Function at 0x140009240
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xba0]
sub rsp, 0xca0
mov rax, qword [0x140047008]
xor rax, rsp
mov qword [rbp + 0xb90], rax
mov r15d, ecx
xor esi, esi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rsi
call fcn.14000fc40
test eax, eax
je 0x14000968e
lea r14d, [rsi + 1]
cmp r15d, 2
ja 0x1400094b4
mov eax, dword [0x14003c778]
lea rcx, [rbp + 0x58e]
movups xmm0, xmmword [str.PromptHighDate]
xor edx, edx
mov dword [rbp + 0x588], eax
movsd xmm1, qword [0x14003c770]
mov r8d, 0x1ea
movzx eax, word [0x14003c77c]
movaps xmmword [rbp + 0x570], xmm0
mov word [rbp + 0x58c], ax
movsd qword [rbp + 0x580], xmm1
call fcn.14001c070
mov eax, dword [0x14003c7a0]
lea rcx, [rbp + 0x79e]
movups xmm0, xmmword [str.PromptACInHighDate]
mov dword [rbp + 0x798], eax
xor edx, edx
movups xmm1, xmmword [0x14003c790]
movzx eax, word [0x14003c7a4]
mov r8d, 0x1e2
movups xmmword [rbp + 0x778], xmm0
mov word [rbp + 0x79c], ax
movups xmmword [rbp + 0x788], xmm1
call fcn.14001c070
movups xmm0, xmmword [str.PromptDCOutHighDate]
xor edx, edx
mov r8d, 0x1e0
movups xmm1, xmmword [0x14003c7b8]
lea rcx, [rbp + 0x9a8]
movaps xmmword [rbp + 0x980], xmm0
movsd xmm0, qword [0x14003c7c8]
movsd qword [rbp + 0x9a0], xmm0
movaps xmmword [rbp + 0x990], xmm1
call fcn.14001c070
movups xmm0, xmmword [str.PromptLowDate]
lea rcx, [rsp + 0x6c]
mov eax, dword [0x14003c7e8]
movsd xmm1, qword [0x14003c7e0]
xor edx, edx
mov r8d, 0x1ec
movaps xmmword [rsp + 0x50], xmm0
movsd qword [rsp + 0x60], xmm1
mov dword [rsp + 0x68], eax
call fcn.14001c070
movups xmm0, xmmword [str.PromptACInLowDate]
mov eax, dword [0x14003c810]
xor edx, edx
movups xmm1, xmmword [0x14003c800]
mov r8d, 0x1e4
mov dword [rbp + 0x178], eax
lea rcx, [rbp + 0x17c]
movups xmmword [rbp + 0x158], xmm0
movups xmmword [rbp + 0x168], xmm1
call fcn.14001c070
mov eax, dword [0x14003c838]
lea rcx, [rbp + 0x386]
movups xmm0, xmmword [str.PromptDCOutLowDate]
mov dword [rbp + 0x380], eax
xor edx, edx
movups xmm1, xmmword [0x14003c828]
movzx eax, word [0x14003c83c]
mov r8d, 0x1e2
movaps xmmword [rbp + 0x360], xmm0
movaps xmmword [rbp + 0x370], xmm1
mov word [rbp + 0x384], ax
call fcn.14001c070
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x570]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x48], 4
imul rbx, r15, 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
add rdx, rbx
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400094b4
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov edi, dword [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x28], rax
add rdx, rbx
lea rax, [rsp + 0x38]
mov dword [rsp + 0x3c], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400094b4
mov esi, r14d
jmp 0x1400094b8
mov edi, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov ebx, dword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
je 0x14000968e
test edi, edi
jne 0x1400094df
test ebx, ebx
jne 0x1400094f2
mov eax, r14d
jmp 0x140009690
cmp edi, 0xffffffff
jne 0x1400094f2
cmp ebx, edi
jne 0x1400094f2
mov eax, 2
jmp 0x140009690
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
mov esi, dword [rsp + 0x44]
mov eax, ebx
shl rdi, 0x20
add rdi, rax
shl rsi, 0x20
mov eax, dword [rsp + 0x40]
add rsi, rax
cmp rdi, rsi
jb 0x140009524
mov eax, 3
jmp 0x140009690
mov eax, 0x5a0
mov qword [rsp + 0x30], 0
test r15d, r15d
lea rcx, [rsp + 0x30]
mov ebx, 0x870
cmovne ebx, eax
call fcn.14000fc40
test eax, eax
je 0x140009669
cmp r15d, 2
ja 0x14000965e
movups xmm0, xmmword [str.PromptRepeatedHours]
xor edx, edx
mov r8d, 0x1e0
movups xmm1, xmmword [0x14003c888]
lea rcx, [rsp + 0x78]
movaps xmmword [rsp + 0x50], xmm0
movsd xmm0, qword [0x14003c898]
movsd qword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm1
call fcn.14001c070
movups xmm0, xmmword [str.PromptACInRepeatedHours]
xor edx, edx
mov r8d, 0x1d8
movups xmm1, xmmword [0x14003c8b0]
lea rcx, [rbp + 0x188]
movups xmmword [rbp + 0x158], xmm0
movups xmm0, xmmword [0x14003c8c0]
movups xmmword [rbp + 0x168], xmm1
movups xmmword [rbp + 0x178], xmm0
call fcn.14001c070
movups xmm0, xmmword [str.PromptDCOutRepeatedHours]
movzx eax, word [0x14003c900]
xor edx, edx
movups xmm1, xmmword [0x14003c8e0]
lea rcx, [rbp + 0x392]
mov r8d, 0x1d6
movaps xmmword [rbp + 0x360], xmm0
movups xmm0, xmmword [0x14003c8f0]
mov word [rbp + 0x390], ax
movaps xmmword [rbp + 0x370], xmm1
movaps xmmword [rbp + 0x380], xmm0
call fcn.14001c070
imul rcx, r15, 0x208
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 4
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x50]
add rdx, rcx
lea rax, [rsp + 0x3c]
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
cmove ebx, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp ebx, r14d
movabs rcx, 0x861c46800
cmova r14d, ebx
mov eax, r14d
imul rax, rcx
add rax, rdi
cmp rax, rsi
sbb eax, eax
add eax, 5
jmp 0x140009690
xor eax, eax
mov rcx, qword [rbp + 0xb90]
xor rcx, rsp
call fcn.14001a990
lea r11, [rsp + 0xca0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret