Function at 0x14001d240
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7e0]
sub rsp, 0x8e0
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x930], rbx
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp + 0x7d0], rax
mov r14, rdx
mov rsi, rcx
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x40], rcx
mov r9d, dword [0x1401d5d60]
mov r8d, r9d
imul r8d, r9d
mov eax, 0x66666667
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub r8d, ecx
xor r15d, r15d
cmp r8d, 0x13
jne 0x14001d2ed
mov r8d, r15d
test r9d, r9d
je 0x14001d2e6
nop word [rax + rax]
mov ecx, r9d
and ecx, 1
add r8d, ecx
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
mov r9d, eax
jne 0x14001d2d0
mov dword [0x1401d5d60], r8d
movzx eax, byte [0x1401d5d64]
neg al
sbb rdi, rdi
lea rcx, str.__r_
mov rax, qword [str.__r_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], r15d
mov qword [rsp + 0x70], r15
mov ecx, dword [0x1401d5d60]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
mov eax, dword [0x1401d6174]
mov ecx, 0xcad97f46
cmp r8d, 0xb
cmove eax, ecx
mov dword [0x1401d6174], eax
lea rcx, str.__r_
mov rax, qword [str.__r_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, [0x140156128]
test rdx, 0xffffffffffff0000
jne 0x14001d3b5
movzx ebx, dx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x14001d3c0
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140002760
jmp 0x14001d3c0
lea rcx, [rsp + 0x58]
call fcn.1400034f0
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x60]
call fcn.14000ff10
nop
lea r8, [0x1401d6110]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14000ff10
nop
lea r8, [0x140154dcc]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.14001b320
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.14000ff10
nop
mov qword [rbp - 0x80], r15
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rax]
lea rcx, [rdi - 0x7ffffffe]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test eax, eax
jne 0x14001d449
mov dword [rsp + 0x68], r15d
mov ecx, r15d
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x60], rax
test ecx, ecx
setne bl
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
or r12, 0xffffffffffffffff
lock add dword [rdx + 0x10], r12d
jg 0x14001d46b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001d484
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001d49d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001d4b6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001d4cf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14001d52a
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001d4e8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], r15d
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14001d50c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001d523
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x14001d983
mov dword [rsp + 0x50], 0x400
mov word [rbp - 0x30], r15w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp - 0x2e]
call fcn.1400d8c20
mov edi, r15d
mov dword [rsp + 0x40], r15d
mov ebx, dword [0x1401d5d60]
lea r8d, [rbx + 2]
lea ecx, [rbx + 1]
imul r8d, ecx
imul r8d, ebx
mov eax, 0x2aaaaaab
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub r8d, eax
cmp r8d, 4
jne 0x14001d5c3
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub ebx, edx
add ebx, 0x2f4
movsxd rcx, ebx
mov eax, 4
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.1400d2e28
mov rcx, rax
call fcn.1400d3f08
mov ebx, dword [0x1401d5d60]
lea ecx, [rbx + 1]
imul ecx, ebx
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 4
jne 0x14001d63e
mov r8d, 0xf0
mov r11d, r15d
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov edi, eax
test edi, edi
jle 0x14001d632
mov eax, ebx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov r9d, r15d
mov r10, rdi
nop dword [rax]
test eax, eax
jle 0x14001d62a
mov ecx, r9d
mov edx, eax
nop dword [rax]
add r8d, ecx
dec ecx
dec rdx
jne 0x14001d620
add r9d, r11d
dec r10
jne 0x14001d610
inc r11d
cmp r11d, r8d
jl 0x14001d5f8
mov edi, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
nop word [rax + rax]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x50]
lea r8, [rbp - 0x30]
mov edx, edi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov r13d, eax
inc edi
mov dword [rsp + 0x40], edi
test eax, eax
je 0x14001d690
cmp eax, 0x103
jne 0x14001d8e7
lea rcx, str.__r_
mov rdx, qword [str.__r_]
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
lea rcx, [rbp - 0x30]
lea rax, [rbp - 0x30]
test rax, 0xffffffffffff0000
jne 0x14001d6e7
movzx edi, cx
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14001d7cb
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140002760
mov rbx, qword [rsp + 0x48]
jmp 0x14001d7cb
lea rax, [rbp - 0x30]
mov rdi, r12
nop
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14001d6f0
test edi, edi
jne 0x14001d750
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14001d7cb
cmp dword [rdx + 0x10], 0
jge 0x14001d72c
cmp dword [rbx - 0xc], 0
jl 0x14001d8f1
mov dword [rbx - 0x10], r15d
mov word [rbx], r15w
jmp 0x14001d7cb
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001d73c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
jmp 0x14001d7cb
mov r15d, dword [rbx - 0x10]
lea rsi, [rbp - 0x30]
sub rsi, rbx
sar rsi, 1
test edi, edi
js 0x14001d978
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001d788
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.140002560
mov rbx, qword [rsp + 0x48]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp rsi, r15
lea r15, [rax + rax]
mov r9, r15
ja 0x14001d7ac
lea r8, [rbx + rsi*2]
call fcn.1400d400c
jmp 0x14001d7b5
lea r8, [rbp - 0x30]
call fcn.1400d41cc
cmp edi, dword [rbx - 0xc]
jg 0x14001d96d
mov dword [rbx - 0x10], edi
xor eax, eax
mov word [r15 + rbx], ax
xor r15d, r15d
cmp dword [rbx - 0x10], 0
je 0x14001d870
call fcn.14001c480
mov rax, qword [r14 + 8]
lea rcx, [rsp + 0x48]
cmp rcx, rax
jae 0x14001d83c
mov rcx, qword [r14]
lea rdx, [rsp + 0x48]
cmp rcx, rdx
ja 0x14001d83c
lea rdi, [rsp + 0x48]
sub rdi, rcx
sar rdi, 3
cmp rax, qword [r14 + 0x10]
jne 0x14001d80f
mov rcx, r14
call fcn.14001e1e0
mov rax, qword [r14]
lea rcx, [rax + rdi*8]
mov rdi, qword [r14 + 8]
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x48], rdi
test rdi, rdi
je 0x14001d83a
mov rcx, qword [rcx]
sub rcx, 0x18
call fcn.1400025c0
add rax, 0x18
mov qword [rdi], rax
jmp 0x14001d86b
cmp rax, qword [r14 + 0x10]
jne 0x14001d84a
mov rcx, r14
call fcn.14001e1e0
mov rdi, qword [r14 + 8]
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x58], rdi
test rdi, rdi
je 0x14001d86b
lea rcx, [rbx - 0x18]
call fcn.1400025c0
add rax, 0x18
mov qword [rdi], rax
add qword [r14 + 8], 8
mov dword [rsp + 0x50], 0x400
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x30]
call fcn.1400d8c20
mov eax, dword [0x1401d5d60]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0x10
jne 0x14001d8ca
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001d8de
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
test r13d, r13d
jne 0x14001d8fc
jmp 0x14001d650
mov ecx, 0x80070057
call fcn.140001920
nop
test rbx, rbx
je 0x14001d912
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r15
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], r15d
test rbx, rbx
je 0x14001d92a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], r15d
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14001d94e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x70]
mov rdx, qword [rdx]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001d969
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
jmp 0x14001d983
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
nop
mov rcx, qword [rbp + 0x7d0]
xor rcx, rsp
call fcn.1400d37e0
mov rbx, qword [rsp + 0x930]
add rsp, 0x8e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret