Function at 0x1400c0250
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x19c0]
mov eax, 0x1ac0
call fcn.1401722d0
sub rsp, rax
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x1b10], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rbp + 0x19b0], rax
mov qword [rbp - 0x70], rdx
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rdx
xor edi, edi
mov dword [rsp + 0x30], edi
lea rcx, [rbp - 0x80]
call fcn.1400bc8d0
nop
lea rcx, [0x140302998]
mov qword [rbp - 0x20], rcx
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.14000ae30
add rax, 0x18
mov qword [rbp - 0x18], rax
mov dword [rsp + 0x30], 2
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400c02fe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r15, [0x1403d5bf0]
cmp word [0x1403d5bf0], 0
jne 0x1400c0400
mov qword [rbp - 0x60], rdi
mov dword [rbp - 0x58], edi
mov qword [rbp - 0x50], rdi
mov r9d, 0x20219
lea r8, str.SOFTWAREHaloDesktop
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x60]
call fcn.14007dcc0
mov rbx, qword [rbp - 0x60]
test eax, eax
jne 0x1400c03f2
mov dword [rsp + 0x58], 0x800
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.FROM
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c03f2
mov eax, dword [rsp + 0x70]
dec eax
cmp eax, 1
ja 0x1400c03f2
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x1400c03a8
test al, 1
jne 0x1400c03f2
shr rax, 1
cmp word [rbp + rax*2 + 0x15e], 0
je 0x1400c03af
jmp 0x1400c03f2
mov word [rbp + 0x160], di
mov r8d, 0x3ff
mov rdx, r15
lea rcx, [rbp + 0x160]
sub rcx, r15
lea rax, [r8 + 0x7ffffbff]
test rax, rax
je 0x1400c03e4
movzx eax, word [rcx + rdx]
test ax, ax
je 0x1400c03e4
mov word [rdx], ax
add rdx, 2
sub r8, 1
jne 0x1400c03c2
lea rax, [rdx - 2]
test r8, r8
cmovne rax, rdx
mov word [rax], di
test rbx, rbx
je 0x1400c0400
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400c0d29
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rdx, r15
lea rcx, [rsp + 0x38]
call fcn.14002e390
mov r13d, 1
test al, al
jne 0x1400c0566
mov rsi, r14
nop
inc rsi
cmp word [r15 + rsi*2], 0
jne 0x1400c0440
mov rbx, qword [rsp + 0x38]
test esi, esi
jne 0x1400c04ad
lea rdx, [rbx - 0x18]
mov rsi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1400c056b
cmp dword [rdx + 0x10], 0
jge 0x1400c0480
cmp dword [rbx - 0xc], 0
jl 0x1400c0d34
mov dword [rbx - 0x10], edi
mov word [rbx], di
jmp 0x1400c056b
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, r13d
jg 0x1400c0496
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + SafeArrayCopy]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
jmp 0x1400c056b
mov r12d, dword [rbx - 0x10]
sub r15, rbx
sar r15, 1
test esi, esi
js 0x1400c0d3f
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x1400c04df
mov edx, esi
lea rcx, [rsp + 0x38]
call fcn.14000bdf0
mov rbx, qword [rsp + 0x38]
movsxd rax, esi
cmp r15, r12
ja 0x1400c0536
lea rdx, [rbx + r15*2]
lea r15, [rax + rax]
test r15, r15
je 0x1400c0553
test rdx, rdx
jne 0x1400c050b
call fcn.14028c79c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14028c64c
jmp 0x1400c0553
movsxd rax, dword [rbx - 0xc]
add rax, rax
cmp rax, r15
jae 0x1400c0529
call fcn.14028c79c
mov dword [rax], 0x22
call fcn.14028c64c
jmp 0x1400c0553
mov r8, r15
mov rcx, rbx
call fcn.140289020
jmp 0x1400c0553
lea r15, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r15
lea r8, [0x1403d5bf0]
mov rcx, rbx
call fcn.140015050
cmp esi, dword [rbx - 0xc]
jg 0x1400c0d4a
mov dword [rbx - 0x10], esi
mov word [r15 + rbx], di
jmp 0x1400c056b
mov rbx, qword [rsp + 0x38]
mov dword [rsp + 0x30], 6
lea rax, [0x1403029a8]
mov qword [rbp - 0x10], rax
lea rcx, [rbx - 0x18]
call fcn.14000ae30
add rax, 0x18
mov qword [rbp - 8], rax
mov dword [rsp + 0x30], reloc.WS2_32.dll_ntohl
mov eax, r14d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x1400c05b2
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x78]
call fcn.1400bc030
nop
lea rcx, [0x1403029b8]
mov qword [rbp], rcx
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.14000ae30
add rax, 0x18
mov qword [rbp + 8], rax
mov dword [rsp + 0x30], 0x1e
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400c0601
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r15, [0x1403d6bf0]
cmp word [0x1403d6bf0], 0
jne 0x1400c061f
mov edx, 0x3ff
mov rcx, r15
call fcn.140178030
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400c0d55
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.14002e390
test al, al
jne 0x1400c0786
mov rsi, r14
nop word [rax + rax]
inc rsi
cmp word [r15 + rsi*2], 0
jne 0x1400c0660
mov rbx, qword [rsp + 0x40]
test esi, esi
jne 0x1400c06cd
lea rdx, [rbx - 0x18]
mov rsi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1400c078b
cmp dword [rdx + 0x10], 0
jge 0x1400c06a0
cmp dword [rbx - 0xc], 0
jl 0x1400c0d60
mov dword [rbx - 0x10], edi
mov word [rbx], di
jmp 0x1400c078b
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400c06b6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + SafeArrayCopy]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
jmp 0x1400c078b
mov r12d, dword [rbx - 0x10]
sub r15, rbx
sar r15, 1
test esi, esi
js 0x1400c0d6b
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x1400c06ff
mov edx, esi
lea rcx, [rsp + 0x40]
call fcn.14000bdf0
mov rbx, qword [rsp + 0x40]
movsxd rax, esi
cmp r15, r12
ja 0x1400c0756
lea rdx, [rbx + r15*2]
lea r15, [rax + rax]
test r15, r15
je 0x1400c0773
test rdx, rdx
jne 0x1400c072b
call fcn.14028c79c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14028c64c
jmp 0x1400c0773
movsxd rax, dword [rbx - 0xc]
add rax, rax
cmp rax, r15
jae 0x1400c0749
call fcn.14028c79c
mov dword [rax], 0x22
call fcn.14028c64c
jmp 0x1400c0773
mov r8, r15
mov rcx, rbx
call fcn.140289020
jmp 0x1400c0773
lea r15, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r15
lea r8, [0x1403d6bf0]
mov rcx, rbx
call fcn.140015050
cmp esi, dword [rbx - 0xc]
jg 0x1400c0d76
mov dword [rbx - 0x10], esi
mov word [r15 + rbx], di
jmp 0x1400c078b
mov rbx, qword [rsp + 0x40]
mov dword [rsp + 0x30], 0x3e
lea rax, [0x1403029c8]
mov qword [rbp + 0x10], rax
lea rcx, [rbx - 0x18]
call fcn.14000ae30
add rax, 0x18
mov qword [rbp + 0x18], rax
mov dword [rsp + 0x30], 0x7e
mov eax, r14d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x1400c07d2
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x5c], edi
mov dword [rsp + 0x34], edi
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x1400c082b
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c0822
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0x60]
call rax
movzx eax, word [rsp + 0x34]
mov dword [rsp + 0x34], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x60]
call fcn.140289490
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x60]
lea r8, str._u._u
mov edx, 0x7f
lea rcx, [rbp + 0x60]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400c0d81
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.14002e390
test al, al
jne 0x1400c09c6
lea rax, [rbp + 0x60]
mov rsi, r14
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1400c08a0
mov rbx, qword [rsp + 0x48]
test esi, esi
jne 0x1400c090c
lea rdx, [rbx - 0x18]
mov rsi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1400c09cb
cmp dword [rdx + 0x10], 0
jge 0x1400c08df
cmp dword [rbx - 0xc], 0
jl 0x1400c0d8c
mov dword [rbx - 0x10], edi
mov word [rbx], di
jmp 0x1400c09cb
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400c08f5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + SafeArrayCopy]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
jmp 0x1400c09cb
mov r12d, dword [rbx - 0x10]
lea r15, [rbp + 0x60]
sub r15, rbx
sar r15, 1
test esi, esi
js 0x1400c0d97
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x1400c0942
mov edx, esi
lea rcx, [rsp + 0x48]
call fcn.14000bdf0
mov rbx, qword [rsp + 0x48]
movsxd rax, esi
cmp r15, r12
ja 0x1400c0999
lea rdx, [rbx + r15*2]
lea r15, [rax + rax]
test r15, r15
je 0x1400c09b3
test rdx, rdx
jne 0x1400c096e
call fcn.14028c79c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14028c64c
jmp 0x1400c09b3
movsxd rax, dword [rbx - 0xc]
add rax, rax
cmp rax, r15
jae 0x1400c098c
call fcn.14028c79c
mov dword [rax], 0x22
call fcn.14028c64c
jmp 0x1400c09b3
mov r8, r15
mov rcx, rbx
call fcn.140289020
jmp 0x1400c09b3
lea r15, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r15
lea r8, [rbp + 0x60]
mov rcx, rbx
call fcn.140015050
cmp esi, dword [rbx - 0xc]
jg 0x1400c0da2
mov dword [rbx - 0x10], esi
mov word [r15 + rbx], di
jmp 0x1400c09cb
mov rbx, qword [rsp + 0x48]
mov dword [rsp + 0x30], 0xfe
lea rax, [0x1403029d8]
mov qword [rbp + 0x20], rax
lea rcx, [rbx - 0x18]
call fcn.14000ae30
add rax, 0x18
mov qword [rbp + 0x28], rax
mov dword [rsp + 0x30], 0x1fe
mov eax, r14d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x1400c0a12
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.1400b7c80
mov qword [rbp - 0x30], rax
lea rcx, [0x1403029e8]
mov qword [rbp + 0x30], rcx
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.14000d920
nop
call fcn.1400bc0e0
mov qword [rbp - 0x28], rax
lea rcx, [0x140302a00]
mov qword [rbp + 0x40], rcx
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.14000d920
nop
lea rcx, [rsp + 0x78]
call fcn.1400b9810
mov rbx, rax
xor edx, edx
mov r8d, 0x1048
lea rcx, [rbp + 0x960]
call fcn.140289490
mov dword [rsp + 0x20], edi
mov r9d, 0x1048
xor r8d, r8d
lea rdx, [rbp + 0x960]
mov rcx, qword [rbx]
call fcn.1400b1540
test eax, eax
jne 0x1400c0a9c
mov word [rbp + 0x960], di
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400c0dad
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rdx, [rbp + 0x960]
lea rcx, [rsp + 0x50]
call fcn.14002e390
test al, al
jne 0x1400c0c0b
lea rax, [rbp + 0x960]
mov rsi, r14
nop
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1400c0ae0
mov rbx, qword [rsp + 0x50]
test esi, esi
jne 0x1400c0b4c
lea rdx, [rbx - 0x18]
mov rsi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1400c0c10
cmp dword [rdx + 0x10], 0
jge 0x1400c0b1f
cmp dword [rbx - 0xc], 0
jl 0x1400c0db8
mov dword [rbx - 0x10], edi
mov word [rbx], di
jmp 0x1400c0c10
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400c0b35
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + SafeArrayCopy]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
jmp 0x1400c0c10
mov r12d, dword [rbx - 0x10]
lea r15, [rbp + 0x960]
sub r15, rbx
sar r15, 1
test esi, esi
js 0x1400c0dc3
sub r13d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, r13d
jge 0x1400c0b84
mov edx, esi
lea rcx, [rsp + 0x50]
call fcn.14000bdf0
mov rbx, qword [rsp + 0x50]
movsxd rax, esi
cmp r15, r12
ja 0x1400c0bdb
lea rdx, [rbx + r15*2]
lea r15, [rax + rax]
test r15, r15
je 0x1400c0bf8
test rdx, rdx
jne 0x1400c0bb0
call fcn.14028c79c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14028c64c
jmp 0x1400c0bf8
movsxd rax, dword [rbx - 0xc]
add rax, rax
cmp rax, r15
jae 0x1400c0bce
call fcn.14028c79c
mov dword [rax], 0x22
call fcn.14028c64c
jmp 0x1400c0bf8
mov r8, r15
mov rcx, rbx
call fcn.140289020
jmp 0x1400c0bf8
lea r15, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r15
lea r8, [rbp + 0x960]
mov rcx, rbx
call fcn.140015050
cmp esi, dword [rbx - 0xc]
jg 0x1400c0d1e
mov dword [rbx - 0x10], esi
mov word [r15 + rbx], di
jmp 0x1400c0c10
mov rbx, qword [rsp + 0x50]
mov dword [rsp + 0x30], 0x3fe
lea rax, str.instdate
mov qword [rbp + 0x50], rax
lea rcx, [rbx - 0x18]
call fcn.14000ae30
add rax, 0x18
mov qword [rbp + 0x58], rax
mov dword [rsp + 0x30], 0x7fe
mov eax, r14d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x1400c0c58
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400c0c78
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov r15, qword [rbp - 0x70]
mov rcx, qword [r15]
sub rcx, 0x18
call fcn.14000ae30
add rax, 0x18
mov rsi, qword [rbp - 0x68]
mov qword [rsi], rax
mov dword [rsp + 0x30], 0x7ff
lea rbx, [rbp - 0x20]
nop
mov r8, qword [rbx + 8]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.14007f8c0
inc edi
lea rbx, [rbx + 0x10]
cmp edi, 8
jb 0x1400c0ca0
lea r9, [fcn.14006adb0]
mov edx, InitCommonControls
lea r8d, [rdx - 8]
lea rcx, [rbp - 0x20]
call fcn.140172394
nop
mov rdx, qword [r15]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x1400c0cf1
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, rsi
mov rcx, qword [rbp + 0x19b0]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x1b10]
add rsp, 0x1ac0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.14000adf0
nop
mov ecx, 0x80004005
call fcn.14000adf0
nop
mov ecx, 0x80070057
call fcn.14000adf0
int3
mov ecx, 0x80070057
call fcn.14000adf0
int3
mov ecx, 0x80070057
call fcn.14000adf0
nop
mov ecx, 0x80004005
call fcn.14000adf0
nop
mov ecx, 0x80070057
call fcn.14000adf0
int3
mov ecx, 0x80070057
call fcn.14000adf0
int3
mov ecx, 0x80070057
call fcn.14000adf0
nop
mov ecx, 0x80004005
call fcn.14000adf0
nop
mov ecx, 0x80070057
call fcn.14000adf0
int3
mov ecx, 0x80070057
call fcn.14000adf0
int3
mov ecx, 0x80070057
call fcn.14000adf0
nop
mov ecx, 0x80004005
call fcn.14000adf0
nop
mov ecx, 0x80070057
call fcn.14000adf0
int3
mov ecx, 0x80070057
call fcn.14000adf0
int3