Function at 0x140043860
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov rsi, rdx
mov r12, rcx
mov rdi, qword [r8]
mov rax, qword [r8 + 0x10]
add rax, rdi
mov rbx, qword [r8 + 8]
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0xd0], rax
mov word [rsp + 0xd8], 0
mov dword [rsp + 0xe0], 1
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0xc8]
call fcn.14003f080
test rbx, rbx
je 0x1400438d9
test rdi, rdi
je 0x1400438d9
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
mov dword [rsp + 0x64], 0x800
mov dword [rsp + 0x48], 0
mov rcx, qword [0x140443578]
test rcx, rcx
jne 0x14004390d
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14004446c
mov rcx, rax
mov qword [0x140443578], rax
mov r8d, 0x800
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14004446c
mov r13, rax
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [0x140098ae0]
movups xmmword [rsp + 0xd0], xmm0
mov rdi, qword [rsi]
mov r15, qword [rsp + 0x68]
lea rsi, [rsp + 0x64]
lea rbx, [rsp + 0x48]
lea r14, [rsp + 0xc8]
nop word [rax + rax]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r13
mov rcx, rdi
mov rdx, r15
xor r8d, r8d
mov r9, rbx
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x1400439b1
mov r8d, dword [rsp + 0x64]
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xd8]
sub rax, rdx
cmp rax, r8
jae 0x140043960
mov rcx, r14
call fcn.1400945d0
mov r13, qword [rsp + 0xc8]
jmp 0x140043960
mov ebp, eax
test eax, eax
jne 0x1400439e7
mov edi, dword [rsp + 0x64]
mov qword [rsp + 0xd8], rdi
mov ebp, dword [rsp + 0x48]
cmp ebp, 0xb
jbe 0x140043a39
movabs rbp, 0xde00000000
mov bl, 1
cmp qword [rsp + 0xd0], 0
jne 0x1400439f8
xor esi, esi
jmp 0x140043a0b
shl rbp, 0x20
mov bl, 1
cmp qword [rsp + 0xd0], 0
je 0x1400439e3
mov rcx, qword [0x140443578]
xor esi, esi
xor edx, edx
mov r8, r13
call sub.kernel32.dll_HeapFree
mov r13, rbp
xor edi, edi
mov rax, qword [rsp + 0x70]
shl rax, 1
test rax, rax
jne 0x140043a54
test bl, bl
je 0x140043a69
mov qword [r12 + 8], r13
mov qword [r12 + 0x10], rsi
mov qword [r12], 1
jmp 0x140044407
mov rsi, qword [rsp + 0xd0]
shr rdi, 1
xor ebx, ebx
mov rax, qword [rsp + 0x70]
shl rax, 1
test rax, rax
je 0x140043a1e
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r15
call sub.kernel32.dll_HeapFree
test bl, bl
jne 0x140043a22
cmp bpl, 7
ja 0x1400443cc
movzx eax, bpl
mov ecx, 0x86
bt ecx, eax
jae 0x1400443cc
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xa0], r12
lea r8, [rdi + rdi]
mov rax, qword [0x14043e3f8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x48], rax
cmp r8, 4
jae 0x14004441c
lea r14, [rdi*2]
add r14, r13
xor r12d, r12d
mov edi, 0xfffd
lea r15, [rsp + 0x48]
mov rsi, r13
lea r13, [rsp + 0xc8]
mov qword [rsp + 0x98], rsi
test r12w, r12w
jne 0x140043b17
jmp 0x140043b20
mov rax, qword [rsp + 0x48]
mov byte [rax + rdx], bl
add rdx, 1
mov qword [rsp + 0x58], rdx
test r12w, r12w
je 0x140043b20
mov rcx, r12
shr rcx, 0x10
jmp 0x140043b30
cmp rsi, r14
je 0x140043d1f
movzx ecx, word [rsi]
add rsi, 2
and r12, 0xffffffffffff0000
mov eax, ecx
and eax, 0xf800
movzx edx, cx
cmp eax, 0xd800
jne 0x140043bb0
mov eax, 1
cmp edx, 0xdbff
ja 0x140043bc1
cmp rsi, r14
je 0x140043cf2
movzx edx, word [rsi]
add rsi, 2
mov ebp, edx
and ebp, 0xfc00
cmp ebp, 0xdc00
jne 0x140043cfa
add ecx, 0x2800
movzx ecx, cx
add edx, 0x2400
movzx eax, dx
shl rcx, 0x2a
shl rax, 0x20
or rax, rcx
movabs rcx, 0x1000000000000
add rax, rcx
cmp ax, 2
jne 0x140043bc1
jmp 0x140043d1f
shl rdx, 0x20
mov rax, rdx
cmp ax, 2
je 0x140043d1f
mov rbx, rax
shr rbx, 0x20
test ax, ax
cmovne ebx, edi
cmp ebx, 0x7f
ja 0x140043c00
mov rdx, qword [rsp + 0x58]
cmp rdx, qword [rsp + 0x50]
jne 0x140043b00
mov rcx, r15
call fcn.140016628
mov rdx, qword [rsp + 0x58]
jmp 0x140043b00
mov dword [rsp + 0xc8], 0
mov eax, ebx
cmp ebx, 0x800
jae 0x140043c40
shr eax, 6
or al, 0xc0
mov byte [rsp + 0xc8], al
and bl, 0x3f
or bl, 0x80
mov byte [rsp + 0xc9], bl
mov ebx, 2
jmp 0x140043cb6
cmp ebx, 0x10000
jae 0x140043c78
shr eax, 0xc
or al, 0xe0
mov byte [rsp + 0xc8], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0xc9], al
and bl, 0x3f
or bl, 0x80
mov byte [rsp + 0xca], bl
mov ebx, 3
jmp 0x140043cb6
shr eax, 0x12
or al, 0xf0
mov byte [rsp + 0xc8], al
mov eax, ebx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [rsp + 0xc9], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0xca], al
and bl, 0x3f
or bl, 0x80
mov byte [rsp + 0xcb], bl
mov ebx, 4
mov rax, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
sub rax, rbp
cmp rax, rbx
jb 0x140043d0a
mov rcx, qword [rsp + 0x48]
add rcx, rbp
mov rdx, r13
mov r8, rbx
call fcn.1400931b0
add rbx, rbp
mov qword [rsp + 0x58], rbx
test r12w, r12w
jne 0x140043b17
jmp 0x140043b20
mov rsi, r14
jmp 0x140043bc1
shl rdx, 0x10
or rdx, 1
mov r12, rdx
jmp 0x140043bc1
mov rcx, r15
mov rdx, rbp
mov r8, rbx
call fcn.1400949ca
mov rbp, qword [rsp + 0x58]
jmp 0x140043cc8
mov r13, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov r14d, dword [rsp + 0x60]
mov ebx, dword [rsp + 0x40]
test rsi, rsi
jne 0x140043d5c
jmp 0x140043df4
and edx, 0x1f
shl edx, 6
and ecx, 0x3f
or ecx, edx
cmp ecx, 0x110000
jne 0x140043dbd
test rsi, rsi
je 0x140043df4
cmp byte [rsi + r13 - 1], 0
jne 0x140043df4
movzx ecx, byte [r13 + rsi - 1]
mov rax, 0xffffffffffffffff
test cl, cl
jns 0x140043de3
movzx edx, byte [r13 + rsi - 2]
cmp dl, 0xbf
jg 0x140043d40
movzx ebp, byte [r13 + rsi - 3]
cmp bpl, 0xc0
jge 0x140043db0
movzx edi, byte [r13 + rsi - 4]
and edi, 7
shl edi, 6
and ebp, 0x3f
or ebp, edi
jmp 0x140043db3
and ebp, 0xf
shl ebp, 6
and edx, 0x3f
or edx, ebp
jmp 0x140043d43
cmp ecx, 0x80
jb 0x140043de3
mov rax, 0xfffffffffffffffe
cmp ecx, 0x800
jb 0x140043de3
xor eax, eax
cmp ecx, 0x10000
setb al
or rax, 0xfffffffffffffffc
add rsi, rax
mov qword [rsp + 0x58], rsi
test rsi, rsi
jne 0x140043d5c
cmp bl, 7
jne 0x140044303
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov rax, qword [0x14043e3f8]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], 1
lea r9, [0x14043e3f5]
lea rcx, [rsp + 0xc8]
mov rdx, r13
mov r8, rsi
call fcn.14001c305
mov rcx, qword [rsp + 0xc8]
mov r14, qword [rsp + 0xd0]
mov r12, qword [rsp + 0xd8]
mov rbp, qword [rsp + 0xe0]
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x158], rax
mov r15, qword [rsp + 0xf0]
mov rax, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x108]
