Function at 0x140033770
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov rax, qword [0x14033e810]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r13, rdx
mov rsi, rcx
mov qword [r11 - 0xa8], rcx
movaps xmm0, xmmword [str.SYSTEMCurrentControlSetControlhivelist]
movaps xmmword [rsp + 0xa0], xmm0
movaps xmm1, xmmword [0x1402ee950]
movaps xmmword [rsp + 0xb0], xmm1
movaps xmm0, xmmword [0x1402ee960]
movaps xmmword [r11 - 0x78], xmm0
movaps xmm1, xmmword [0x1402ee970]
movaps xmmword [r11 - 0x68], xmm1
movaps xmm0, xmmword [0x1402ee980]
movaps xmmword [r11 - 0x58], xmm0
mov eax, dword [0x1402ee990]
mov dword [r11 - 0x48], eax
mov rcx, rdx
call fcn.14000e0b0
mov rcx, qword [rsi]
cmp dword [rcx - 0x10], 0
jl 0x1400338c4
lea rdx, [0x1402ed690]
call fcn.14024112c
test rax, rax
je 0x1400338c4
sub rax, qword [rsi]
sar rax, 1
test eax, eax
js 0x1400338c4
lea r8d, [rax + 1]
xor edx, edx
mov rcx, rsi
call fcn.14002a380
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [rsp + 0xa0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400338c4
xor ebx, ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x74]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x140033914
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdi, 0xffffffffffffffff
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400338e5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1402155d0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x80], rbx
mov ecx, dword [rsp + 0x70]
add ecx, 2
mov eax, 2
mul rcx
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.1400164e0
mov r15, rax
mov qword [rsp + 0x68], rax
mov edx, dword [rsp + 0x74]
add edx, 2
mov eax, 2
mul rdx
cmovo rax, rdi
mov rcx, rax
call fcn.1400164e0
mov r12, rax
mov qword [rsp + 0x80], rax
mov word [r15], bx
mov word [rax], bx
mov r14d, ebx
cmp dword [rsp + 0x78], ebx
jbe 0x140033a24
nop word [rax + rax]
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x74]
inc eax
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x8c], ebx
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x80]
mov r8, r15
mov edx, r14d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140033a16
mov rax, qword [rsi]
cmp dword [rax - 8], 1
jle 0x140033a06
mov edx, dword [rax - 0x10]
mov rcx, rsi
call fcn.14000dd30
mov rdx, qword [rsi]
mov rcx, r12
call fcn.14024112c
test rax, rax
jne 0x140033a62
inc r14d
cmp r14d, dword [rsp + 0x78]
jb 0x140033990
mov rcx, r15
call fcn.140095d64
mov rcx, r12
call fcn.140095d64
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140033a5b
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
jmp 0x1400338e7
mov rax, rdi
inc rax
cmp word [r15 + rax*2], 0
jne 0x140033a65
mov r8d, eax
mov rdx, r15
mov rcx, r13
call fcn.14000df90
mov edx, 0x5c
mov rcx, qword [r13]
call fcn.1402413c0
test rax, rax
je 0x140033b48
mov rdx, qword [r13]
sub rax, rdx
sar rax, 1
test eax, eax
js 0x140033b48
movsxd r14, dword [rdx - 0x10]
mov ecx, r14d
sub ecx, eax
sub ecx, 1
cmovns ebx, ecx
lea rcx, [rdx - 0x18]
cmp ebx, r14d
jl 0x140033acf
call fcn.14000de80
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
jmp 0x140033b17
mov rcx, qword [rcx]
test rcx, rcx
je 0x140033ae2
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140033af1
call fcn.1400a2364
nop
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
movsxd rdx, ebx
mov r8, r14
sub r8, rdx
mov rdx, qword [r13]
lea rdx, [rdx + r8*2]
mov r9, rax
mov r8d, ebx
lea rcx, [rsp + 0x68]
call fcn.140015720
mov rbx, qword [rsp + 0x68]
lea rdx, [rsp + 0x68]
mov rcx, r13
call fcn.14000d7c0
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140033b3e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ebx, 1
jmp 0x140033a24
mov rcx, r13
call fcn.14000e0b0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r15
call fcn.140095d64
mov rcx, r12
call fcn.140095d64
nop
jmp 0x1400338cb