Function at 0x140041880
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
lea rax, [0x14021c6c7]
mov qword [rbp + 8], rax
lea rax, [0x14021c6f3]
mov qword [rbp + 0x10], rax
mov word [rbp + 0x18], 0
mov dword [rbp + 0x20], 1
lea rcx, [rbp - 0x48]
lea rdx, [rbp + 8]
call fcn.140033a70
add rsi, rbx
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], rsi
mov word [rbp + 0x18], 0
mov dword [rbp + 0x20], 1
lea rcx, [rbp - 0x30]
lea rbx, [rbp + 8]
mov rdx, rbx
call fcn.140033a70
mov rsi, qword [rbp - 0x40]
call fcn.140018590
mov qword [rbp + 8], rax
mov qword [rsp + 0x20], rbx
mov rcx, 0xffffffff80000002
mov rdx, rsi
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140041945
movabs rax, 0x8000000000000000
mov qword [rdi], rax
jmp 0x140041b35
mov qword [rbp - 0x18], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x4c], 0x800
movzx eax, byte [0x140331341]
mov ecx, 0x800
mov edx, 1
call fcn.140022d40
test rax, rax
je 0x140041b7f
mov r14, rax
mov qword [rbp - 0x10], 0x800
mov qword [rbp - 8], rax
mov rbx, qword [rbp - 0x28]
lea r15, [rbp + 0x4c]
lea r12, [rbp + 0x30]
mov rsi, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea r13, [rbp - 0x10]
jmp 0x1400419a4
mov r14, qword [rbp - 8]
mov dword [rbp + 0x30], 0
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rcx, qword [rbp + 0x28]
mov rdx, rbx
xor r8d, r8d
mov r9, r12
call rsi
test eax, eax
je 0x140041a34
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.1400460f0
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], edx
mov qword [rbp + 8], 1
cmp edx, 0x800700ea
jne 0x140041af5
mov qword [rbp + 0x30], rax
mov dword [rbp + 0x38], 0x800700ea
mov rdx, qword [rbp - 0x10]
mov qword [rbp], rdx
mov r8d, dword [rbp + 0x4c]
test r8, r8
je 0x140041a1e
mov rcx, r13
call fcn.140205260
mov rax, qword [rbp + 0x30]
test rax, rax
je 0x1400419a0
mov rcx, r12
call fcn.1400460b0
jmp 0x1400419a0
mov esi, dword [rbp + 0x4c]
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 1
mov qword [rbp + 0x40], 0
mov r8d, esi
shr r8d, 2
bt esi, 1
adc r8, 0
je 0x140041a6b
lea rcx, [rbp + 0x30]
xor edx, edx
call fcn.140205260
and esi, 0xfffffffe
add rsi, r14
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], rsi
mov word [rbp + 0x18], 0
lea rcx, [rbp + 8]
lea rdx, [rbp + 0x30]
call fcn.14002b8a0
mov rax, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x40]
test rdx, rdx
je 0x140041aac
nop dword [rax]
cmp byte [rcx + rdx - 1], 0
jne 0x140041aae
dec rdx
jne 0x140041aa0
xor edx, edx
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x140041ad0
mov r8d, 1
mov rcx, r14
call fcn.140022d50
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x140041b50
add rdx, rdx
mov r8d, 2
mov rcx, rbx
jmp 0x140041b4b
movabs rcx, 0x8000000000000000
mov qword [rdi], rcx
test rax, rax
je 0x140041b10
lea rcx, [rbp + 0x10]
call fcn.1400460b0
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x140041b27
mov r8d, 1
mov rcx, r14
call fcn.140022d50
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x140041b50
mov rcx, qword [rbp - 0x28]
add rdx, rdx
mov r8d, 2
call fcn.140022d50
mov rdx, qword [rbp - 0x48]
test rdx, rdx
je 0x140041b6a
add rdx, rdx
mov r8d, 2
mov rcx, rsi
call fcn.140022d50
nop
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 1
mov edx, 0x800
call fcn.140215f80
ud2