Function at 0x1400358a8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov rdi, rcx
xor r15d, r15d
test rcx, rcx
jne 0x1400358d3
xor eax, eax
jmp 0x140035b05
mov dword [rbp + 0x50], r15d
mov ecx, r15d
mov dword [rbp + 0x40], ecx
mov esi, r15d
mov r12d, 2
lea rbx, [0x1403d1700]
or dword [rbp + 0x48], 0xffffffff
test esi, esi
jne 0x140035907
cmp dword [0x1403d11c0], r15d
je 0x140035a95
mov r14d, r12d
jmp 0x140035923
cmp esi, 1
jne 0x140035a95
mov rcx, rdi
call fcn.140035c50
test al, al
je 0x140035a92
mov r14d, r15d
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, 1
lock xadd dword [rbp - 0x18], eax
test eax, eax
jne 0x140035959
cmp dword [rbp - 0x14], r15d
sete al
test al, al
je 0x140035aa1
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [rbp - 0x14], eax
mov qword [rbp - 0x30], r15
mov qword [rbp + 0x58], r15
movzx r9d, word [rdi + 0x18]
shr r9d, 1
and r9d, 0x10
or r9d, r14d
mov qword [rsp + 0x20], r15
lea r8, [rbp - 0x30]
mov rdx, qword [rdi + 0x10]
lea rcx, [rbp - 0x10]
call fcn.140037160
mov ecx, dword [rax]
mov dword [rbp + 0x48], ecx
mov rbx, qword [rax + 8]
mov qword [rax + 8], r15
mov rcx, qword [rbp + 0x58]
test rcx, rcx
sete al
test al, al
jne 0x1400359ab
mov qword [rbp + 0x58], r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x58], rbx
mov rcx, qword [rbp - 8]
test rcx, rcx
sete al
test al, al
jne 0x1400359cb
mov qword [rbp - 8], r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rbp + 0x58]
cmp dword [rbp + 0x48], r15d
jne 0x140035a6a
mov rax, qword [rbp - 0x30]
test rax, rax
cmovne rbx, rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x50]
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 0x48], eax
cmp dword [rbp + 0x40], r12d
jae 0x140035a19
mov ecx, dword [rbp + 0x50]
dec ecx
cmp ecx, 1
cmovbe eax, r12d
mov dword [rbp + 0x48], eax
cmp eax, 0x3f2
je 0x140035a2c
cmp eax, 0x3fa
je 0x140035a2c
cmp eax, 6
jne 0x140035a62
mov rax, qword [rdi + 0x10]
movzx ecx, word [rax + 0xa]
and ecx, 0xf
shl rcx, 5
lea rax, [0x1403c0d00]
mov qword [rcx + rax], r15
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x140035959
mov qword [rbp + 0x58], r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140035959
test eax, eax
je 0x140035aae
mov rbx, qword [rbp + 0x58]
test rbx, rbx
sete al
test al, al
jne 0x140035a82
mov qword [rbp + 0x58], r15
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x20]
call fcn.1401763b8
lea rbx, [0x1403d1700]
mov ecx, dword [rbp + 0x40]
inc esi
cmp esi, r12d
jge 0x140035ad3
jmp 0x1400358ed
xor edx, edx
mov ecx, 0x131f4c4
call fcn.1400235f8
nop
mov rcx, qword [rbp + 0x58]
test rcx, rcx
sete al
test al, al
jne 0x140035ac7
mov qword [rbp + 0x58], r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x20]
call fcn.1401763b8
mov ecx, dword [rbp + 0x40]
cmp dword [rbp + 0x48], r15d
jne 0x140035af9
cmp dword [rbp + 0x50], r12d
je 0x140035ae9
mov al, byte [rdi + 0x18]
and al, 0xf
cmp al, r12b
jne 0x140035b03
call fcn.14003b424
mov ecx, eax
mov dword [rbp + 0x40], eax
cmp dword [rbp + 0x48], r15d
je 0x140035b03
mov rcx, rdi
call fcn.14003bad8
mov ecx, eax
mov eax, ecx
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret