Function at 0x140025440
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
lea rax, [0x14042a497]
mov qword [rsp + 0x50], rax
lea rax, [0x14042a4c3]
mov qword [rsp + 0x58], rax
mov word [rsp + 0x60], 0
mov dword [rsp + 0x68], 1
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x50]
call fcn.140032c50
add rsi, rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x60], 0
mov dword [rsp + 0x68], 1
lea rcx, [rsp + 0x88]
lea rsi, [rsp + 0x50]
mov rdx, rsi
call fcn.140032c50
mov rdi, qword [rsp + 0xa8]
call fcn.14004c230
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], rsi
mov rcx, 0xffffffff80000002
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x20019
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x14002552d
movabs rax, 0x8000000000000000
mov qword [rbx], rax
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x140025737
mov rcx, qword [rsp + 0x90]
add rdx, rdx
mov r8d, 2
jmp 0x140025732
mov rsi, qword [rsp + 0x50]
mov dword [rsp + 0x34], 0x800
mov rax, qword [0x140457a18]
movzx eax, byte [rax]
mov ecx, 0x800
mov edx, 1
call fcn.140008a30
test rax, rax
je 0x1400257bc
mov r15, rax
mov qword [rsp + 0x70], 0x800
mov qword [rsp + 0x78], rax
mov r14, qword [rsp + 0x90]
mov dword [rsp + 0x38], 0
lea r12, [rsp + 0x34]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x140025664
lea r13, [rsp + 0x38]
lea rbp, [rsp + 0x70]
jmp 0x1400255ec
mov r15, qword [rsp + 0x78]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
mov r9, r13
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x140025664
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140057310
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], edx
mov qword [rsp + 0x50], 1
cmp edx, 0x800700ea
jne 0x14002576a
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], 0x800700ea
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x80], rdx
mov r8d, dword [rsp + 0x34]
test r8, r8
je 0x14002564e
mov rcx, rbp
call fcn.1400260a0
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1400255c0
mov rcx, r13
call fcn.140057db0
jmp 0x1400255c0
mov r12d, dword [rsp + 0x34]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], 0
mov r8d, r12d
shr r8d, 2
bt r12d, 1
adc r8, 0
je 0x1400256a2
lea rcx, [rsp + 0x38]
xor edx, edx
call fcn.1400260a0
and r12d, 0xfffffffe
add r12, r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r12
mov word [rsp + 0x60], 0
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x38]
call fcn.1400335e0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x1400256ec
nop dword [rax]
cmp byte [rcx + rdx - 1], 0
jne 0x1400256ee
dec rdx
jne 0x1400256e0
xor edx, edx
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140025711
mov r8d, 1
mov rcx, r15
call fcn.140008a40
mov rcx, rsi
call sub.advapi32.dll_RegCloseKey
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x140025737
add rdx, rdx
mov r8d, 2
mov rcx, r14
call fcn.140008a40
mov rdx, qword [rsp + 0xa0]
test rdx, rdx
je 0x140025755
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140008a40
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs rcx, 0x8000000000000000
mov qword [rbx], rcx
test rax, rax
je 0x140025786
lea rcx, [rsp + 0x58]
call fcn.140057db0
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x14002579e
mov r8d, 1
mov rcx, r15
call fcn.140008a40
mov rcx, rsi
call sub.advapi32.dll_RegCloseKey
mov rdx, qword [rsp + 0x88]
test rdx, rdx
jne 0x140025517
jmp 0x140025737
mov ecx, 1
mov edx, 0x800
call fcn.1400dc200
ud2