Function at 0x1400ba290
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1210]
mov eax, 0x1310
call fcn.1401722d0
sub rsp, rax
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x1350], rbx
mov qword [rsp + 0x1358], rsi
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rbp + 0x1200], rax
mov r15, rdx
mov r12, rcx
mov qword [rsp + 0x38], rcx
xor esi, esi
test rdx, rdx
je 0x1400ba2ec
mov dword [rdx], esi
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x68], rsi
mov r9d, 0x20019
lea r8, str.SOFTWARELudashi
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x58]
call fcn.14007dcc0
mov rbx, 0xffffffffffffffff
test eax, eax
jne 0x1400ba9ef
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x200]
call fcn.140289490
mov dword [rsp + 0x30], 0x1000
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x200]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.url0
mov r14, qword [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ba9f4
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
ja 0x1400ba9f4
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400ba3b1
test al, 1
jne 0x1400ba9f4
shr rax, 1
cmp word [rbp + rax*2 + 0x1fe], 0
jne 0x1400ba9f4
jmp 0x1400ba3b8
mov word [rbp + 0x200], si
test r14, r14
je 0x1400ba3ce
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, rsi
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x60], esi
cmp word [rbp + 0x200], 0
je 0x1400ba9f4
lea rax, [rbp + 0x68]
mov qword [rbp + 0x60], rax
xor r8d, r8d
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x60]
call fcn.1400bd5c0
nop
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], 0
mov rdx, qword [rbp + 0x60]
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x1400ba414
lea rcx, [rbp - 8]
call fcn.14000c230
nop
lea rax, [rbp + 0x68]
mov rcx, qword [rbp + 0x60]
cmp rcx, rax
je 0x1400ba43a
call fcn.14028fcf4
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x18], 0
mov r8d, 0x24
lea rdx, str.6804FACB_33CC_48a8_99B1_4E2A487F9638
lea rcx, [rbp + 0x18]
call fcn.14000c230
nop
lea r8, [rbp - 0x48]
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 8]
call fcn.140173420
mov edi, eax
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x1400ba4b9
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ba4b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400baa85
call fcn.140171af0
test edi, edi
je 0x1400ba966
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x48], xmm0
mov byte [rbp + 0x38], 0
mov r8d, 1
lea rdx, [0x14030348c]
lea rcx, [rbp + 0x38]
call fcn.14000c230
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x38]
lea rcx, [rbp - 0x48]
call fcn.1400c6200
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x1400ba545
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ba540
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400baa8b
call fcn.140171af0
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
sub rsi, rdi
sar rsi, 5
cmp rsi, 2
jb 0x1400ba915
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.140023630
nop
lea rdx, [rdi + 0x20]
lea rcx, [rsp + 0x78]
call fcn.140023630
nop
cmp qword [rbp - 0x18], 0
je 0x1400ba88a
cmp qword [rbp - 0x78], 0
je 0x1400ba88a
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], 0
lea r8, [rbp - 0x68]
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x78]
call fcn.140173420
test eax, eax
je 0x1400ba84e
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rdx, qword [rbp - 0x68]
lea rax, [rbp + 0xf8]
mov qword [rbp + 0xf0], rax
xor r8d, r8d
lea rcx, [rbp + 0xf0]
call fcn.1400bd490
nop
mov rdx, qword [rbp + 0xf0]
lea rcx, [rsp + 0x38]
call fcn.14000d920
nop
lea rax, [rbp + 0xf8]
mov rcx, qword [rbp + 0xf0]
cmp rcx, rax
je 0x1400ba613
call fcn.14028fcf4
test r15, r15
je 0x1400ba634
cmp rsi, 3
jb 0x1400ba634
lea rcx, [rdi + 0x40]
cmp qword [rcx + 0x18], 0x10
jb 0x1400ba62c
mov rcx, qword [rcx]
call fcn.1402918c4
mov dword [r15], eax
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffffffe8
call fcn.14000ae30
add rax, 0x18
mov qword [r12], rax
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x1400ba667
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x1400ba6a2
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ba69d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400baa91
call fcn.140171af0
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x1400ba6ef
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ba6ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400baa97
call fcn.140171af0
xor esi, esi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rsp + 0x78], sil
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x1400ba73d
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ba738
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400baa9d
call fcn.140171af0
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbp - 0x28], 0
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1400ba7a3
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.1400196d0
mov rdx, qword [rsp + 0x50]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400ba79a
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400baaa3
mov rcx, rbx
call fcn.140171af0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x1400ba7de
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ba7d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400baaa9
call fcn.140171af0
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x1400ba82a
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ba825
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400baaaf
call fcn.140171af0
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], 0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400baa4c
jmp 0x1400baa46
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x1400ba88a
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ba884
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400baab5
call fcn.140171af0
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x1400ba8c6
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ba8c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400baabb
call fcn.140171af0
xor esi, esi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rsp + 0x78], sil
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x1400ba915
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ba90f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400baac1
call fcn.140171af0
nop
test rdi, rdi
je 0x1400ba966
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.1400196d0
mov rdx, qword [rsp + 0x50]
sub rdx, rdi
and rdx, 0xffffffffffffffe0
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400ba95d
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400baac7
mov rcx, rdi
call fcn.140171af0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x1400ba9a1
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ba99c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400baacd
call fcn.140171af0
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x1400ba9f4
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ba9e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400baad3
call fcn.140171af0
jmp 0x1400ba9f4
mov r14, qword [rsp + 0x58]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400baa7a
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [r12], rax
lea rdi, [0x1402ec198]
mov rdx, rdi
mov rcx, r12
call fcn.14002e390
test al, al
jne 0x1400baa3e
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1400baa25
mov r8d, ebx
mov rdx, rdi
mov rcx, r12
call fcn.140010860
nop
test r14, r14
je 0x1400baa4c
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, r12
mov rcx, qword [rbp + 0x1200]
xor rcx, rsp
call fcn.140172190
lea r11, [rsp + 0x1310]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000adf0
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
int3