Function at 0x1400d772c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
and dword [rbp - 0x10], 0
mov rsi, r9
and dword [rbp + 0x20], 0
mov r14, r8
cmp qword [rbp + 0x40], 0
mov r15, rcx
mov ebx, 0x80004005
mov qword [rbp - 8], rcx
jne 0x1400d776d
mov eax, 0x80070057
jmp 0x1400d79a4
mov eax, dword [rbp + 0x50]
test rdx, rdx
jne 0x1400d7779
test eax, eax
je 0x1400d77f7
neg eax
lea rax, [rbp - 8]
sbb r9d, r9d
mov qword [rsp + 0x20], rax
and r9d, 0x100
xor r8d, r8d
or r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test eax, eax
je 0x1400d77f3
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
cmovns eax, ebx
mov ebx, eax
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400d798e
test byte [rcx + 0x1c], 1
je 0x1400d798e
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401285a0]
mov edx, 0x3f
mov r9d, ebx
call fcn.1400036d4
jmp 0x1400d798e
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x10]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
and qword [rsp + 0x20], 0
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test eax, eax
je 0x1400d785c
test rsi, rsi
je 0x1400d7848
cmp dword [rbp + 0x48], 0
je 0x1400d783a
mov rdx, qword [rbp + 0x40]
mov rcx, rsi
call fcn.1400d6dfc
mov ebx, eax
jmp 0x1400d798e
mov rcx, qword [rbp + 0x40]
mov rdx, rsi
call fcn.1400d8f6c
jmp 0x1400d7833
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
cmovns eax, ebx
jmp 0x1400d7833
mov eax, dword [rbp + 0x20]
dec eax
cmp eax, 1
jbe 0x1400d7870
mov ebx, 0x8007065d
jmp 0x1400d798e
mov ecx, dword [rbp - 0x10]
mov eax, 2
shr rcx, 1
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14010617c
mov rsi, rax
test rax, rax
jne 0x1400d78d2
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400d798e
test byte [rcx + 0x1c], 1
je 0x1400d798e
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x40]
lea r8, [0x1401285a0]
call fcn.140003614
jmp 0x1400d798e
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400d792d
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovns ecx, ebx
mov ebx, ecx
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400d7985
test byte [rcx + 0x1c], 1
je 0x1400d7985
mov edx, 0x41
jmp 0x1400d796e
mov eax, dword [rbp + 0x20]
dec eax
cmp eax, 1
jbe 0x1400d793e
mov ebx, 0x8007065d
jmp 0x1400d7985
mov rcx, qword [rbp + 0x40]
mov rdx, rsi
call fcn.1400d8f6c
mov ebx, eax
test eax, eax
jns 0x1400d7983
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400d7985
test byte [rcx + 0x1c], 1
je 0x1400d7985
mov edx, 0x42
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401285a0]
mov r9d, ebx
call fcn.1400036d4
jmp 0x1400d7985
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400d79a2
cmp rcx, r15
je 0x1400d79a2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret