Function at 0x14004ab00
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7a0]
sub rsp, 0x8a0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x8f0], rbx
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp + 0x790], rax
mov r12, rdx
mov r10, rcx
xor r13d, r13d
mov qword [rsp + 0x50], r13
mov dword [rsp + 0x58], r13d
mov qword [rsp + 0x60], r13
mov r8d, dword [0x1401c4d60]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 0xb
jne 0x14004abad
mov r9d, r13d
test r8d, r8d
je 0x14004aba6
mov ecx, r8d
and ecx, 1
add r9d, ecx
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
jne 0x14004ab90
mov dword [0x1401c4d60], r9d
xor r8d, r8d
mov rdx, r10
lea rcx, [rsp + 0x70]
call fcn.140048210
nop
mov qword [rsp + 0x68], r13
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [0x1401bfd48]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test eax, eax
jne 0x14004abfe
mov dword [rsp + 0x58], r13d
mov ecx, r13d
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
test ecx, ecx
setne bl
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004ac1c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14004ac2d
xor dil, dil
mov rbx, qword [rsp + 0x50]
jmp 0x14004ae26
mov r15d, r13d
mov word [rbp - 0x70], r13w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp - 0x6e]
call fcn.1400d3710
mov dword [rsp + 0x48], 0x400
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x48]
lea r8, [rbp - 0x70]
mov edx, r15d
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc r15d
test eax, eax
jne 0x14004ae08
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
lea rcx, [rbp - 0x70]
lea rax, [rbp - 0x70]
test rax, 0xffffffffffff0000
jne 0x14004acdd
movzx ebx, cx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x14004adb7
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400025a0
jmp 0x14004adb7
lea rax, [rbp - 0x70]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14004ace5
test edi, edi
jne 0x14004ad45
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004adb7
cmp dword [rdx + 0x10], 0
jge 0x14004ad21
cmp dword [rbx - 0xc], 0
jl 0x14004ade7
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
jmp 0x14004adb7
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004ad31
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
jmp 0x14004adb7
mov r14d, dword [rbx - 0x10]
lea rsi, [rbp - 0x70]
sub rsi, rbx
sar rsi, 1
test edi, edi
js 0x14004adfd
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14004ad7d
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.1400023a0
mov rbx, qword [rsp + 0x40]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp rsi, r14
lea r14, [rax + rax]
mov r9, r14
ja 0x14004ada1
lea r8, [rbx + rsi*2]
call fcn.1400ceaf4
jmp 0x14004adaa
lea r8, [rbp - 0x70]
call fcn.1400cebf0
cmp edi, dword [rbx - 0xc]
jg 0x14004adf2
mov dword [rbx - 0x10], edi
mov word [r14 + rbx], r13w
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.140027d70
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004ac30
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14004ac30
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
nop
test rbx, rbx
je 0x14004ae1e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r13
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], r13d
mov dil, 1
test rbx, rbx
je 0x14004ae39
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r13
mov dword [rsp + 0x58], r13d
movzx eax, dil
mov rcx, qword [rbp + 0x790]
xor rcx, rsp
call fcn.1400ce2d0
mov rbx, qword [rsp + 0x8f0]
add rsp, 0x8a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret