Function at 0x14003ec50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r13, r9
mov r15, r8
test rdx, rdx
jne 0x14003ec80
mov rdx, qword [r8]
jmp 0x14003ed1c
test r13, r13
jne 0x14003ec8d
mov rdx, qword [r8]
jmp 0x14003ed1c
xor esi, esi
xor eax, eax
mov qword [r9], rax
mov r8, rdx
mov qword [r9 + 8], rax
mov rdx, rcx
mov qword [r9 + 0x10], rax
lea rcx, [rbp - 0x20]
lea r9d, [rsi + 1]
mov qword [rbp - 0x20], rsi
mov dword [rbp - 0x18], esi
mov qword [rbp - 0x10], rsi
mov dword [rbp - 0x50], esi
call fcn.140024490
test eax, eax
je 0x14003eccc
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14003ed19
jmp 0x14003ed13
mov r14, qword [rbp - 0x20]
lea r9, [rbp - 0x50]
mov rdx, qword [r15]
mov rcx, r14
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003ed0b
mov eax, dword [rbp - 0x50]
sub eax, 1
je 0x14003ee2a
sub eax, 2
je 0x14003ed94
cmp eax, 1
je 0x14003ed3f
test r14, r14
je 0x14003ed19
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [r15]
sub rdx, 0x18
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003ed38
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14003ef50
mov eax, 0x13
mov dword [rbp - 0x44], 4
mov word [r13], ax
lea rcx, [rbp - 0x44]
mov rdx, qword [r15]
lea rax, [r13 + 8]
mov qword [rsp + 0x28], rcx
lea r9, [rbp - 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14003ef1a
cmp dword [rbp - 0x40], 4
mov edi, esi
mov r12d, SafeArrayDestroy
cmovne edi, r12d
jmp 0x14003ef1a
mov rdx, qword [r15]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x3c]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rcx, r14
mov dword [rbp + 0x38], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14003edce
cmp dword [rbp - 0x3c], 3
mov edi, esi
mov r12d, SafeArrayDestroy
cmovne edi, r12d
mov eax, dword [rbp + 0x38]
lea r8, [rbp - 0x30]
mov ecx, 0x11
mov dword [rbp - 0x30], eax
mov eax, 0x2011
mov dword [rbp - 0x2c], esi
mov word [r13], ax
lea edx, [rcx - 0x10]
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov qword [r13 + 8], rax
test rax, rax
je 0x14003ef1a
mov rax, qword [rax + 0x10]
lea rcx, [rbp + 0x38]
mov rdx, qword [r15]
lea r9, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x14003ef1a
mov eax, 0x1f
mov qword [rsp + 0xb0], rbx
mov word [r13], ax
lea r9, [rbp - 0x38]
mov rdx, qword [r15]
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov ebx, esi
mov rcx, r14
mov qword [rsp + 0x20], rsi
mov dword [rbp - 0x4c], esi
mov dword [rbp + 0x38], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov r12d, SafeArrayDestroy
test eax, eax
jne 0x14003ee8a
mov eax, dword [rbp - 0x38]
dec eax
cmp eax, 1
jbe 0x14003ee80
mov edi, r12d
jmp 0x14003ee8a
mov ebx, dword [rbp - 0x4c]
mov edi, esi
shr ebx, 1
mov dword [rbp + 0x38], ebx
add rbx, rbx
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r8, rbx
xor edx, edx
mov rcx, rax
mov qword [r13 + 8], rax
call fcn.1402ef020
mov rbx, qword [r13 + 8]
test rbx, rbx
je 0x14003ef12
mov eax, dword [rbp + 0x38]
lea r9, [rbp - 0x34]
mov rdx, qword [r15]
add eax, eax
mov dword [rbp - 0x48], eax
xor r8d, r8d
lea rax, [rbp - 0x48]
mov rcx, r14
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14003ef12
mov eax, dword [rbp - 0x34]
dec eax
cmp eax, 1
jbe 0x14003eeee
mov edi, r12d
jmp 0x14003ef12
test rbx, rbx
je 0x14003ef10
mov eax, dword [rbp - 0x48]
test eax, eax
je 0x14003ef0d
test al, 1
jne 0x14003ef08
shr rax, 1
cmp word [rbx + rax*2 - 2], si
je 0x14003ef10
mov edi, r12d
jmp 0x14003ef12
mov word [rbx], si
mov edi, esi
mov rbx, qword [rsp + 0xb0]
test edi, edi
sete sil
test r14, r14
je 0x14003ef2e
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [r15]
mov eax, 0xffffffff
sub rdx, 0x18
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003ef4e
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, esi
lea r11, [rsp + 0x80]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret