Function at 0x14004dfb0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x3d8
mov qword [rsp + 0x58], 0xfffffffffffffffe
movaps xmmword [rsp + 0x3c0], xmm6
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov r10, r9
mov rax, r8
mov r14, rdx
mov rdi, rcx
xor r15d, r15d
mov ebp, r15d
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x38], r15
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004e2a3
mov dword [rsp + 0x48], r15d
mov rbp, qword [rsp + 0x38]
mov qword [rsp + 0x40], rbp
mov rax, qword [rdi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, 0x800
or eax, ecx
jge 0x14004e063
mov edx, 0x800
mov rcx, rdi
call fcn.140002760
mov rbx, qword [rdi]
cmp dword [rbx - 0xc], 0x800
jge 0x14004e07a
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rbx - 0x10], 0x800
mov rax, qword [rdi]
mov word [rax + 0x1000], r15w
mov dword [rsp + 0x30], 0x1000
mov esi, r15d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, eax
test eax, eax
jne 0x14004e105
mov eax, dword [rsp + 0x38]
dec eax
cmp eax, 1
jbe 0x14004e0d4
mov r14d, 0xd
jmp 0x14004e105
mov ecx, dword [rsp + 0x30]
test rbx, rbx
je 0x14004e0fe
test ecx, ecx
je 0x14004e0fa
test cl, 1
jne 0x14004e0f2
mov eax, ecx
shr rax, 1
cmp word [rbx + rax*2 - 2], si
je 0x14004e0fe
mov r14d, 0xd
jmp 0x14004e105
mov word [rbx], r15w
mov esi, ecx
shr esi, 1
mov r14d, r15d
call fcn.14004ad00
mov r9d, dword [0x1401d6d80]
test al, al
jne 0x14004e16d
movsd xmm3, qword [0x140164068]
xorps xmm2, xmm2
movd xmm4, r9d
cvtdq2pd xmm4, xmm4
movsd xmm5, qword [0x140164090]
movsd xmm6, qword [0x140164060]
nop dword [rax]
addsd xmm2, xmm3
movaps xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x14004e159
subsd xmm2, xmm3
divsd xmm3, xmm5
movaps xmm1, xmm2
mulsd xmm1, xmm2
movaps xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmm6
ja 0x14004e140
lea eax, [rsi - 1]
cmp eax, 0xffffffff
jne 0x14004e192
mov rcx, qword [rdi]
test rcx, rcx
jne 0x14004e182
mov eax, r15d
jmp 0x14004e19a
movsxd rdx, dword [rcx - 0xc]
call fcn.1400d5a84
mov r9d, dword [0x1401d6d80]
test eax, eax
js 0x14004e298
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x14004e298
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rdi]
mov word [rax + rcx*2], r15w
lea ecx, [r9 + 1]
imul ecx, r9d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 9
jne 0x14004e23e
mov edi, r15d
lea rsi, [rsp + 0x60]
mov r10d, r15d
nop word [rax + rax]
lea ebx, [r10 + 1]
lea ecx, [rdi + 1]
mov eax, r9d
cdq
idiv ecx
mov r8d, edx
mov ecx, r9d
sub ecx, edi
imul r8d, ecx
mov eax, r9d
cdq
idiv ebx
add r8d, eax
sub r8d, r10d
mov edx, r8d
lea rcx, [0x14015d724]
call fcn.1400d5714
mov r10d, ebx
add rsi, 4
mov r9d, dword [0x1401d6d80]
cmp ebx, 0x13
jl 0x14004e1f0
inc edi
cmp edi, 0xb
jl 0x14004e1e2
test rbp, rbp
je 0x14004e25b
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, r15
mov qword [rsp + 0x40], r15
mov r9d, dword [0x1401d6d80]
mov dword [rsp + 0x48], r15d
lea ecx, [r9 + 1]
imul ecx, r9d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0xd
jne 0x14004e290
dec r9d
mov dword [0x1401d6d80], r9d
test r14d, r14d
sete bl
jmp 0x14004e2a5
mov ecx, 0x80070057
call fcn.140001920
int3
xor bl, bl
test rbp, rbp
je 0x14004e2b8
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], r15d
movzx eax, bl
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.1400d4e00
movaps xmm6, xmmword [rsp + 0x3c0]
add rsp, 0x3d8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret