Function at 0x140019170
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x50], 0xfffffffffffffffe
xorps xmm0, xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx], xmm0
nop
mov qword [rcx + 0x18], 7
mov word [rcx], 0
mov qword [rbp + 0x28], rcx
nop
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
mov rdi, r8
mov rsi, rdx
mov rcx, r8
call fcn.1400441fc
mov rbx, rax
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jae 0x140019623
cmp rbx, 7
ja 0x140019208
nop
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], 7
lea r8, [rbx + rbx]
lea rcx, [rbp + 0x30]
mov rdx, rdi
call fcn.14006d670
lea rax, [rbx*2 + 0x30]
add rax, rbp
jmp 0x14001927c
nop
mov qword [rbp + 0x48], 7
mov rax, rbx
or rax, 7
movabs r15, 0x7ffffffffffffffe
mov rcx, 0xfffffffffffffffe
cmp rax, r15
ja 0x14001924d
cmp rax, 0xb
mov r15d, 0xa
cmovae r15, rax
lea rcx, [r15*2 + 2]
cmp r15, 0x7ff
jb 0x140019254
call fcn.140005860
jmp 0x140019259
call fcn.14001ef3c
mov r14, rax
nop
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], r15
lea r8, [rbx + rbx]
mov rcx, rax
mov rdx, rdi
call fcn.14006d670
lea rax, [r14 + rbx*2]
nop
mov word [rax], 0
mov rcx, rdi
call fcn.1400441fc
cmp rax, 2
jb 0x1400192e4
nop
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x48]
cmp rcx, rax
jne 0x1400192bf
nop
mov qword [rsp + 0x20], 1
lea r9, [0x1400713ae]
lea rcx, [rbp + 0x30]
mov edx, 1
call fcn.140005e10
jmp 0x1400192e4
lea rdx, [rax + 1]
mov qword [rbp + 0x40], rdx
cmp rcx, 8
jb 0x1400192d3
mov rcx, qword [rbp + 0x30]
jmp 0x1400192d7
lea rcx, [rbp + 0x30]
mov word [rcx + rax*2], 0x5c
mov word [rcx + rax*2 + 2], 0
lea rdx, [0x140070d40]
mov rdi, rbp
mov rcx, rdi
mov r8d, 0x3b
call fcn.140006940
nop
mov r8, qword [rbp + 0x10]
cmp qword [rbp + 0x18], 8
jb 0x14001930c
mov rdi, qword [rbp]
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x48]
mov rdx, rcx
sub rdx, rax
cmp rdx, r8
jae 0x140019336
nop
mov qword [rsp + 0x20], r8
lea rcx, [rbp + 0x30]
mov rdx, r8
mov r9, rdi
call fcn.140005e10
jmp 0x140019364
lea rbx, [rax + r8]
mov qword [rbp + 0x40], rbx
cmp rcx, 8
jb 0x14001934a
mov r14, qword [rbp + 0x30]
jmp 0x14001934e
lea r14, [rbp + 0x30]
lea rcx, [r14 + rax*2]
add r8, r8
mov rdx, rdi
call fcn.14006d670
mov word [r14 + rbx*2], 0
nop
mov rax, qword [rbp + 0x18]
cmp rax, 8
jb 0x1400193ad
nop
mov rcx, qword [rbp]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400193a8
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140019628
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
lea rdx, [0x140070e30]
mov rdi, rbp
mov rcx, rdi
mov r8d, inet_ntoa
call fcn.140006940
nop
cmp qword [rbp + 0x48], 8
jb 0x1400193d3
mov rdx, qword [rbp + 0x30]
jmp 0x1400193d7
lea rdx, [rbp + 0x30]
mov rcx, rsi
mov r8d, 1
call fcn.140016490
mov rsi, rax
test rax, rax
je 0x140019585
nop
mov dword [rbp + 0x20], 4
cmp qword [rbp + 0x18], 8
jb 0x140019404
mov rdi, qword [rbp]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x24]
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001957c
nop
cmp dword [rbp + 0x24], 1
jne 0x14001957c
lea rdx, [0x140070e60]
lea rdi, [rbp - 0x48]
mov rcx, rdi
mov r8d, inet_ntoa
call fcn.140006940
nop
cmp qword [rbp - 0x30], 8
jb 0x140019461
mov rdi, qword [rbp - 0x48]
lea rbx, [rbp - 0x20]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.1400164e0
mov rdi, qword [rbp + 0x28]
cmp rbx, rdi
je 0x1400194ea
nop
mov rax, qword [rdi + 0x18]
cmp rax, 8
jb 0x1400194c4
nop
mov rcx, qword [rdi]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400194bf
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140019641
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
nop
movups xmm0, xmmword [rbp - 0x20]
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 7
mov word [rbp - 0x20], 0
nop
mov rax, qword [rbp - 8]
cmp rax, 8
jb 0x140019533
nop
mov rcx, qword [rbp - 0x20]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14001952e
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140019637
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
nop
mov rax, qword [rbp - 0x30]
cmp rax, 8
jb 0x14001957c
nop
mov rcx, qword [rbp - 0x48]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140019577
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14001963c
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rbp + 0x18]
cmp rax, 8
jb 0x1400195ca
nop
mov rcx, qword [rbp]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400195c5
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14001962d
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
nop
mov rax, qword [rbp + 0x48]
cmp rax, 8
jb 0x14001960f
nop
mov rcx, qword [rbp + 0x30]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14001960a
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140019632
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
mov rax, qword [rbp + 0x28]
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call fcn.140005840
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
int3