Function at 0x14001a508
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
xor r13d, r13d
mov rax, rcx
mov qword [r11 - 0x60], r13
lea rcx, [rbp - 0x18]
mov qword [r11 - 0x68], r13
mov rbx, r8
mov qword [r11 - 0x70], rcx
xor r9d, r9d
lea rcx, [rbp + 0x60]
mov dword [rbp + 0x50], r13d
mov qword [r11 - 0x78], rcx
xor r8d, r8d
lea rcx, [rbp + 0x50]
mov dword [rbp + 0x60], r13d
mov qword [r11 - 0x80], rcx
xor edx, edx
mov qword [rsp + 0x30], r13
mov rcx, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov dword [rbp - 0x18], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14001a607
test rbx, rbx
je 0x14001a607
or rsi, 0xffffffffffffffff
mov ebx, r13d
mov edi, r13d
cmp dword [rbp + 0x50], r13d
jbe 0x14001a73b
mov ecx, dword [rbp + 0x60]
lea eax, [rsi + 3]
inc ecx
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.14003c460
mov rbx, rax
test rax, rax
je 0x14001a607
mov r13d, dword [rbp - 0x18]
lea rcx, [r13 + 2]
call qword [sym.imp.msvcrt.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14001a72a
mov r15d, dword [rbp + 0x50]
lea r12d, [r15 + 1]
shl r12, 2
mov rcx, r12
call qword [sym.imp.msvcrt.dll_malloc]
mov r14, rax
test rax, rax
jne 0x14001a61a
mov rcx, rbx
call fcn.14003c408
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
xor eax, eax
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r8, r12
mov edx, 0xff
mov rcx, r14
call sub.msvcrt.dll_memset
test r15d, r15d
je 0x14001a6ee
lea r12, [r14 + r15*4]
mov eax, dword [rbp + 0x60]
lea edx, [r15 - 1]
mov rcx, qword [rbp + 0x48]
lea r9, [rbp - 0x10]
inc eax
mov r8, rbx
mov dword [rbp - 0x10], eax
lea eax, [r13 + 2]
mov dword [rbp - 0x14], eax
xor r13d, r13d
lea rax, [rbp - 0x14]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0xc]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x14001a6ee
lea r8d, [r13 + 4]
mov rcx, rbx
lea rdx, str.WMC_
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x14001a6c1
mov eax, dword [rbp - 0xc]
dec eax
cmp eax, 1
ja 0x14001a6b1
mov rdx, qword [rbp + 0x58]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14001a6d4
lea rcx, [rbx + 8]
call qword [sym.imp.msvcrt.dll__wtoi]
mov edi, eax
mov dword [r12], eax
sub r12, 4
add r15d, 0xffffffff
je 0x14001a6ee
mov r13d, dword [rbp - 0x18]
jmp 0x14001a637
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_free]
mov rax, rbx
jmp 0x14001a609
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov edx, dword [rbp + 0x50]
mov ecx, 1
cmp edx, ecx
jb 0x14001a719
mov eax, ecx
cmp dword [r14 + rax*4], edi
je 0x14001a711
inc ecx
cmp ecx, edx
jbe 0x14001a703
cmp ecx, edx
ja 0x14001a719
inc edi
jmp 0x14001a6fa
mov rcx, r14
call qword [sym.imp.msvcrt.dll_free]
cmp edi, 0x1869f
jle 0x14001a737
mov rcx, rbx
call fcn.14003c408
jmp 0x14001a607
or rsi, 0xffffffffffffffff
cmp dword [rbp + 0x60], 0xe
mov ecx, 8
mov dword [rbp + 0x50], ecx
jae 0x14001a781
test rbx, rbx
je 0x14001a759
mov rcx, rbx
call fcn.14003c408
mov ecx, dword [rbp + 0x50]
lea edx, [rcx + 6]
mov eax, 2
mul rdx
cmovo rax, rsi
mov rcx, rax
call fcn.14003c460
mov rbx, rax
test rax, rax
je 0x14001a607
mov ecx, dword [rbp + 0x50]
jmp 0x14001a78a
test rbx, rbx
je 0x14001a6e6
mov r8d, ecx
lea rdx, str.WMC_
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov eax, dword [rbp + 0x50]
mov r8d, 0xa
shr rax, 1
mov ecx, edi
lea rdx, [rbx + rax*2]
call qword [sym.imp.msvcrt.dll__itow]
jmp 0x14001a6e6