Function at 0x140004280
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x14004a040]
xor rax, rsp
mov qword [rbp], rax
mov edi, r8d
mov r15, rcx
mov qword [rsp + 0x38], rcx
xor r14d, r14d
mov r8, rdx
lea rdx, str.CLSID_
lea rcx, [rbp - 0x60]
call fcn.14000b770
nop
lea rdx, str.LocalServer32
mov rcx, rax
call fcn.14000a7a0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x140004349
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004344
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b84
call fcn.140011900
mov r12, r14
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x70], r14d
mov qword [rsp + 0x78], r14
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rdx, qword [rbp - 0x40]
or edi, 0x20019
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test eax, eax
jne 0x1400043ab
mov r12, qword [rsp + 0x38]
mov qword [rsp + 0x68], r12
and edi, 0x300
mov dword [rsp + 0x70], edi
mov eax, r14d
test ecx, ecx
cmovne eax, ecx
xor r8d, r8d
test eax, eax
je 0x140004456
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], r14
mov qword [r15 + 0x18], r14
lea rdx, [0x1400415cc]
mov rcx, r15
call fcn.14000c000
nop
test r12, r12
je 0x1400043ec
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x14000442c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004427
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b7e
call fcn.140011900
mov rax, r15
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1400118e0
mov rbx, qword [rsp + 0x168]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x30], r14d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x38]
xor edx, edx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004afd
mov eax, dword [rsp + 0x38]
dec eax
cmp eax, 1
ja 0x140004afd
mov edi, dword [rsp + 0x30]
shr edi, 1
mov r8d, edi
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
xor edx, edx
lea rcx, [rbp - 0x80]
call fcn.14000bec0
nop
lea rbx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rbx, qword [rbp - 0x80]
lea eax, [rdi + rdi]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x38]
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004b78
mov eax, dword [rsp + 0x38]
dec eax
cmp eax, 1
ja 0x140004b78
mov ecx, dword [rsp + 0x30]
test rbx, rbx
je 0x140004530
test ecx, ecx
je 0x14000452c
test cl, 1
jne 0x140004b78
mov eax, ecx
shr rax, 1
cmp word [rbx + rax*2 - 2], 0
jne 0x140004b78
jmp 0x140004530
mov word [rbx], r14w
shr ecx, 1
dec ecx
mov r8, qword [rbp - 0x70]
cmp rcx, r8
ja 0x140004556
lea rax, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rax, qword [rbp - 0x80]
mov qword [rbp - 0x70], rcx
mov word [rax + rcx*2], r14w
jmp 0x1400045af
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rbp - 0x68]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x14000459a
mov qword [rbp - 0x70], rcx
lea r9, [rbp - 0x80]
cmp rdi, 7
cmova r9, qword [rbp - 0x80]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x14000458f
movzx eax, r14w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [rdx + r8]
mov word [r9 + rax*2], r14w
jmp 0x1400045af
mov word [rsp + 0x20], r14w
mov r9, rdx
xor r8d, r8d
lea rcx, [rbp - 0x80]
call fcn.14000cb00
lea rax, [rbp - 0x80]
mov r9, qword [rbp - 0x80]
mov r10, qword [rbp - 0x68]
cmp r10, 7
cmova rax, r9
cmp word [rax], 0x22
jne 0x140004759
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
mov rax, qword [rbp - 0x70]
cmp rax, 1
jb 0x140004b8a
dec rax
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rdx, [rbp - 0x80]
cmp r10, 7
cmova rdx, r9
add rdx, 2
lea rcx, [rbp - 0x60]
call fcn.14000c000
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x140004654
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000464f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ba2
call fcn.140011900
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rbp - 0x50]
movups xmmword [rbp - 0x70], xmm1
lea rdx, [rbp - 0x80]
movq r9, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r10, xmm0
cmp r10, 7
cmova rdx, r9
movq rdi, xmm1
test rdi, rdi
je 0x1400047bc
mov rax, rdi
mov rcx, rdx
mov r8, r14
cmp word [rdx], 0x22
je 0x1400046b3
cmp rax, 1
je 0x1400046b6
dec rax
add rcx, 2
cmp word [rcx], 0x22
jne 0x1400046a0
mov r8, rcx
test r8, r8
je 0x1400047bc
sub r8, rdx
sar r8, 1
cmp r8, 0xffffffffffffffff
je 0x1400047bc
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
cmp rdi, r8
cmovb r8, rdi
lea rdx, [rbp - 0x80]
cmp r10, 7
cmova rdx, r9
lea rcx, [rbp - 0x60]
call fcn.14000c000
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x14000473a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004735
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ba2
call fcn.140011900
movups xmm1, xmmword [rbp - 0x60]
movups xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rbp - 0x70], xmm0
psrldq xmm0, 8
movq r10, xmm0
movq r9, xmm1
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov r13, qword [rbp - 0x70]
lea rdi, [rbp - 0x80]
cmp r10, 7
cmova rdi, r9
movabs rsi, 0x7ffffffffffffffe
cmp r13, rsi
ja 0x140004b90
cmp r13, 7
ja 0x140004834
mov esi, 7
mov qword [rsp + 0x58], rsi
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x40], xmm0
mov r14, r13
mov qword [rsp + 0x50], r13
movq rbx, xmm0
jmp 0x1400048ff
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], r14
mov qword [r15 + 0x18], r14
xor r8d, r8d
lea rdx, [0x1400415cc]
mov rcx, r15
call fcn.14000c000
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x14000481e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004819
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b96
call fcn.140011900
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r14w
jmp 0x1400043dd
mov qword [rsp + 0x58], 7
mov rax, r13
or rax, 7
cmp rax, rsi
jbe 0x140004859
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14000488b
mov rsi, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140004b72
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400048b7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004b72
mov rcx, rax
call fcn.140011908
test rax, rax
je 0x140004b9c
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400048c9
test rcx, rcx
je 0x1400048c6
call fcn.140011908
mov rbx, rax
jmp 0x1400048c9
mov rbx, r14
mov qword [rsp + 0x40], rbx
mov r14, r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], rsi
lea r8, [r13*2 + 2]
mov rdx, rdi
mov rcx, rbx
call fcn.140033730
mov r10, qword [rbp - 0x68]
mov r13, qword [rbp - 0x70]
mov r9, qword [rbp - 0x80]
movups xmm0, xmmword [rsp + 0x40]
lea rdi, [rsp + 0x40]
cmp rsi, 7
cmova rdi, rbx
lea rax, [rsp + 0x40]
cmova rax, rbx
lea rbx, [rax + r14*2]
cmp rdi, rbx
je 0x140004945
nop
movzx ecx, word [rdi]
call fcn.14001cbcc
mov word [rdi], ax
add rdi, 2
cmp rdi, rbx
jne 0x140004920
mov r10, qword [rbp - 0x68]
mov r13, qword [rbp - 0x70]
mov r9, qword [rbp - 0x80]
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbp - 0x10], xmm1
lea rbx, [rbp - 0x20]
movq r11, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r14, xmm0
cmp r14, 7
cmova rbx, r11
movq rax, xmm1
cmp rax, 5
jb 0x140004a02
lea rsi, [rax - 4]
lea rsi, [rbx + rsi*2]
mov rdi, rbx
lea r8, str..exe
mov rax, rsi
sub rax, rdi
sar rax, 1
mov ecx, 0
je 0x1400049be
cmp word [rdi], 0x2e
je 0x1400049bb
cmp rax, 1
je 0x1400049be
dec rax
add rdi, 2
cmp word [rdi], 0x2e
jne 0x1400049a8
mov rcx, rdi
mov rdi, rcx
test rcx, rcx
je 0x140004a02
mov edx, 5
mov rcx, r8
mov r8, rdi
lea rax, str..exe
sub r8, rax
nop dword [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x1400049fc
add rcx, 2
sub rdx, 1
jne 0x1400049e0
sub rdi, rbx
sar rdi, 1
jmp 0x140004a09
add rdi, 2
jmp 0x14000498b
mov rdi, 0xffffffffffffffff
cmp r14, 7
jbe 0x140004a50
lea rdx, [r14*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x140004a3c
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b9c
mov rcx, r11
call fcn.140011900
mov r10, qword [rbp - 0x68]
mov r13, qword [rbp - 0x70]
mov r9, qword [rbp - 0x80]
cmp rdi, 0xffffffffffffffff
je 0x140004ad5
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
lea r8, [rdi + 4]
cmp r13, r8
cmovb r8, r13
lea rdx, [rbp - 0x80]
cmp r10, 7
cmova rdx, r9
lea rcx, [rbp - 0x60]
call fcn.14000c000
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x140004ac5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ac0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ba2
call fcn.140011900
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rbp - 0x50]
movups xmmword [rbp - 0x70], xmm1
xor eax, eax
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [r15 + 0x10], xmm1
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], ax
jmp 0x1400043dd
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], r14
mov qword [r15 + 0x18], r14
xor r8d, r8d
lea rdx, [0x1400415cc]
mov rcx, r15
call fcn.14000c000
nop
test r12, r12
je 0x140004b2e
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x14000442c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004427
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b7e
jmp 0x140004427
call fcn.1400015d0
int3
call fcn.1400185d4
nop
call fcn.14001d3f4
nop
call fcn.14001d3f4
nop
call fcn.14000b3f0
int3
call fcn.140001670
nop
call fcn.14001d3f4
nop
call fcn.14001d3f4
int3
call fcn.14001d3f4
int3