Function at 0x14001941c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x988]
sub rsp, 0xa50
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rbp + 0x940], rax
mov r15, rdx
mov r14, rcx
mov qword [rbp - 0x60], rcx
mov eax, dword [0x1401a8d80]
mov r8d, eax
imul r8d, eax
imul r8d, eax
mov eax, 0x38e38e39
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
mov edi, 1
cmp r8d, 0xe
jne 0x1400194b2
mov r8d, edi
mov eax, edi
mov edx, 0xe4
lea ecx, [rax + r8]
lea r8d, [rax]
mov eax, ecx
sub edx, edi
jns 0x14001949f
mov dword [0x1401a8d80], ecx
mov al, byte [0x1401a8d84]
neg al
sbb rbx, rbx
add rbx, 0xffffffff80000002
lea rcx, [0x1401a09a8]
mov rax, qword [0x1401a09a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov r9d, dword [0x1401a8d80]
lea ecx, [r9 + 1]
imul ecx, r9d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
xor r12d, r12d
cmp ecx, 0xd
jne 0x140019538
mov r8d, r12d
lea r10, [rbp - 0x50]
mov r11d, r9d
lea ecx, [r9 + r8]
mov eax, r11d
cdq
idiv ecx
mov dword [r10], edx
add r8d, edi
sub r11d, edi
lea r10, [r10 + 4]
movsxd rax, r8d
cmp rax, 0x61
jb 0x140019518
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x58], r12
mov r8d, dword [0x1401a8d80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0x12
jne 0x1400195c4
movsd xmm3, qword [0x14013dd10]
xorps xmm2, xmm2
movd xmm4, r8d
cvtdq2pd xmm4, xmm4
addsd xmm2, xmm3
movaps xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x1400195ac
subsd xmm2, xmm3
divsd xmm3, qword [0x14013dd38]
movaps xmm1, xmm2
mulsd xmm1, xmm2
movaps xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmmword [0x14013dd08]
ja 0x14001958f
lea rdx, [0x1401399d0]
lea rcx, [rbp - 0x80]
call fcn.140002c48
nop
mov r8, rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.14000d870
nop
lea r8, [0x1401a9150]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.14000d870
nop
lea r8, [0x140139960]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140017bcc
nop
mov r8, r14
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14000d870
nop
mov r9d, edi
mov r8, qword [rax]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.14001878c
test eax, eax
setne bl
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
or r13, 0xffffffffffffffff
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001965f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140019680
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400196a1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400196c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400196e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14001977d
mov ecx, dword [0x1401a8d80]
imul ecx, ecx
mov eax, 0x78787879
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 0xa
jne 0x14001971b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401a8d80], eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140019730
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140019757
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140019776
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x1400199db
mov dword [rsp + 0x40], 0x400
mov word [rbp + 0x140], r12w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp + 0x142]
call fcn.1400c2400
mov esi, r12d
mov r8d, dword [0x1401a8d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, edi
jne 0x1400197ee
mov ecx, edi
cmp r8d, edi
jle 0x1400197e5
mov eax, r8d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r8d
jl 0x1400197d6
mov r8d, ecx
mov dword [0x1401a8d80], ecx
mov rbx, qword [rsp + 0x48]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x15
jne 0x14001983d
mov r8d, edi
mov eax, edi
mov edx, 0xb8
lea ecx, [rax + r8]
lea r8d, [rax]
mov eax, ecx
sub edx, edi
jns 0x14001982a
mov dword [0x1401a8d80], ecx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x140]
mov edx, esi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
inc esi
test eax, eax
je 0x14001987b
cmp eax, 0x103
jne 0x14001994f
lea rdx, [rbp + 0x140]
lea rcx, [rsp + 0x60]
call fcn.140001f2c
nop
mov rcx, qword [rsp + 0x60]
cmp dword [rcx - 0x10], r12d
je 0x1400198a5
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.140019ee8
mov dword [rsp + 0x40], 0x400
mov r8d, dword [0x1401a8d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
cmp ecx, 7
jne 0x140019914
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x141
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.1400bc638
mov rcx, rax
call fcn.1400be0fc
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x140]
call fcn.1400c2400
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001994a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x48]
test edi, edi
jne 0x140019964
mov r8d, dword [0x1401a8d80]
mov edi, 1
jmp 0x1400197f3
test rbx, rbx
je 0x14001997a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r12
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], r12d
test rbx, rbx
je 0x140019992
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400199b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov ecx, r13d
lock xadd dword [rdx + 0x10], ecx
add ecx, r13d
test ecx, ecx
jg 0x1400199d9
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, 1
mov rcx, qword [rbp + 0x940]
xor rcx, rsp
call fcn.1400bcfc0
mov rbx, qword [rsp + 0xaa0]
add rsp, 0xa50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret