Function at 0x14001ada0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x48
lea rax, [rsp + 0x60]
mov dword [rsp + 0x58], 3
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x50], 0
lea rdx, str.Console
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001ae0c
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], 0
lea rdx, str.Vendata
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x50], 0xa
jbe 0x14001b50e
mov qword [rsp + 0x68], rbx
xor edx, edx
mov qword [rsp + 0x40], rsi
mov r8d, 0x7d0
lea rsi, str.xiugaishiyong
mov qword [rsp + 0x38], rdi
mov rcx, rsi
mov qword [rsp + 0x30], r14
call fcn.14003d990
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, str.Vendata
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [0x14005a8fe]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
lea rcx, [0x14005a8fe]
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.14003d990
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r14, [0x14004bbc0]
movsxd rbx, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r8d, r8d
movsxd rdi, eax
mov r10, rbx
test ebx, ebx
jle 0x14001af38
xor ecx, ecx
nop dword [rax + rax]
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x14001aee6
lea rbx, [rsi + rcx*2]
nop dword [rax]
movzx eax, word [r14 + rdx*2]
cmp word [rbx + rdx*2], ax
jne 0x14001aee6
inc r9d
inc rdx
cmp rdx, rdi
jl 0x14001aed0
cmp r9d, edi
jne 0x14001af12
add r8d, edi
add rcx, rdi
movsxd rax, r8d
cmp rcx, r10
jge 0x14001af12
nop dword [rax]
cmp word [rsi + rcx*2], 0x7c
je 0x14001af1f
inc r8d
inc rcx
cmp rcx, r10
jl 0x14001af00
inc r8d
inc rcx
cmp rcx, r10
jl 0x14001aec0
jmp 0x14001af38
sub r8d, eax
lea rdx, [rsi + rax*2]
add r8d, r8d
lea rcx, [0x14005a8fe]
movsxd r8, r8d
call fcn.14003d2f0
lea rcx, str.4433
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
lea rcx, str.4433
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.14003d990
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r14, [0x14004bbc8]
movsxd rbx, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r8d, r8d
movsxd rdi, eax
mov r10, rbx
test ebx, ebx
jle 0x14001b008
xor ecx, ecx
nop dword [rax]
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x14001afb6
lea rbx, [rsi + rcx*2]
nop dword [rax]
movzx eax, word [r14 + rdx*2]
cmp word [rbx + rdx*2], ax
jne 0x14001afb6
inc r9d
inc rdx
cmp rdx, rdi
jl 0x14001afa0
cmp r9d, edi
jne 0x14001afe2
add r8d, edi
add rcx, rdi
movsxd rax, r8d
cmp rcx, r10
jge 0x14001afe2
nop dword [rax]
cmp word [rsi + rcx*2], 0x7c
je 0x14001afef
inc r8d
inc rcx
cmp rcx, r10
jl 0x14001afd0
inc r8d
inc rcx
cmp rcx, r10
jl 0x14001af90
jmp 0x14001b008
sub r8d, eax
lea rdx, [rsi + rax*2]
add r8d, r8d
lea rcx, str.4433
movsxd r8, r8d
call fcn.14003d2f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r14, [0x14004bbd0]
movsxd rbx, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r8d, r8d
movsxd rdi, eax
mov r10, rbx
test ebx, ebx
jle 0x14001b09a
xor ecx, ecx
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x14001b056
lea rbx, [rsi + rcx*2]
movzx eax, word [r14 + rdx*2]
cmp word [rbx + rdx*2], ax
jne 0x14001b056
inc r9d
inc rdx
cmp rdx, rdi
jl 0x14001b040
cmp r9d, edi
jne 0x14001b078
add r8d, edi
add rcx, rdi
cmp rcx, r10
jge 0x14001b078
cmp word [rsi + rcx*2], 0x7c
je 0x14001b085
inc r8d
inc rcx
cmp rcx, r10
jl 0x14001b066
inc r8d
inc rcx
cmp rcx, r10
jl 0x14001b033
jmp 0x14001b09a
movsxd rax, r8d
cmp word [rsi + rax*2 - 2], 0x31
jne 0x14001b09a
mov dword [0x14005ab38], 1
lea rcx, [0x14005ab3c]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
lea rcx, [0x14005ab3c]
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.14003d990
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r14, [0x14004bd10]
movsxd rbx, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r8d, r8d
movsxd rdi, eax
mov r10, rbx
test ebx, ebx
jle 0x14001b168
xor ecx, ecx
nop
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x14001b116
lea rbx, [rsi + rcx*2]
nop dword [rax]
movzx eax, word [r14 + rdx*2]
cmp word [rbx + rdx*2], ax
jne 0x14001b116
inc r9d
inc rdx
cmp rdx, rdi
jl 0x14001b100
cmp r9d, edi
jne 0x14001b142
add r8d, edi
add rcx, rdi
movsxd rax, r8d
cmp rcx, r10
jge 0x14001b142
nop dword [rax]
cmp word [rsi + rcx*2], 0x7c
je 0x14001b14f
inc r8d
inc rcx
cmp rcx, r10
jl 0x14001b130
inc r8d
inc rcx
cmp rcx, r10
jl 0x14001b0f0
jmp 0x14001b168
sub r8d, eax
lea rdx, [rsi + rax*2]
add r8d, r8d
lea rcx, [0x14005ab3c]
movsxd r8, r8d
call fcn.14003d2f0
lea rcx, str.10443
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
lea rcx, str.10443
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.14003d990
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r14, [0x14004bd18]
movsxd rbx, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r8d, r8d
movsxd rdi, eax
mov r10, rbx
test ebx, ebx
jle 0x14001b238
xor ecx, ecx
nop dword [rax]
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x14001b1e6
lea rbx, [rsi + rcx*2]
nop dword [rax]
movzx eax, word [r14 + rdx*2]
cmp word [rbx + rdx*2], ax
jne 0x14001b1e6
inc r9d
inc rdx
cmp rdx, rdi
jl 0x14001b1d0
cmp r9d, edi
jne 0x14001b212
add r8d, edi
add rcx, rdi
movsxd rax, r8d
cmp rcx, r10
jge 0x14001b212
nop dword [rax]
cmp word [rsi + rcx*2], 0x7c
je 0x14001b21f
inc r8d
inc rcx
cmp rcx, r10
jl 0x14001b200
inc r8d
inc rcx
cmp rcx, r10
jl 0x14001b1c0
jmp 0x14001b238
sub r8d, eax
lea rdx, [rsi + rax*2]
add r8d, r8d
lea rcx, str.10443
movsxd r8, r8d
call fcn.14003d2f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r14, [0x14004bd20]
movsxd rbx, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r8d, r8d
movsxd rdi, eax
mov r10, rbx
test ebx, ebx
jle 0x14001b2ca
xor ecx, ecx
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x14001b286
lea rbx, [rsi + rcx*2]
movzx eax, word [r14 + rdx*2]
cmp word [rbx + rdx*2], ax
jne 0x14001b286
inc r9d
inc rdx
cmp rdx, rdi
jl 0x14001b270
cmp r9d, edi
jne 0x14001b2a8
add r8d, edi
add rcx, rdi
cmp rcx, r10
jge 0x14001b2a8
cmp word [rsi + rcx*2], 0x7c
je 0x14001b2b5
inc r8d
inc rcx
cmp rcx, r10
jl 0x14001b296
inc r8d
inc rcx
cmp rcx, r10
jl 0x14001b263
jmp 0x14001b2ca
movsxd rax, r8d
cmp word [rsi + rax*2 - 2], 0x31
jne 0x14001b2ca
mov dword [0x14005ad78], 1
lea rcx, str.202.79.173.2
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
lea rcx, str.202.79.173.2
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.14003d990
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r14, [0x14004bd28]
movsxd rbx, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r8d, r8d
movsxd rdi, eax
mov r10, rbx
test ebx, ebx
jle 0x14001b398
xor ecx, ecx
nop
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x14001b346
lea rbx, [rsi + rcx*2]
nop dword [rax]
movzx eax, word [r14 + rdx*2]
cmp word [rbx + rdx*2], ax
jne 0x14001b346
inc r9d
inc rdx
cmp rdx, rdi
jl 0x14001b330
cmp r9d, edi
jne 0x14001b372
add r8d, edi
add rcx, rdi
movsxd rax, r8d
cmp rcx, r10
jge 0x14001b372
nop dword [rax]
cmp word [rsi + rcx*2], 0x7c
je 0x14001b37f
inc r8d
inc rcx
cmp rcx, r10
jl 0x14001b360
inc r8d
inc rcx
cmp rcx, r10
jl 0x14001b320
jmp 0x14001b398
sub r8d, eax
lea rdx, [rsi + rax*2]
add r8d, r8d
lea rcx, str.202.79.173.2
movsxd r8, r8d
call fcn.14003d2f0
lea rcx, [0x14005af7a]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
lea rcx, [0x14005af7a]
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.14003d990
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r14, [0x14004bd30]
movsxd rbx, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r8d, r8d
movsxd rdi, eax
mov r10, rbx
test ebx, ebx
jle 0x14001b468
xor ecx, ecx
nop dword [rax]
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x14001b416
lea rbx, [rsi + rcx*2]
nop dword [rax]
movzx eax, word [r14 + rdx*2]
cmp word [rbx + rdx*2], ax
jne 0x14001b416
inc r9d
inc rdx
cmp rdx, rdi
jl 0x14001b400
cmp r9d, edi
jne 0x14001b442
add r8d, edi
add rcx, rdi
movsxd rax, r8d
cmp rcx, r10
jge 0x14001b442
nop dword [rax]
cmp word [rsi + rcx*2], 0x7c
je 0x14001b44f
inc r8d
inc rcx
cmp rcx, r10
jl 0x14001b430
inc r8d
inc rcx
cmp rcx, r10
jl 0x14001b3f0
jmp 0x14001b468
sub r8d, eax
lea rdx, [rsi + rax*2]
add r8d, r8d
lea rcx, [0x14005af7a]
movsxd r8, r8d
call fcn.14003d2f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r14, [0x14004bd38]
movsxd rbx, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r8d, r8d
movsxd rdi, eax
mov r10, rbx
test ebx, ebx
jle 0x14001b4fa
xor ecx, ecx
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x14001b4b6
lea rbx, [rsi + rcx*2]
movzx eax, word [r14 + rdx*2]
cmp word [rbx + rdx*2], ax
jne 0x14001b4b6
inc r9d
inc rdx
cmp rdx, rdi
jl 0x14001b4a0
cmp r9d, edi
jne 0x14001b4d8
add r8d, edi
add rcx, rdi
cmp rcx, r10
jge 0x14001b4d8
cmp word [rsi + rcx*2], 0x7c
je 0x14001b4e5
inc r8d
inc rcx
cmp rcx, r10
jl 0x14001b4c6
inc r8d
inc rcx
cmp rcx, r10
jl 0x14001b493
jmp 0x14001b4fa
movsxd rax, r8d
cmp word [rsi + rax*2 - 2], 0x31
jne 0x14001b4fa
mov dword [0x14005afb8], 1
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x30]
add rsp, 0x48
ret