Function at 0x1400dfc60
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rsi, r9
mov r12, r8
mov r15, rdx
mov rbp, rcx
lea rdx, [0x1400f4784]
mov rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400dfca4
mov r8d, eax
mov rcx, rsi
call fcn.14000fd40
xor r13d, r13d
mov qword [rsp + 0x80], r13
mov dword [rsp + 0x88], r13d
mov qword [rsp + 0x90], r13
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x1400dfec6
mov rax, qword [rax]
call qword [rax + 0x18]
mov r14, rax
lea rcx, [rax + 0x18]
mov qword [rsp + 0x78], rcx
mov ebx, 0x20019
call fcn.14001f530
test al, al
je 0x1400dfd14
movzx ecx, byte [rsp + 0xf0]
inc ecx
shl ecx, 8
or ebx, ecx
mov r9d, ebx
mov r8, qword [r15]
mov rdx, rbp
lea rcx, [rsp + 0x80]
call fcn.14000da90
test eax, eax
jne 0x1400dfe69
mov dword [rsp + 0x60], r13d
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rbp, qword [rsp + 0x80]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1400dfe69
mov edx, dword [rsp + 0x60]
add edx, 1
mov dword [rsp + 0x60], edx
js 0x1400dfed1
mov rbx, qword [rsi]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x1400dfdb9
mov rcx, rsi
call fcn.14000e630
mov rbx, qword [rsi]
mov edx, dword [rsp + 0x60]
lea eax, [rdx + rdx]
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x60], r13d
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x68]
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400dfe34
mov eax, dword [rsp + 0x68]
dec eax
cmp eax, 1
jbe 0x1400dfdff
mov eax, 0xd
jmp 0x1400dfe32
mov ecx, dword [rsp + 0x64]
test rbx, rbx
je 0x1400dfe29
test ecx, ecx
je 0x1400dfe25
test cl, 1
jne 0x1400dfe1e
mov eax, ecx
shr rax, 1
cmp word [rbx + rax*2 - 2], 0
je 0x1400dfe29
mov eax, 0xd
jmp 0x1400dfe32
mov word [rbx], r13w
shr ecx, 1
mov dword [rsp + 0x60], ecx
mov eax, r13d
test eax, eax
sete bl
mov rcx, qword [rsi]
test rcx, rcx
jne 0x1400dfe44
mov eax, r13d
jmp 0x1400dfe51
movsxd rdx, dword [rcx - 0xc]
call fcn.1400b7e14
test eax, eax
js 0x1400dfebb
mov rcx, qword [rsi]
cmp eax, dword [rcx - 0xc]
jg 0x1400dfebb
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rsi]
mov word [rax + rcx*2], r13w
jmp 0x1400dfe6b
xor bl, bl
lock xadd dword [r14 + 0x10], edi
sub edi, 1
jg 0x1400dfe84
mov rcx, qword [r14]
mov r8, qword [rcx]
mov rdx, r14
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400dfe97
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80070057
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80070057
call fcn.14000c310
int3