Function at 0x140033da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xb8
mov qword [rbp - 0x79], 0xfffffffffffffffe
mov rax, qword [0x1400e5090]
xor rax, rsp
mov qword [rbp - 9], rax
mov rcx, qword [rbp + 0x57]
mov rdx, qword [rbp + 0x5f]
mov r15, qword [rbp + 0x67]
mov r14, qword [rbp + 0x6f]
xor r13d, r13d
mov r12d, r13d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x21], xmm0
mov esi, r13d
mov qword [rbp - 0x11], r13
mov dword [rbp - 0x49], r13d
mov qword [rbp - 0x71], r13
test rcx, rcx
je 0x140033ebb
test rdx, rdx
je 0x140033ebb
cmp word [rdx], r13w
je 0x140033ebb
mov r9d, dword [rbp + 0x77]
or r9d, 1
lea rax, [rbp - 0x71]
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x140033ea2
mov eax, r13d
mov dword [rbp - 0x45], eax
mov edx, eax
lea rcx, [rbp - 0x21]
call fcn.1400323b0
lea rax, [rbp - 0x45]
mov qword [rsp + 0x28], rax
mov rbx, qword [rbp - 0x21]
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x49]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rbp - 0x45]
test rbx, rbx
jne 0x140033e94
test eax, eax
je 0x140033e94
test edi, edi
je 0x140033e51
cmp edi, 0xea
je 0x140033e51
mov rsi, qword [rbp - 0x11]
jmp 0x140033ea6
mov rbx, qword [rbp - 0x21]
mov rcx, qword [rbp - 0x71]
test rcx, rcx
je 0x140033ec4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x71], r13
jmp 0x140033ec4
mov edi, 0x57
mov rbx, qword [rbp - 0x21]
mov ecx, edi
call qword [0x1400a41c0]
test edi, edi
je 0x140033ede
call qword [0x1400a41e8]
mov r12d, eax
jmp 0x140034145
mov eax, dword [rbp - 0x49]
dec eax
cmp eax, 1
ja 0x14003413f
mov rdi, qword [rbp - 0x19]
sub rdi, rbx
test dil, 1
jne 0x14003413f
mov qword [rbp - 0x51], 7
mov qword [rbp - 0x59], r13
mov word [rbp - 0x69], r13w
mov rdx, rdi
shr rdx, 1
jne 0x140033f22
mov qword [rbp - 0x59], rdx
mov word [rbp + rdx*2 - 0x69], r13w
jmp 0x140033f2e
xor r8d, r8d
lea rcx, [rbp - 0x69]
call fcn.140004770
mov r15, qword [rbp - 0x59]
test r15, r15
je 0x140033f54
lea rcx, [rbp - 0x69]
cmp qword [rbp - 0x51], 8
cmovae rcx, qword [rbp - 0x69]
mov r8, rdi
mov rdx, rbx
call fcn.1400738a0
mov r15, qword [rbp - 0x59]
xor edx, edx
xor r8d, r8d
lea rcx, [rbp - 0x69]
call fcn.140032510
cmp rax, 0xffffffffffffffff
je 0x140033f94
lea rcx, [rbp - 0x69]
cmp rax, r15
ja 0x140033f86
mov qword [rbp - 0x59], rax
cmp qword [rbp - 0x51], 8
cmovae rcx, qword [rbp - 0x69]
mov word [rcx + rax*2], r13w
jmp 0x140033f94
xor r8d, r8d
sub rax, r15
mov rdx, rax
call fcn.140004770
cmp dword [rbp - 0x49], 2
jne 0x1400340ea
mov eax, 7
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x31], r13
mov word [rbp - 0x41], r13w
lea rdx, [rbp - 0x41]
cmp rax, 8
cmovae rdx, qword [rbp - 0x41]
lea rcx, [rbp - 0x69]
cmp qword [rbp - 0x51], 8
cmovae rcx, qword [rbp - 0x69]
mov r8d, dword [rbp - 0x31]
call qword [0x1400a40e8]
mov edx, eax
mov rcx, qword [rbp - 0x31]
cmp rdx, rcx
jbe 0x140033ff5
xor r8d, r8d
sub rdx, rcx
lea rcx, [rbp - 0x41]
call fcn.140004770
mov rax, qword [rbp - 0x29]
jmp 0x140033fb0
test eax, eax
jne 0x140034061
call qword [0x1400a41e8]
mov r12d, eax
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14003401e
inc rdx
mov r8d, 2
mov rcx, qword [rbp - 0x41]
call fcn.140005890
mov qword [rbp - 0x29], 7
mov qword [rbp - 0x31], r13
mov word [rbp - 0x41], r13w
mov rdx, qword [rbp - 0x51]
cmp rdx, 8
jb 0x14003404b
inc rdx
mov r8d, 2
mov rcx, qword [rbp - 0x69]
call fcn.140005890
mov qword [rbp - 0x51], 7
mov qword [rbp - 0x59], r13
mov word [rbp - 0x69], r13w
jmp 0x140034145
lea edx, [rax - 1]
cmp rdx, rcx
ja 0x140034082
mov qword [rbp - 0x31], rdx
lea rax, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rax, qword [rbp - 0x41]
mov word [rax + rdx*2], r13w
jmp 0x140034092
xor r8d, r8d
sub rdx, rcx
lea rcx, [rbp - 0x41]
call fcn.140004770
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 8
jb 0x1400340ae
inc rdx
mov r8d, 2
mov rcx, qword [rbp - 0x69]
call fcn.140005890
mov qword [rbp - 0x51], 7
mov qword [rbp - 0x59], r13
mov word [rbp - 0x69], r13w
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x69]
call fcn.140004d00
nop
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x1400340ea
inc rdx
mov r8d, 2
mov rcx, qword [rbp - 0x41]
call fcn.140005890
nop
lea rax, [rbp - 0x69]
cmp r14, rax
je 0x14003413a
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x14003410e
inc rdx
mov r8d, 2
mov rcx, qword [r14]
call fcn.140005890
mov qword [r14 + 0x18], 7
mov qword [r14 + 0x10], r13
cmp qword [r14 + 0x18], 8
jb 0x140034126
mov rax, qword [r14]
jmp 0x140034129
mov rax, r14
mov word [rax], r13w
lea rdx, [rbp - 0x69]
mov rcx, r14
call fcn.140004d00
nop
jmp 0x14003402f
mov r12d, 0xd
test rbx, rbx
je 0x14003415e
sub rsi, rbx
mov r8d, 1
mov rdx, rsi
mov rcx, rbx
call fcn.140005890
mov ecx, r12d
call qword [0x1400a41c0]
test r12d, r12d
sete al
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.14003dda0
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret