Function at 0x14003d254
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x82a0]
mov eax, 0x83a0
call fcn.1400c0180
sub rsp, rax
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x83f0], rbx
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp + 0x8290], rax
mov r15, rdx
mov qword [rbp - 0x80], rdx
xor r12d, r12d
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x58], r12
xor r8d, r8d
mov rdx, rcx
lea rcx, [rsp + 0x78]
call fcn.14003b200
nop
mov r9d, 0x2001f
mov r8, qword [rax]
mov rdx, qword [0x14019ed48]
lea rcx, [rsp + 0x48]
call fcn.1400199a4
test eax, eax
setne bl
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14003d2f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14003d309
mov bl, r12b
mov rdi, qword [rsp + 0x48]
jmp 0x14003d591
mov dword [rsp + 0x40], 0x4000
mov word [rbp + 0x290], r12w
xor edx, edx
mov r8d, 0x7ffe
lea rcx, [rbp + 0x292]
call fcn.1400c0510
mov r8d, dword [0x1401a3d80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 9
jne 0x14003d37b
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov r8d, dword [0x1401a3d80]
mov r14d, r12d
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov ebx, 1
and ecx, 0x8000000f
jge 0x14003d3a1
sub ecx, ebx
or ecx, 0xfffffff0
add ecx, ebx
cmp ecx, 0xd
jne 0x14003d41a
jmp 0x14003d415
mov eax, r8d
and eax, 0x80000001
jge 0x14003d3b9
sub eax, ebx
or eax, 0xfffffffe
add eax, ebx
test eax, eax
jne 0x14003d3d0
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov dword [0x1401a3d80], eax
jmp 0x14003d3df
lea r8d, [r8*2 + 1]
mov dword [0x1401a3d80], r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov ecx, r8d
sub ecx, eax
je 0x14003d403
sub ecx, 2
je 0x14003d407
dec ecx
je 0x14003d40a
jmp 0x14003d415
add r8d, 2
add r8d, ebx
add r8d, 2
mov dword [0x1401a3d80], r8d
test r8d, r8d
jne 0x14003d3a8
mov rdi, qword [rsp + 0x48]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x290]
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
mov dword [rsp + 0x60], eax
add r14d, ebx
mov dword [rsp + 0x70], r14d
test eax, eax
je 0x14003d464
cmp eax, 0x103
jne 0x14003d4c9
lea rdx, [rbp + 0x290]
lea rcx, [rsp + 0x68]
call fcn.1400020f8
nop
mov rcx, qword [rsp + 0x68]
cmp dword [rcx - 0x10], r12d
je 0x14003d48e
lea rdx, [rsp + 0x68]
mov rcx, r15
call fcn.14001af6c
mov dword [rsp + 0x40], 0x4000
xor edx, edx
mov r8d, 0x8000
lea rcx, [rbp + 0x290]
call fcn.1400c0510
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14003d4c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x48]
mov r11d, dword [0x1401a3d80]
mov ecx, r11d
imul ecx, r11d
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 0xd
jne 0x14003d56e
xor esi, esi
mov r8d, esi
lea r9, [rbp - 0x70]
mov r14b, r11b
sub r14b, r8b
mov r10d, ebx
mov r15d, 0xc
mov r12, rsi
mov eax, r11d
cdq
idiv r10d
mov dword [rsp + 0x74], edx
mov r13d, ebx
mov edi, edx
mov eax, r11d
cdq
idiv r13d
mov ecx, eax
mov al, r14b
imul cl
mov cl, al
mov al, dil
imul cl
mov byte [r9 + r12], al
add r13d, ebx
add r12, rbx
cmp r12, 0x10
jl 0x14003d51f
add r10d, ebx
add r9, 0x10
sub r15, rbx
jne 0x14003d50c
add r8d, ebx
cmp r8d, 4
jl 0x14003d4fd
mov rdi, qword [rsp + 0x48]
mov esi, dword [rsp + 0x60]
mov r14d, dword [rsp + 0x70]
mov r15, qword [rbp - 0x80]
xor r12d, r12d
test esi, esi
je 0x14003d41f
test rdi, rdi
je 0x14003d58c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r12
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
test rdi, rdi
je 0x14003d5a4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
mov al, bl
mov rcx, qword [rbp + 0x8290]
xor rcx, rsp
call fcn.1400bb0d0
mov rbx, qword [rsp + 0x83f0]
add rsp, 0x83a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret