Function at 0x140098394
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r15, r8
mov rbx, rdx
mov r14, rcx
lea rdi, section..data
mov rcx, qword [section..data]
cmp rcx, rdi
je 0x1400983e7
test byte [rcx + 0x1c], 1
je 0x1400983e7
cmp byte [rcx + 0x19], 5
jb 0x1400983e7
mov edx, 0x37
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.140099f6c
mov rdx, rbx
mov rcx, r14
call fcn.140098d20
mov esi, eax
mov rcx, qword [section..data]
cmp rcx, rdi
je 0x140098421
test byte [rcx + 0x1c], 2
je 0x140098421
cmp byte [rcx + 0x19], 5
jb 0x140098421
mov edx, 0x38
mov dword [rsp + 0x20], eax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.140099f6c
xor edi, edi
mov eax, 0x490
test esi, esi
cmove edi, eax
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.140005058
nop
lea rcx, [rbp - 0x28]
call fcn.1400304d8
xor esi, esi
mov qword [rbp - 0x20], rsi
and qword [rbp - 0x18], rsi
and qword [rbp - 0x10], rsi
test edi, edi
jne 0x1400984a1
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, r14
call fcn.140099214
mov edi, eax
mov rcx, qword [section..data]
lea r14, section..data
cmp rcx, r14
je 0x14009849b
test byte [rcx + 0x1c], 2
je 0x14009849b
cmp byte [rcx + 0x19], 4
jb 0x14009849b
lea edx, [rsi + 0x39]
mov r9d, eax
lea r8, [0x1400bd8b8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
mov rsi, qword [rbp - 0x20]
jmp 0x1400984a8
lea r14, section..data
and dword [r15], 0
and dword [rbp + 0x40], 0
mov rbx, qword [rbp - 0x28]
test edi, edi
jne 0x140098659
lea r14d, [rdi + 4]
mov dword [rbp + 0x48], r14d
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140098502
mov eax, dword [rbp - 0x30]
sub eax, r14d
neg eax
sbb edi, edi
and edi, 0xd
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x14009854b
test byte [rcx + 0x1c], 2
je 0x14009854b
cmp byte [rcx + 0x19], r14b
jb 0x14009854b
mov edx, 0x3a
mov dword [rsp + 0x28], edi
mov eax, dword [rbp + 0x40]
mov dword [rsp + 0x20], eax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.140099ea4
mov rcx, qword [section..data]
lea rax, section..data
cmp edi, 2
jne 0x140098619
xor edi, edi
cmp rcx, rax
je 0x1400985c2
test byte [rcx + 0x1c], 2
je 0x140098581
cmp byte [rcx + 0x19], r14b
jb 0x140098581
lea edx, [rdi + 0x3b]
lea r8, [0x1400bd8b8]
mov rcx, qword [rcx + 0x10]
call fcn.1400062b0
mov rcx, qword [section..data]
lea r14, section..data
cmp rcx, r14
je 0x1400985c2
test byte [rcx + 0x1c], 1
je 0x1400985c2
movzx r9d, byte [rcx + 0x19]
mov eax, edi
neg eax
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp r9d, edx
jb 0x1400985c2
mov edx, 0x3d
mov r9d, edi
lea r8, [0x1400bd8b8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
nop
test rsi, rsi
je 0x1400985d7
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140098602
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
mov eax, edi
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
test edi, edi
jne 0x140098581
cmp dword [rbp + 0x40], edi
je 0x140098581
mov dword [r15], 1
mov rcx, qword [section..data]
cmp rcx, rax
je 0x1400985c2
test byte [rcx + 0x1c], 2
je 0x140098581
cmp byte [rcx + 0x19], r14b
jb 0x140098581
lea edx, [rdi + 0x3c]
jmp 0x14009856a
mov rcx, qword [section..data]
jmp 0x140098588