Function at 0x140018a30
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x348]
sub rsp, 0x430
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400a3008]
xor rax, rsp
mov qword [rbp + 0x320], rax
mov rsi, rcx
xor r14d, r14d
mov edi, r14d
mov ebx, r14d
mov dword [rsp + 0x30], ebx
nop word [rax + rax]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x210]
call fcn.14005db90
lea r8, [rbp + 0x210]
mov edx, ebx
mov ecx, dword [rsi + 0x10]
call section.RT_CODE
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x100]
call fcn.14005db90
mov r8d, 1
lea rdx, str.Property_u
lea rcx, [rbp + 0x100]
call fcn.1400156c0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x10]
call fcn.14005db90
xor bl, bl
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x210]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140018b8e
mov dword [rsp + 0x34], r14d
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rbp + 0x100]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 0x102
ja 0x140018b83
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rbp + 0x100]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x140018d5e
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x10]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140018bb0
inc ebx
lea r8, [rsp + 0x68]
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.140002d00
movsxd rdx, ebx
mov r9, rdx
lea r8, [rbp - 0x10]
mov rcx, qword [rsp + 0x60]
call fcn.140001490
test eax, eax
je 0x140018c08
cmp eax, 0xc
je 0x140018d88
cmp eax, 0x16
je 0x140018d7d
cmp eax, 0x22
je 0x140018d7d
cmp eax, 0x50
jne 0x140018d72
mov rcx, qword [rsp + 0x60]
call fcn.140018450
movzx ebx, al
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x140018c29
call fcn.14005fb6c
test bl, bl
je 0x140018d5e
mov rax, qword [rsi]
mov rcx, qword [rax + 8]
mov rbx, rax
mov edx, dword [rsp + 0x30]
cmp byte [rcx + 0x19], 0
jne 0x140018c5c
cmp dword [rcx + 0x20], edx
jae 0x140018c50
mov rcx, qword [rcx + 0x10]
jmp 0x140018c56
mov rbx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x140018c45
cmp rbx, rax
je 0x140018c66
cmp edx, dword [rbx + 0x20]
jae 0x140018c9b
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
mov rcx, rsi
call fcn.14001b1f0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.14001b230
mov rbx, qword [rsp + 0x48]
cmp byte [rbp - 0x10], 0
jne 0x140018ca6
mov r8, r14
jmp 0x140018cba
lea rax, [rbp - 0x10]
or r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140018cb0
lea rcx, [rbx + 0x28]
lea rdx, [rbp - 0x10]
call fcn.140002500
mov ebx, dword [rsp + 0x30]
cmp ebx, edi
je 0x140018d5a
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x10]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140018ce5
inc ebx
lea r8, [rsp + 0x68]
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.140002d00
movsxd rdx, ebx
mov r9, rdx
lea r8, [rbp - 0x10]
mov rcx, qword [rsp + 0x60]
call fcn.140001490
test eax, eax
je 0x140018d31
cmp eax, 0xc
je 0x140018da9
cmp eax, 0x16
je 0x140018d9e
cmp eax, 0x22
je 0x140018d9e
cmp eax, 0x50
jne 0x140018d93
mov r9d, edi
mov rdx, qword [rsp + 0x60]
mov rcx, rsi
call fcn.140019310
nop
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x140018d56
call fcn.14005fb6c
mov ebx, dword [rsp + 0x30]
inc edi
jmp 0x140018d62
mov ebx, dword [rsp + 0x30]
inc ebx
mov dword [rsp + 0x30], ebx
cmp ebx, 9
ja 0x140018db4
jmp 0x140018a80
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
int3
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
int3
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.14003cd10
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret