Function at 0x140004290
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0xd0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x48], 0xfffffffffffffffe
mov qword [rbp + 0x20], r9
mov qword [rbp + 0x28], r8
mov qword [rbp + 0x30], rdx
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x40], rcx
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400042ee
jmp 0x140004dea
mov rcx, qword [rbp + 0x28]
mov r8, qword [rbp + 0x20]
mov r10, qword [rbp + 0x38]
mov eax, 0x10
mov qword [rbp], rax
call fcn.1400451b0
sub rsp, rax
mov rax, qword [rbp]
mov r9, rsp
call fcn.1400451b0
sub rsp, rax
mov rax, qword [rbp]
mov rdx, rsp
mov qword [rbp - 0x28], rdx
call fcn.1400451b0
sub rsp, rax
mov rax, qword [rbp]
mov r11, rsp
mov qword [rbp + 0x10], r11
call fcn.1400451b0
sub rsp, rax
mov rax, qword [rbp]
mov r11, rsp
mov qword [rbp - 0x20], r11
call fcn.1400451b0
sub rsp, rax
mov rax, qword [rbp]
mov r11, rsp
mov qword [rbp - 0x18], r11
call fcn.1400451b0
sub rsp, rax
mov rax, qword [rbp]
mov r11, rsp
mov qword [rbp - 0x10], r11
call fcn.1400451b0
sub rsp, rax
mov rax, qword [rbp]
mov r11, rsp
mov qword [rbp - 8], r11
call fcn.1400451b0
sub rsp, rax
mov rax, qword [rbp]
mov r11, rsp
mov qword [rbp + 8], r11
call fcn.1400451b0
sub rsp, rax
mov rax, qword [rbp + 0x10]
mov r11, rsp
mov qword [rbp + 0x18], r11
mov qword [r9], r10
mov qword [rdx], r8
mov qword [rax], rcx
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400043e5
jmp 0x140004dea
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004417
jmp 0x140004e36
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x30]
mov qword [rcx], rdx
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.140007a90
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp - 0x18]
mov rcx, qword [rcx]
xor r8d, r8d
mov r9d, 0x20019
sub rsp, 0x30
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add rsp, 0x30
cmp eax, 0
sete al
mov byte [rbp - 0x29], al
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000449b
jmp 0x140004e36
mov al, byte [rbp - 0x29]
test al, 1
jne 0x1400044ab
jmp 0x140004cfb
mov rax, qword [rbp - 0x28]
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.140007a90
mov rcx, qword [rbp - 0x18]
mov r9, qword [rbp - 0x10]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp - 8]
mov rcx, qword [rcx]
xor r8d, r8d
sub rsp, 0x30
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add rsp, 0x30
mov dword [rbp - 0x30], eax
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004525
jmp 0x140004e84
mov eax, dword [rbp - 0x30]
cmp eax, 0
sete al
mov byte [rbp - 0x31], al
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004563
jmp 0x140004e84
mov al, byte [rbp - 0x31]
test al, 1
jne 0x140004573
jmp 0x140004c11
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400045a5
jmp 0x140004e89
mov rax, qword [rbp - 0x10]
cmp dword [rax], 1
sete al
mov byte [rbp - 0x32], al
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400045e4
jmp 0x140004e89
mov al, byte [rbp - 0x32]
test al, 1
jne 0x1400045f4
jmp 0x140004ba8
mov rax, qword [rbp - 8]
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 8]
mov byte [rdx], 0
mov eax, dword [rax]
mov edx, eax
xor r8d, r8d
sub rsp, 0x20
call fcn.140007c80
mov rcx, qword [rbp + 0x38]
add rsp, 0x20
xor eax, eax
mov edx, eax
sub rsp, 0x20
call fcn.140007e80
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x40], rcx
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.140007a90
mov rcx, qword [rbp - 0x18]
mov r10, qword [rbp - 0x40]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp - 8]
mov rcx, qword [rcx]
xor r8d, r8d
mov r9d, r8d
sub rsp, 0x30
mov r8, r9
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add rsp, 0x30
cmp eax, 0
jne 0x140004884
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400046b5
jmp 0x140004e8e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
add eax, 0x7dccd8cc
sub eax, 1
sub eax, 0x7dccd8cc
mov dword [rbp - 0x44], eax
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400046fd
jmp 0x140004e8e
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000472f
jmp 0x140004e93
mov eax, dword [rbp - 0x44]
mov eax, eax
mov qword [rbp - 0x50], rax
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000476a
jmp 0x140004e93
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp + 0x38]
sub rsp, 0x20
xor eax, eax
mov r8b, al
call fcn.140008050
add rsp, 0x20
jmp 0x140004789
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400047bb
jmp 0x140004e98
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
mov qword [rbp - 0x58], rax
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400047f8
jmp 0x140004e98
