Function at 0x14003d260
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x80], rbx
mov rax, qword [0x1403ddfb8]
xor rax, rbp
mov qword [rbp + 0x28], rax
mov r12, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
xor ebx, ebx
mov dword [rbp], ebx
mov r13d, ebx
mov dword [rbp + 8], ebx
mov rdi, qword [rbp + 0x90]
test rdi, rdi
je 0x14003d2c2
mov r13d, dword [rdi]
mov dword [rbp + 8], r13d
mov eax, dword [rcx + 8]
test eax, eax
jne 0x14003d4d3
mov eax, dword [rbp + 0x98]
and eax, 1
test al, al
jne 0x14003d30f
cmp dword [rbp + 0xa0], ebx
je 0x14003d2f1
mov qword [rsp + 0x20], rdi
call fcn.14003dbb0
jmp 0x14003d4d3
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r9
mov r9, rsi
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x14003d4d3
test rdi, rdi
jne 0x14003d321
test rsi, rsi
jne 0x14003d321
lea eax, [rdi + 0x57]
jmp 0x14003d4d3
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
xor r8d, r8d
call fcn.14003d950
test rsi, rsi
je 0x14003d340
mov ecx, dword [rbp + 4]
mov dword [rsi], ecx
test eax, eax
jne 0x14003d4d3
test rdi, rdi
je 0x14003d4d3
mov qword [rbp + 0x10], rbx
mov esi, dword [rbp]
mov edx, esi
lea rax, [rsi + 0x10]
mov rcx, rbx
cmp rax, rsi
cmova rcx, rax
test rcx, rcx
je 0x14003d3f9
lea rax, [rsi + 0x10]
mov rcx, rbx
cmp rax, rdx
cmova rcx, rax
lea rax, [rsi + 0x10]
cmp rcx, 0x400
ja 0x14003d3d0
cmp rax, rdx
cmova rbx, rax
lea rax, [rbx + 0xf]
cmp rax, rbx
ja 0x14003d3a6
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14026e690
sub rsp, rax
lea rbx, [rsp + 0x30]
mov qword [rbp + 0x18], rbx
test rbx, rbx
je 0x14003d3f9
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x18], rbx
jmp 0x14003d3f9
cmp rax, rdx
cmova rbx, rax
mov rcx, rbx
call fcn.14029de2c
mov rbx, rax
mov qword [rbp + 0x20], rax
test rax, rax
je 0x14003d3f9
mov dword [rax], 0xdddd
add rbx, 0x10
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x10], rbx
jmp 0x14003d425
test rbx, rbx
jne 0x14003d432
lea eax, [rbx + 0xe]
jmp 0x14003d4d3
mov r8d, esi
xor edx, edx
mov rcx, rbx
call fcn.14028e7e0
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
mov r8, rbx
mov rdx, r14
mov rcx, r15
call fcn.14003d950
mov r14d, eax
test eax, eax
jne 0x14003d4bf
cmp dword [rbp + 0xa0], eax
je 0x14003d491
mov edx, dword [rbp + 4]
cmp edx, 1
je 0x14003d476
cmp edx, 7
jne 0x14003d491
mov dword [rdi], r13d
mov qword [rsp + 0x20], rdi
mov r9, r12
mov r8, rbx
mov rcx, r15
call fcn.14003d8d0
mov r14d, eax
jmp 0x14003d4bf
test r12, r12
je 0x14003d4ba
mov eax, dword [rdi]
mov esi, dword [rbp]
cmp esi, eax
jbe 0x14003d4a7
mov r14d, 0xea
jmp 0x14003d4bd
mov r9, rsi
mov rdx, rax
mov r8, rbx
mov rcx, r12
call fcn.140028d70
jmp 0x14003d4bd
mov esi, dword [rbp]
mov dword [rdi], esi
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x14003d4d0
call fcn.140290594
mov eax, r14d
mov rcx, qword [rbp + 0x28]
xor rcx, rbp
call fcn.14026d870
mov rbx, qword [rbp + 0x80]
lea rsp, [rbp + 0x30]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret