Function at 0x14000fd98
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor esi, esi
mov eax, r9d
mov r15, rdx
mov r14, rcx
test r8d, r8d
je 0x14000fdc7
mov word [rdx], si
or dword [rbp + 0x50], 0xffffffff
mov r8d, r8d
add r8, r8
cmp rax, r8
jae 0x14000fdf7
mov rcx, qword [0x1401cd740]
mov edx, 0x48d3d3
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400ee2b6.0]
mov eax, dword [rbp + 0x50]
jmp 0x140010026
lea rbx, [0x1401460b4]
lea r10, [0x1401d1ff8]
mov cl, byte [rbx]
or r9d, 0xffffffff
mov rdx, r14
mov dword [rbp + 0x50], r9d
call fcn.14000f018
mov r13d, eax
cmp eax, 0xffffffff
je 0x140010010
and qword [rbp - 0x18], 0
mov rcx, r10
mov qword [rbp - 0x20], r10
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, 1
lock xadd dword [rbp - 0x18], ecx
test ecx, ecx
jne 0x14000fe55
cmp dword [rbp - 0x14], esi
jne 0x14001003e
call qword [sym.imp.MSVCP140.dll__Thrd_id]
mov dword [rbp - 0x14], eax
mov edi, esi
cmp edi, 4
jge 0x14000fffc
mov eax, dword [r14 + 0x1c]
lea rcx, [rbp - 0x10]
mov rdx, qword [r14 + 0x10]
mov r9d, r13d
mov dword [rsp + 0x20], eax
mov r12b, sil
mov qword [rbp - 0x28], rsi
call fcn.14000e2fc
mov ecx, dword [rax]
mov dword [rbp + 0x50], ecx
mov rdx, qword [rax + 8]
mov qword [rax + 8], rsi
mov rcx, qword [rbp - 0x28]
mov qword [rbp - 0x28], rdx
test rcx, rcx
je 0x14000fea6
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400ee2b6.0]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14000fec0
mov qword [rbp - 8], rsi
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400ee2b6.0]
cmp dword [rbp + 0x50], esi
jne 0x14000ffd7
mov ecx, dword [rbp + 0x58]
mov r9d, 0xffff
mov rax, qword [rbp - 0x28]
xor edx, edx
mov sil, byte [r14 + 0x18]
mov r8, qword [r14]
and sil, 0xf
and dword [rbp - 0x2c], 0
mov dword [rbp - 0x30], ecx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x2c]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov r8d, dword [rbp - 0x2c]
mov r9d, 2
mov edx, eax
cmp dword [rbp - 0x30], r9d
jae 0x14000ff28
lea ecx, [r8 - 1]
cmp ecx, 1
cmovbe edx, r9d
xor ecx, ecx
test edx, edx
jne 0x14000ff69
lea eax, [r8 - 1]
cmp eax, 1
ja 0x14000ff47
mov eax, dword [rbp - 0x30]
shr rax, 1
mov word [r15 + rax*2 - 2], cx
mov r8d, dword [rbp - 0x2c]
movzx ecx, sil
cmp r8d, ecx
jne 0x14000ff55
mov dword [rbp + 0x50], edx
jmp 0x14000ff81
sub r8d, 1
je 0x14000ffae
cmp r8d, 1
jne 0x14000ff66
cmp ecx, r8d
je 0x14000ff50
mov edx, r9d
mov dword [rbp + 0x50], edx
cmp edx, 0x3f2
je 0x14000ffb3
cmp edx, 0x3fa
je 0x14000ffb3
cmp edx, 6
je 0x14000ffb3
xor esi, esi
test edx, edx
jne 0x14000ffd7
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14000ffa1
mov qword [rbp - 0x28], rsi
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400ee2b6.0]
lea rcx, [rbp - 0x20]
call fcn.14000ba40
xor eax, eax
jmp 0x140010026
cmp ecx, r9d
jmp 0x14000ff64
mov rcx, qword [r14 + 0x10]
lea rdx, [0x1401cd7f0]
xor esi, esi
movzx eax, word [rcx + 0xa]
and eax, 0x1f
shl rax, 5
mov qword [rax + rdx], rsi
call fcn.14000b808
mov r12b, 1
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14000fff1
mov qword [rbp - 0x28], rsi
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400ee2b6.0]
inc edi
test r12b, r12b
jne 0x14000fe57
lea rcx, [rbp - 0x20]
call fcn.14000ba40
mov r9d, dword [rbp + 0x50]
lea r10, [0x1401d1ff8]
inc rbx
lea rax, [0x1401460b7]
cmp rbx, rax
jne 0x14000fe05
mov eax, r9d
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
mov ecx, 0x131f4c4
call fcn.14000ad28
int3