Function at 0x14009abc0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
mov rbx, rdx
mov rsi, rcx
lea r14, section..data
mov rcx, qword [section..data]
cmp rcx, r14
je 0x14009ac13
test byte [rcx + 0x1c], 1
je 0x14009ac13
cmp byte [rcx + 0x19], 5
jb 0x14009ac13
mov edx, 0x1d
lea r8, [0x1400bd8a8]
mov rcx, qword [rcx + 0x10]
call fcn.1400062b0
mov rcx, qword [rbx]
xor r13d, r13d
test rcx, rcx
je 0x14009ac4f
mov edi, r13d
cmp dword [rbx + 8], r13d
jle 0x14009ac40
movsxd rcx, edi
shl rcx, 5
add rcx, qword [rbx]
call fcn.14003c81c
inc edi
cmp edi, dword [rbx + 8]
jl 0x14009ac27
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
nop dword [rax + rax]
mov qword [rbx], r13
mov qword [rbx + 8], r13
mov edi, 0x54f
mov rdx, qword [rsi + 8]
cmp dword [rdx - 0x10], r13d
je 0x14009b234
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x19], r13
lea rcx, [rbp - 0x29]
call fcn.14009a978
mov edi, eax
mov rcx, qword [section..data]
cmp rcx, r14
je 0x14009acad
test byte [rcx + 0x1c], 2
je 0x14009acad
cmp byte [rcx + 0x19], 4
jb 0x14009acad
mov edx, 0x1e
mov r9d, eax
lea r8, [0x1400bd8a8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
mov qword [rbp - 0x61], r13
mov qword [rbp - 0x59], r13
test edi, edi
jne 0x14009b215
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x29]
call fcn.1400917dc
mov edi, eax
mov rcx, qword [section..data]
cmp rcx, r14
je 0x14009acfc
test byte [rcx + 0x1c], 2
je 0x14009acfc
cmp byte [rcx + 0x19], 4
jb 0x14009acfc
mov edx, 0x1f
mov r9d, eax
lea r8, [0x1400bd8a8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
test edi, edi
jne 0x14009b215
mov r12d, r13d
mov r14d, dword [rbp - 0x59]
test r14d, r14d
jle 0x14009b20e
mov r15, r13
mov rsi, r13
mov qword [rbp - 0x49], r13
mov qword [rbp - 0x41], r13
mov qword [rbp - 0x39], r13
test r15, r15
js 0x14009b28b
cmp r12d, r14d
jge 0x14009b28b
mov r13, qword [rbp - 0x61]
and qword [rbp - 0x31], 0
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, qword [r13 + r15*8]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14009ad76
mov rsi, qword [rbp - 0x31]
mov qword [rbp - 0x49], rsi
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x14009adad
test byte [rcx + 0x1c], 2
je 0x14009adad
cmp byte [rcx + 0x19], 4
jb 0x14009adad
mov edx, 0x20
mov r9d, edi
lea r8, [0x1400bd8a8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
test edi, edi
jne 0x14009b186
mov rax, qword [0x1400cce40]
movabs r10, 0xb1a8ae8f5a5da170
lea rdi, [0x1400cce40]
mov rcx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x140071786.0]
add rax, 0x18
mov qword [rbp - 0x51], rax
mov rax, qword [0x1400cce40]
movabs r10, 0xb1a8ae8f5a5da170
mov rcx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x140071786.0]
add rax, 0x18
mov qword [rbp - 0x69], rax
mov rax, qword [0x1400cce40]
movabs r10, 0xb1a8ae8f5a5da170
mov rcx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x140071786.0]
add rax, 0x18
mov qword [rbp + 0x7f], rax
mov dword [rbp + 0x67], 4
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f]
xor r8d, r8d
lea rdx, str.Reason
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14009ae77
mov eax, dword [rbp + 0x6f]
sub eax, 4
neg eax
sbb edi, edi
and edi, 0xd
mov rcx, qword [section..data]
lea r14, section..data
mov sil, 2
cmp rcx, r14
je 0x14009aeb1
test byte [rcx + 0x1c], sil
je 0x14009aeb1
cmp byte [rcx + 0x19], 4
jb 0x14009aeb1
mov edx, 0x21
mov r9d, edi
lea r8, [0x1400bd8a8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
test edi, edi
jne 0x14009af97
lea r8, [rbp - 0x51]
lea rdx, [0x1400bd870]
lea rcx, [rbp - 0x49]
call fcn.140091e58
mov edi, eax
mov rcx, qword [section..data]
cmp rcx, r14
je 0x14009aeff
test byte [rcx + 0x1c], sil
je 0x14009aeff
cmp byte [rcx + 0x19], 4
jb 0x14009aeff
mov edx, 0x22
mov r9d, eax
lea r8, [0x1400bd8a8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
test edi, edi
jne 0x14009af97
lea r8, [rbp - 0x69]
lea rdx, [0x1400bd878]
lea rcx, [rbp - 0x49]
call fcn.140091e58
mov edi, eax
mov rcx, qword [section..data]
cmp rcx, r14
je 0x14009af4d
test byte [rcx + 0x1c], sil
je 0x14009af4d
cmp byte [rcx + 0x19], 4
jb 0x14009af4d
mov edx, 0x23
mov r9d, eax
lea r8, [0x1400bd8a8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
test edi, edi
jne 0x14009af97
lea r8, [rbp + 0x7f]
lea rdx, str.Scope
lea rcx, [rbp - 0x49]
call fcn.140091e58
mov edi, eax
mov rcx, qword [section..data]
cmp rcx, r14
je 0x14009af97
test byte [rcx + 0x1c], sil
je 0x14009af97
cmp byte [rcx + 0x19], 4
jb 0x14009af97
mov edx, 0x24
mov r9d, eax
lea r8, [0x1400bd8a8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
lea rdx, str.ignored
mov rcx, qword [rbp - 0x69]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x14009afe1
lea rcx, [rbp - 0x69]
call fcn.1400056f8
mov rcx, qword [section..data]
cmp rcx, r14
je 0x14009afe1
test byte [rcx + 0x1c], sil
je 0x14009afe1
cmp byte [rcx + 0x19], 4
jb 0x14009afe1
mov edx, 0x25
lea r8, [0x1400bd8a8]
mov rcx, qword [rcx + 0x10]
call fcn.1400062b0
lea rdx, str.ignored
mov rcx, qword [rbp + 0x7f]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x14009b02b
lea rcx, [rbp + 0x7f]
call fcn.1400056f8
mov rcx, qword [section..data]
cmp rcx, r14
je 0x14009b02b
test byte [rcx + 0x1c], sil
je 0x14009b02b
cmp byte [rcx + 0x19], 4
jb 0x14009b02b
mov edx, 0x26
lea r8, [0x1400bd8a8]
mov rcx, qword [rcx + 0x10]
call fcn.1400062b0
test edi, edi
jne 0x14009b0ee
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x69]
mov r8, qword [rbp - 0x51]
mov edx, dword [rbp + 0x77]
lea rcx, [rbp - 0x11]
call fcn.14009a394
mov rsi, rax
mov eax, dword [rbx + 8]
cmp eax, dword [rbx + 0xc]
jne 0x14009b09c
cmp dword [rbx + 0xc], edi
jne 0x14009b067
mov edi, 1
jmp 0x14009b06e
lea edi, [rax + rax]
test edi, edi
js 0x14009b0b8
mov edx, edi
cmp rdx, 0x3ffffff
ja 0x14009b0b8
mov r8d, 0x20
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__recalloc]
nop dword [rax + rax]
test rax, rax
je 0x14009b0b8
mov dword [rbx + 0xc], edi
mov qword [rbx], rax
mov eax, dword [rbx + 8]
movsxd rcx, eax
shl rcx, 5
add rcx, qword [rbx]
je 0x14009b0b3
mov rdx, rsi
call fcn.14009a4d0
mov eax, dword [rbx + 8]
inc eax
mov dword [rbx + 8], eax
lea rcx, [rbp - 0x11]
call fcn.14003c81c
mov rcx, qword [section..data]
cmp rcx, r14
je 0x14009b0ee
test byte [rcx + 0x1c], 2
je 0x14009b0ee
cmp byte [rcx + 0x19], 4
jb 0x14009b0ee
mov edx, 0x27
lea r8, [0x1400bd8a8]
mov rcx, qword [rcx + 0x10]
call fcn.1400062b0
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14009b120
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
mov rdx, qword [rbp - 0x69]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14009b14f
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14009b17e
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
mov rsi, qword [rbp - 0x49]
mov r14d, dword [rbp - 0x59]
test rsi, rsi
je 0x14009b1a0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
xor esi, esi
mov qword [rbp - 0x49], rsi
mov rdx, qword [r13 + r15*8]
lea rcx, [rbp - 0x29]
call fcn.140091164
mov edi, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x14009b1e8
test byte [rcx + 0x1c], 2
je 0x14009b1e8
cmp byte [rcx + 0x19], 4
jb 0x14009b1e8
mov edx, 0x28
mov r9d, edi
lea r8, [0x1400bd8a8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
nop
xor r13d, r13d
test rsi, rsi
je 0x14009b1ff
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
inc r12d
inc r15
cmp r12d, r14d
jl 0x14009ad17
lea r14, section..data
lea rcx, [rbp - 0x61]
call fcn.140015550
nop
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14009b234
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [section..data]
cmp rcx, r14
je 0x14009b274
test byte [rcx + 0x1c], 1
je 0x14009b274
movzx r9d, byte [rcx + 0x19]
mov eax, edi
neg eax
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp r9d, edx
jb 0x14009b274
mov edx, 0x29
mov r9d, edi
lea r8, [0x1400bd8a8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
mov eax, edi
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0xc000008c
call fcn.140006108
int3