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000482a
jmp 0x140004e9d
mov rcx, qword [rbp - 0x58]
sub rsp, 0x20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 8]
add rsp, 0x20
mov rax, qword [rbp + 0x18]
mov byte [rcx], 1
mov dword [rax], 1
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000487f
jmp 0x140004e9d
jmp 0x1400048f7
mov rax, qword [rbp + 0x18]
mov dword [rax], 0
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400048c0
jmp 0x140004ec5
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400048f2
jmp 0x140004ec5
jmp 0x1400048f7
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004929
jmp 0x140004eca
mov rax, qword [rbp + 8]
mov al, byte [rax]
mov byte [rbp - 0x59], al
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004964
jmp 0x140004eca
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004996
jmp 0x140004ecf
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400049c8
jmp 0x140004ecf
mov al, byte [rbp - 0x59]
test al, 1
jne 0x140004a52
jmp 0x1400049d8
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004a0a
jmp 0x140004ed4
mov rcx, qword [rbp + 0x38]
sub rsp, 0x20
call fcn.1400066e0
add rsp, 0x20
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004a4d
jmp 0x140004ed4
jmp 0x140004a52
mov rax, qword [rbp + 0x18]
mov eax, dword [rax]
mov dword [rbp - 0x60], eax
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004a8d
jmp 0x140004eea
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004abf
jmp 0x140004eea
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004af1
jmp 0x140004eef
mov eax, dword [rbp - 0x60]
cmp eax, 1
sete al
mov byte [rbp - 0x61], al
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004b2f
jmp 0x140004eef
mov al, byte [rbp - 0x61]
test al, 1
jne 0x140004de0
jmp 0x140004b3f
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004b71
jmp 0x140004ef4
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004ba3
jmp 0x140004ef4
jmp 0x140004ba8
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004bda
jmp 0x140004ef9
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004c0c
jmp 0x140004ef9
jmp 0x140004c11
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004c43
jmp 0x140004efe
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
mov qword [rbp - 0x70], rax
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004c80
jmp 0x140004efe
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004cb2
jmp 0x140004f03
mov rcx, qword [rbp - 0x70]
sub rsp, 0x20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x20
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004cf6
jmp 0x140004f03
jmp 0x140004cfb
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004d2d
jmp 0x140004f1a
mov rcx, qword [rbp + 0x38]
lea rdx, [0x140046a3c]
sub rsp, 0x20
call fcn.140008780
add rsp, 0x20
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004d77
jmp 0x140004f1a
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004da9
jmp 0x140004f37
mov eax, dword [0x14004933c]
mov ecx, dword [0x140049340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004ddb
jmp 0x140004f37
jmp 0x140004de0
mov rax, qword [rbp + 0x40]
lea rsp, [rbp + 0x50]
pop rbp
ret
mov rcx, qword [rbp + 0x28]
mov r8, qword [rbp + 0x20]
mov r10, qword [rbp + 0x38]
mov eax, 0x10
mov qword [rbp - 0x78], rax
call fcn.1400451b0
sub rsp, rax
mov rax, qword [rbp - 0x78]
mov r9, rsp
call fcn.1400451b0
sub rsp, rax
mov rax, qword [rbp - 0x78]
mov rdx, rsp
call fcn.1400451b0
sub rsp, rax
mov rax, rsp
mov qword [r9], r10
mov qword [rdx], r8
mov qword [rax], rcx
jmp 0x1400042ee
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x30]
mov qword [rcx], rdx
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.140007a90
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp - 0x18]
mov rcx, qword [rcx]
xor r8d, r8d
mov r9d, 0x20019
sub rsp, 0x30
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add rsp, 0x30
jmp 0x140004417
jmp 0x140004525
jmp 0x1400045a5
jmp 0x1400046b5
jmp 0x14000472f
jmp 0x1400047bb
mov rcx, qword [rbp - 0x58]
sub rsp, 0x20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 8]
add rsp, 0x20
mov rax, qword [rbp + 0x18]
mov byte [rcx], 1
mov dword [rax], 1
jmp 0x14000482a
jmp 0x1400048c0
jmp 0x140004929
jmp 0x140004996
mov rcx, qword [rbp + 0x38]
sub rsp, 0x20
call fcn.1400066e0
add rsp, 0x20
jmp 0x140004a0a
jmp 0x140004a8d
jmp 0x140004af1
jmp 0x140004b71
jmp 0x140004bda
jmp 0x140004c43
mov rcx, qword [rbp - 0x70]
sub rsp, 0x20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x20
jmp 0x140004cb2
mov rcx, qword [rbp + 0x38]
lea rdx, [0x140046a3c]
sub rsp, 0x20
call fcn.140008780
add rsp, 0x20
jmp 0x140004d2d
jmp 0x140004da9