov rcx, qword [rsp + 0x60]
mov rdx, r14
call fcn.140088c69
jmp 0x14003895e
cmp dword [rsp + 0x3c], 8
jne case.0x1400389a0.5
lea rax, [rsp + 0x40]
and qword [rax], 0
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x140038942
mov rax, qword [rsp + 0x40]
mov dword [rsi], 1
mov qword [rsi + 8], rax
jmp 0x14003895e
cmp dword [rsp + 0x3c], 4
jne case.0x1400389a0.5
lea rax, [rsp + 0x40]
and dword [rax], 0
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x140038942
mov eax, dword [rsp + 0x40]
and dword [rsi], 0
mov dword [rsi + 4], eax
jmp 0x14003895e
and qword [rsi + 8], 0
mov dword [rsi + 0x10], 0x8007000d
jmp 0x140038958
mov edx, dword [rsp + 0x3c]
shr edx, 1
lea r14, [rsp + 0xb0]
mov rcx, r14
call fcn.1400a6a48
mov r14, qword [r14 + 8]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x140038c0f
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
and qword [rsi + 8], 0
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
jmp 0x140038d76
mov rdx, qword [rsp + 0x90]
mov rcx, r14
call fcn.1400a6a92
lea rcx, [rax + rdx*2]
lea rbx, [rsp + 0x40]
mov qword [rbx], rax
mov qword [rbx + 8], rcx
and word [rbx + 0x10], 0
lea r15, [rsp + 0x60]
mov rcx, r15
mov rdx, rbx
call fcn.1400a6c5a
movups xmm0, xmmword [r15]
movups xmmword [rbx + 4], xmm0
mov rax, qword [r15 + 0x10]
mov qword [rbx + 0x14], rax
mov dword [rsi], 2
movups xmm0, xmmword [rbx]
mov rax, qword [rbx + 0xc]
mov qword [rsi + 0x10], rax
mov rax, qword [rbx + 0x14]
mov qword [rsi + 0x18], rax
movups xmmword [rsi + 4], xmm0
mov rcx, qword [rsp + 0x80]
jmp 0x140038d7e
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x54], rax
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsp + 0x44], xmm0
mov dword [rsi], 3
movups xmm0, xmmword [rsp + 0x40]
mov rax, qword [rsp + 0x4c]
mov rcx, qword [rsp + 0x54]
movups xmmword [rsi + 4], xmm0
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rcx
jmp 0x14003895e
mov rdx, qword [rsp + 0xc0]
mov rcx, r14
call fcn.1400a6a92
lea r8, [rsp + 0xe0]
mov qword [r8], rax
mov qword [r8 + 8], rdx
mov byte [r8 + 0x10], 0
lea rbx, [rsp + 0x80]
mov rcx, rbx
mov rdx, r8
call fcn.140079002
movabs r15, 0x8000000000000000
cmp qword [rbx], r15
jne 0x140038c64
mov eax, 8
xor r12d, r12d
xor ecx, ecx
jmp 0x140038d64
lea rdi, [rsp + 0x40]
mov edx, 4
mov rcx, rdi
call fcn.1400a6912
cmp qword [rdi], 0
mov rcx, qword [rdi + 8]
jne 0x140038d8b
lea rdi, [rsp + 0x40]
mov r13, qword [rdi + 0x10]
mov rax, qword [rsp + 0x90]
mov qword [r13 + 0x10], rax
movups xmm0, xmmword [rsp + 0x80]
movups xmmword [r13], xmm0
lea rbx, [rsp + 0x98]
mov qword [rbx], rcx
mov qword [rbx + 8], r13
mov qword [rbx + 0x10], 1
mov rax, qword [rsp + 0xf0]
lea r14, [rsp + 0x60]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rsp + 0xe0]
movaps xmmword [r14], xmm0
mov r12d, 1
mov ebp, 0x18
mov rcx, rdi
mov rdx, r14
call fcn.140079002
cmp qword [rsp + 0x40], r15
je 0x140038d44
cmp r12, qword [rsp + 0x98]
jne 0x140038d1e
movzx eax, byte [rsp + 0x70]
mov edx, 2
sub rdx, rax
mov rcx, rbx
call fcn.1400a6987
mov r13, qword [rsp + 0xa0]
movups xmm0, xmmword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov qword [r13 + rbp + 0x10], rax
movups xmmword [r13 + rbp], xmm0
inc r12
mov qword [rsp + 0xa8], r12
add rbp, 0x18
jmp 0x140038ce5
mov rcx, qword [rsp + 0x98]
mov rax, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xd0]
mov dword [rsi], 4
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], r12
mov rcx, qword [rsp + 0xb0]
mov rdx, r14
call fcn.1400a6c3e
jmp 0x14003895e
mov rdx, qword [rsp + 0x50]
call fcn.1400b5c40
int3