Function at 0x140011268
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xb8
xor ebx, ebx
mov rsi, r9
mov rdi, r8
mov r13, rcx
mov r12d, ebx
mov qword [rbp - 0x39], rbx
mov r15d, ebx
cmp byte [rcx], bl
je 0x140011344
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x11]
call fcn.14003f510
test eax, eax
je 0x140011344
mov rdx, qword [rbp - 0x39]
lea rax, [rbp - 0x19]
mov rcx, qword [rbp - 0x11]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140011344
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 0x2d]
mov qword [rsp + 0x58], rbx
xor r9d, r9d
mov qword [rsp + 0x50], rbx
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
lea rax, [rbp - 0x41]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x25]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 5]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x14001135a
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, dword [rbp - 0x2d]
mov eax, 0xa
cmp dword [rbp - 0x41], eax
cmova eax, dword [rbp - 0x41]
inc eax
mov dword [rbp - 0x41], eax
call fcn.14015319c
mov qword [rbp - 0x11], rax
test rax, rax
je 0x1400116ea
mov ecx, dword [rbp - 0x41]
call fcn.14015319c
mov qword [rbp - 1], rax
mov r14, rax
test rax, rax
je 0x1400116c6
mov r8d, dword [rsi]
or r10, 0xffffffffffffffff
mov rcx, r10
lea edx, [r8 + 5]
inc rcx
cmp byte [rcx + r13], bl
jne 0x1400113a6
inc rcx
mov r15d, 0x7fffffff
cmp rdx, r15
ja 0x1400113cc
mov eax, r15d
sub rax, rdx
cmp rcx, rax
lea rax, [rcx + rdx]
jbe 0x1400113cf
mov rax, r10
mov edi, dword [rdi]
cmp eax, edi
jb 0x14001143c
lea rcx, [rdi + 0x8000]
cmp rcx, rdi
jae 0x1400113e6
mov rdi, r10
jmp 0x140011401
mov eax, 1
mov qword [rbp - 0x39], rbx
mul rcx
mov rdi, rax
test rdx, rdx
jne 0x1400113e1
cmp rax, r15
cmova rdi, r10
mov rax, qword [rbp + 0x67]
lea rcx, [rbp - 0x39]
mov edx, edi
mov rax, qword [rax]
mov qword [rbp - 0x39], rax
call fcn.140032304
neg al
sbb rcx, rcx
and rcx, qword [rbp - 0x39]
je 0x1400116c3
mov r9, qword [rbp + 0x67]
or r10, 0xffffffffffffffff
mov rax, qword [rbp + 0x6f]
mov r8d, dword [rsi]
mov qword [r9], rcx
mov dword [rax], edi
jmp 0x140011440
mov r9, qword [rbp + 0x67]
mov eax, edi
sub eax, r8d
cmp eax, edi
ja 0x1400116c3
mov ecx, r8d
mov r8, r10
add rcx, qword [r9]
lea r9, str._s_r_n_r_n
mov edx, eax
mov qword [rsp + 0x20], r13
call fcn.14000b754
mov rax, qword [rbp + 0x67]
mov edx, dword [rsi]
mov ecx, edx
add rcx, qword [rax]
je 0x140011484
or rax, 0xffffffffffffffff
inc rax
cmp byte [rax + rcx], bl
jne 0x14001147a
jmp 0x140011487
mov rax, rbx
add eax, edx
mov edi, ebx
mov dword [rsi], eax
cmp dword [rbp - 0x25], ebx
jbe 0x140011547
mov r12, qword [rbp + 0x67]
mov r15, qword [rbp + 0x6f]
mov r13, qword [rbp - 0x11]
mov eax, dword [rbp - 0x41]
lea r9, [rbp - 0x31]
mov rcx, qword [rbp - 0x19]
mov r8, r14
mov dword [rbp - 0x31], eax
mov edx, edi
mov eax, dword [rbp - 0x2d]
mov dword [rbp - 0x29], eax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x14001152f
mov edx, dword [rbp - 0x31]
test edx, edx
jne 0x14001150c
cmp dword [rbp - 0x41], ebx
jle 0x140011504
movsxd rdx, dword [rbp - 0x41]
lea r8, str._default_
or r9, 0xffffffffffffffff
mov rcx, r14
call fcn.14014f790
mov edx, 9
mov dword [rbp - 0x31], edx
mov r9d, dword [rbp - 0x29]
mov r8, r14
mov ecx, dword [rbp - 9]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r13
call fcn.140010b98
inc edi
cmp edi, dword [rbp - 0x25]
jb 0x1400114a2
mov r13, qword [rbp + 0x5f]
mov r15d, 0x7fffffff
mov r12, rbx
cmp dword [rbp + 0x7f], ebx
je 0x1400116bb
or rdx, 0xffffffffffffffff
mov r14, rdx
inc r14
cmp byte [r14 + r13], bl
jne 0x140011557
mov eax, dword [rbp - 5]
add eax, 2
mov esi, r14d
mov ecx, eax
cmp rcx, r15
ja 0x14001157c
sub r15, rcx
lea rdi, [rsi + rax]
cmp rsi, r15
jbe 0x14001157f
mov rdi, rdx
mov ecx, edi
call fcn.14015319c
mov r12, rax
test rax, rax
je 0x1400116c3
test edi, edi
jle 0x1400115a8
movsxd rdx, edi
or r9, 0xffffffffffffffff
mov r8, r13
mov rcx, rax
call fcn.14014f790
lea r15, [rsi + r12]
mov esi, edi
sub esi, r14d
cmp esi, edi
jae 0x1400116c3
test esi, esi
jle 0x1400115d3
movsxd rdx, esi
lea r8, [0x14018a3a4]
or r9, 0xffffffffffffffff
mov rcx, r15
call fcn.14014f790
dec esi
mov edi, ebx
cmp dword [rbp - 0x21], ebx
jbe 0x1400116bb
mov r14, qword [rbp + 0x77]
mov r13, qword [rbp + 0x67]
mov rcx, qword [rbp - 0x19]
lea r9, [rbp + 0x5f]
mov qword [rsp + 0x38], rbx
lea r8, [r15 + 1]
mov qword [rsp + 0x30], rbx
mov edx, edi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov dword [rbp + 0x5f], esi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1400116ed
mov rax, qword [rbp + 0x6f]
mov ecx, dword [r14]
mov r8, qword [r13]
mov edx, dword [rax]
lea eax, [rcx + 3]
cmp eax, edx
jb 0x140011660
add edx, 0x8000
mov qword [rbp - 0x39], r8
lea rcx, [rbp - 0x39]
call fcn.140032304
neg al
sbb r8, r8
and r8, qword [rbp - 0x39]
je 0x1400116c3
mov rax, qword [rbp + 0x6f]
mov ecx, dword [r14]
mov qword [r13], r8
add dword [rax], 0x8000
mov edx, dword [rax]
sub edx, ecx
lea r9, [0x14018a348]
add rcx, r8
or r8, 0xffffffffffffffff
call fcn.14000b754
mov edx, dword [r14]
mov ecx, edx
add rcx, qword [r13]
je 0x14001168e
or rax, 0xffffffffffffffff
inc rax
cmp byte [rax + rcx], bl
jne 0x140011684
jmp 0x140011691
mov rax, rbx
mov r8, qword [rbp + 0x6f]
add eax, edx
mov rdx, r13
mov dword [r14], eax
mov r9, r14
mov dword [rsp + 0x20], 1
mov rcx, r12
call fcn.140011268
inc edi
cmp edi, dword [rbp - 0x21]
jb 0x1400115e8
mov r15d, 1
jmp 0x1400116c6
mov r15d, ebx
mov rcx, qword [rbp - 0x11]
call fcn.140152ed8
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x1400116dd
call fcn.140152ed8
test r12, r12
je 0x1400116ea
mov rcx, r12
call fcn.140152ed8
mov ebx, r15d
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140011346