Function at 0x140049da0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x830]
sub rsp, 0x930
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x980], rbx
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp + 0x820], rax
mov r15, rdx
xor r13d, r13d
mov qword [rsp + 0x50], r13
mov dword [rsp + 0x58], r13d
mov qword [rsp + 0x60], r13
xor r8d, r8d
mov rdx, rcx
lea rcx, [rsp + 0x70]
call fcn.140047880
nop
mov qword [rsp + 0x68], r13
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [0x1401b8d58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test eax, eax
jne 0x140049e43
mov dword [rsp + 0x58], r13d
mov ecx, r13d
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
test ecx, ecx
setne bl
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
or rsi, 0xffffffffffffffff
lock add dword [rdx + 0x10], esi
jg 0x140049e64
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x140049e75
xor dil, dil
mov rbx, qword [rsp + 0x50]
jmp 0x14004a183
mov r12d, r13d
mov r9d, dword [0x1401bdd80]
mov ecx, r9d
imul ecx, r9d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 5
jne 0x140049f13
mov esi, r13d
lea rdi, [rbp - 0x70]
nop dword [rax + rax]
mov r10d, r13d
lea ebx, [r10 + 1]
lea ecx, [rsi + 1]
mov eax, r9d
cdq
idiv ecx
mov r8d, edx
mov ecx, r9d
sub ecx, esi
imul r8d, ecx
mov eax, r9d
cdq
idiv ebx
add r8d, eax
sub r8d, r10d
mov dword [rdi], r8d
mov edx, r8d
lea rcx, [0x140146c08]
call fcn.1400cc3f4
mov r10d, ebx
add rdi, 4
cmp ebx, 6
jge 0x140049eff
mov r9d, dword [0x1401bdd80]
jmp 0x140049eb3
inc esi
cmp esi, 6
jge 0x140049f0f
mov r9d, dword [0x1401bdd80]
jmp 0x140049eb0
or rsi, 0xffffffffffffffff
mov word [rbp + 0x20], r13w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp + 0x22]
call fcn.1400d0f20
mov dword [rsp + 0x48], 0x400
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x48]
lea r8, [rbp + 0x20]
mov edx, r12d
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
inc r12d
mov r9d, dword [0x1401bdd80]
mov r8d, r9d
imul r8d, r9d
mov eax, 0x88888889
imul r8d
add edx, r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0xf
sub r8d, edx
cmp r8d, 7
jne 0x140049fd5
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x141
movsxd rcx, r9d
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400cb128
mov rcx, rax
call fcn.1400cc208
test edi, edi
jne 0x14004a165
lea rcx, [0x1401b59a8]
mov rax, qword [0x1401b59a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
lea rcx, [rbp + 0x20]
lea rax, [rbp + 0x20]
test rax, 0xffffffffffff0000
jne 0x14004a02f
movzx ebx, cx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x14004a110
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002690
jmp 0x14004a110
lea rax, [rbp + 0x20]
mov rdi, rsi
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14004a036
test edi, edi
jne 0x14004a09a
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004a110
cmp dword [rdx + 0x10], 0
jge 0x14004a072
cmp dword [rbx - 0xc], 0
jl 0x14004a144
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
jmp 0x14004a110
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14004a086
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
jmp 0x14004a110
mov r14d, dword [rbx - 0x10]
lea rsi, [rbp + 0x20]
sub rsi, rbx
sar rsi, 1
test edi, edi
js 0x14004a15a
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14004a0d2
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140002490
mov rbx, qword [rsp + 0x40]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp rsi, r14
lea r14, [rax + rax]
mov r9, r14
ja 0x14004a0f6
lea r8, [rbx + rsi*2]
call fcn.1400cc30c
jmp 0x14004a0ff
lea r8, [rbp + 0x20]
call fcn.1400cc4cc
cmp edi, dword [rbx - 0xc]
jg 0x14004a14f
mov dword [rbx - 0x10], edi
mov word [r14 + rbx], r13w
or rsi, 0xffffffffffffffff
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.140027f70
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x140049f13
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140049f13
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
nop
test rbx, rbx
je 0x14004a17b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r13
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], r13d
mov dil, 1
test rbx, rbx
je 0x14004a196
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r13
mov dword [rsp + 0x58], r13d
movzx eax, dil
mov rcx, qword [rbp + 0x820]
xor rcx, rsp
call fcn.1400cbae0
mov rbx, qword [rsp + 0x980]
add rsp, 0x930
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret