Function at 0x14001ac60
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x7f8]
sub rsp, 0x8c0
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
mov r15, rdx
mov r14, rcx
mov qword [rbp - 0x60], rcx
mov al, byte [0x1401aad84]
neg al
sbb rbx, rbx
add rbx, 0xffffffff80000002
lea rcx, [0x1401a29a8]
mov rax, qword [0x1401a29a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
xor r12d, r12d
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x58], r12
lea rdx, [0x14013ae08]
lea rcx, [rbp - 0x80]
call fcn.140002df8
nop
mov r8, rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.14000de60
nop
lea r8, [0x1401ab268]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14000de60
nop
lea r8, [0x14013ad98]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140019018
nop
mov r8, r14
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.14000de60
nop
lea r9d, [r12 + 1]
mov r8, qword [rax]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140019dc4
test eax, eax
setne bl
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
or r13, 0xffffffffffffffff
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001ad7d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001ad9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001adc0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001ade2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001ae02
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14001ae68
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001ae1b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001ae42
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001ae61
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x14001b0e5
mov r8d, dword [0x1401aad80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 0xd
jne 0x14001aed9
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x2f4
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.1400bcf98
mov rcx, rax
call fcn.1400be048
mov dword [rsp + 0x40], 0x400
mov word [rbp - 0x50], r12w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp - 0x4e]
call fcn.1400c2d60
mov esi, r12d
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x50]
mov edx, esi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
mov r10d, 1
add esi, r10d
test eax, eax
je 0x14001af41
cmp eax, 0x103
jne 0x14001b066
mov r9d, dword [0x1401aad80]
lea r8d, [r9 + 2]
lea ecx, [r9 + 1]
imul r8d, ecx
imul r8d, r9d
mov eax, 0x66666667
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*4]
add ecx, ecx
mov eax, r8d
sub eax, ecx
cmp eax, 3
jne 0x14001afff
and r8d, 0x80000007
jge 0x14001af90
sub r8d, r10d
or r8d, 0xfffffff8
add r8d, r10d
cmp r8d, 3
je 0x14001afe2
mov r8d, r9d
imul r8d, r9d
imul r8d, r9d
mov eax, 0x2aaaaaab
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub r8d, ecx
cmp r8d, 2
jne 0x14001afe2
mov r8d, r12d
test r9d, r9d
je 0x14001afdf
mov ecx, r9d
and ecx, r10d
add r8d, ecx
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
mov r9d, eax
jne 0x14001afc9
mov r9d, r8d
mov ecx, r10d
cmp r9d, r10d
jle 0x14001aff9
mov eax, r9d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r9d
jl 0x14001afea
mov dword [0x1401aad80], ecx
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x60]
call fcn.140001f6c
nop
mov rax, qword [rsp + 0x60]
cmp dword [rax - 0x10], r12d
je 0x14001b026
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.14001b514
mov dword [rsp + 0x40], 0x400
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x50]
call fcn.1400c2d60
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001b061
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x48]
test edi, edi
je 0x14001aeff
test rbx, rbx
je 0x14001b084
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r12
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], r12d
test rbx, rbx
je 0x14001b09c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001b0c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov ecx, r13d
lock xadd dword [rdx + 0x10], ecx
add ecx, r13d
test ecx, ecx
jg 0x14001b0e3
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, 1
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.1400bd920
mov rbx, qword [rsp + 0x910]
add rsp, 0x8c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret