Function at 0x1400036f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x14371b080]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov rbx, rdx
mov r14, rcx
mov qword [rbp - 0x50], rcx
xor r15d, r15d
mov dword [rbp - 0x58], 0x200
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp]
call fcn.1400336d0
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
movdqa xmm1, xmmword [0x143715000]
movdqu xmmword [rbp - 0x18], xmm1
mov byte [rbp - 0x28], r15b
lea rcx, [rsp + 0x30]
call fcn.140009c20
nop
mov r8, qword [rax]
lea rcx, [rbp - 0x70]
call fcn.1400020f0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140002440
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140002e50
cmp qword [rax + 0x18], 7
jbe 0x140003796
mov rax, qword [rax]
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x1400037fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cd9
call fcn.1400106e0
movdqa xmm0, xmmword [0x143714ff0]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r15w
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x14000384a
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003845
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cdf
call fcn.1400106e0
movdqa xmm0, xmmword [0x143715000]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400038a3
mov rdx, qword [rbp - 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003892
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ce5
call fcn.1400106e0
mov qword [rbp - 0x70], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140003914
mov rdx, qword [rsp + 0x38]
call fcn.14000ad80
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
sub rcx, r8
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, r8
cmp rdx, 0x1000
jb 0x14000390c
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ceb
mov rcx, r8
call fcn.1400106e0
mov r8, rbx
lea rcx, [rsp + 0x30]
call fcn.1400020f0
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140002440
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140002e50
cmp qword [rax + 0x18], 7
jbe 0x140003947
mov rax, qword [rax]
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x1400039af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400039aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cf1
call fcn.1400106e0
movdqa xmm0, xmmword [0x143714ff0]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r15w
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140003a00
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400039fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cf7
call fcn.1400106e0
movdqa xmm0, xmmword [0x143715000]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140003a4f
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cfd
call fcn.1400106e0
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
test ebx, ebx
je 0x140003ae7
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], r15
xor r8d, r8d
lea rdx, [0x1400402ad]
mov rcx, r14
call fcn.14000a470
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140003abe
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ab9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cd3
call fcn.1400106e0
mov rax, r14
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.1400106c0
mov rbx, qword [rsp + 0x550]
add rsp, 0x510
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ebx, dword [rbp - 0x58]
shr rbx, 1
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
cmp rbx, 7
ja 0x140003b26
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], 7
add rbx, rbx
mov r8, rbx
lea rdx, [rbp]
lea rcx, [rbp - 0x48]
call fcn.140033030
mov word [rbp + rbx - 0x48], r15w
jmp 0x140003ba1
mov rsi, rbx
or rsi, 7
mov eax, 0xa
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi*2 + 2]
cmp rcx, 0x1000
jb 0x140003b76
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003d03
mov rcx, rax
call fcn.1400106e8
test rax, rax
je 0x140003ccd
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140003b7e
call fcn.1400106e8
mov rdi, rax
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp]
mov rcx, rdi
call fcn.140033030
mov word [rbx + rdi], r15w
lea rcx, [rbp - 0x48]
mov r8, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
cmova rcx, r8
mov rax, qword [rbp - 0x38]
lea rdi, [rcx + rax*2]
lea rbx, [rbp - 0x48]
cmova rbx, r8
cmp rbx, rdi
je 0x140003c23
nop word [rax + rax]
movzx r9d, byte [rbx]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
cmp rcx, rdx
jae 0x140003c01
lea rax, [rcx + 1]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x28]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x28]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140003c12
xor r8d, r8d
mov edx, 1
lea rcx, [rbp - 0x28]
call fcn.14000ae10
add rbx, 2
cmp rbx, rdi
jne 0x140003bd0
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x48]
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [r14 + 0x10], xmm1
movdqa xmm0, xmmword [0x143715000]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
cmp rdx, 7
jbe 0x140003c7c
lea rdx, [rdx*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x140003c74
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ccd
mov rcx, r8
call fcn.1400106e0
movdqa xmm0, xmmword [0x143714ff0]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r15w
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140003abe
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ab9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cd3
jmp 0x140003ab9
call fcn.14001a910
nop
call fcn.14001a910
nop
call fcn.14001a910
nop
call fcn.14001a910
nop
call fcn.14001a910
nop
call fcn.14001a910
nop
call fcn.14001a910
nop
call fcn.14001a910
nop
call fcn.14001a910
int3
call fcn.1400011e0
int3