mov qword [rsp + 0x160], rdx
mov rdx, qword [rsp + 0x110]
mov qword [rsp + 0xa8], rdx
mov rdx, qword [rsp + 0x120]
mov qword [rsp + 0x40], rdx
mov rdx, rax
and rdx, 0xffffffffffffff00
mov qword [rsp + 0x130], rdx
lea rdx, [rbp - 1]
mov qword [rsp + 0xc0], rdx
xor r8d, r8d
mov qword [rsp + 0x138], rax
mov r9d, eax
xor eax, eax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rbp
cmp qword [rsp + 0x158], 1
jne 0x140043f60
mov rax, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xa8]
add rax, rdx
cmp rax, r14
jae 0x140044331
movzx edx, r9b
or rdx, qword [rsp + 0x130]
mov rbx, rbp
mov qword [rsp + 0x148], rdx
sub rbx, rdx
mov qword [rsp + 0x140], rbx
mov r11, r15
neg r11
lea rdx, [r15 - 1]
mov qword [rsp + 0x150], rdx
mov r10, qword [rsp + 0x40]
mov rdi, qword [rsp + 0xa8]
mov byte [rsp + 0x3f], r9b
jmp 0x14004409b
test dword [rsp + 0x138], 0xff0000
je 0x140043f86
jmp 0x140044331
add r15, rax
mov r9b, 1
test r15, r15
je 0x140043fa6
cmp r14, r15
jbe 0x140043fa0
cmp byte [rcx + r15], 0xbf
jg 0x140043fa6
jmp 0x14004445c
jne 0x14004445c
cmp r15, r14
je 0x1400441fb
movzx eax, byte [rcx + r15]
test al, al
js 0x140043fd0
mov ebx, eax
test r9b, r9b
je 0x140044030
jmp 0x140044218
mov ebx, eax
and ebx, 0x1f
movzx ebp, byte [rcx + r15 + 1]
and ebp, 0x3f
cmp al, 0xdf
jbe 0x14004400f
mov rdi, rcx
movzx edx, byte [rcx + r15 + 2]
shl ebp, 6
and edx, 0x3f
or edx, ebp
cmp al, 0xf0
jb 0x14004401e
movzx ecx, byte [rdi + r15 + 3]
and ebx, 7
shl ebx, 0x12
shl edx, 6
and ecx, 0x3f
or ecx, edx
or ebx, ecx
jmp 0x140044023
shl ebx, 6
or ebx, ebp
test r9b, r9b
je 0x140044030
jmp 0x140044218
shl ebx, 0xc
or ebx, edx
mov rcx, rdi
test r9b, r9b
jne 0x140044218
nop
cmp ebx, 0x110000
je 0x140044331
mov eax, 1
cmp ebx, 0x80
jb 0x140043f80
mov eax, 2
cmp ebx, 0x800
jb 0x140043f80
cmp ebx, 0x10000
mov eax, 4
sbb rax, 0
jmp 0x140043f80
xor eax, eax
mov rcx, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x90]
mov r10, rax
mov rax, qword [rsp + 0xc0]
add rax, rdi
cmp rax, r14
jae 0x140044331
movzx eax, byte [rcx + rax]
mov rdx, qword [rsp + 0x160]
bt rdx, rax
jae 0x140044120
cmp r15, r10
mov r9, r10
cmova r9, r15
cmp qword [rsp + 0x40], 0xffffffffffffffff
cmove r9, r15
cmp r9, rbp
cmova rbp, r9
lea rax, [rcx + rdi]
nop dword [rax]
cmp rbp, r9
je 0x140044140
lea rdx, [rdi + r9]
cmp rdx, r14
jae 0x140044431
lea rdx, [r9 + 1]
movzx ebx, byte [r12 + r9]
cmp bl, byte [rax + r9]
mov r9, rdx
je 0x1400440d0
add rdi, r11
add rdi, rdx
cmp qword [rsp + 0x40], 0xffffffffffffffff
jne 0x140044072
mov rcx, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x90]
jmp 0x140044087
add rdi, rbp
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x140044087
xor eax, eax
jmp 0x140044084
mov r9, r8
cmp qword [rsp + 0x40], 0xffffffffffffffff
mov rcx, r10
mov edx, 0
cmove rcx, rdx
mov r8, qword [rsp + 0x150]
mov rbp, qword [rsp + 0x90]
nop word cs:[rax + rax]
nop
lea rdx, [r8 + 1]
cmp rcx, rdx
jae 0x1400441d0
cmp r8, rbp
jae 0x140044431
lea rdx, [rdi + r8]
cmp rdx, r14
jae 0x140044431
movzx edx, byte [r12 + r8]
lea rbx, [r8 - 1]
cmp dl, byte [rax + r8]
mov r8, rbx
je 0x140044170
add rdi, qword [rsp + 0x148]
mov rax, qword [rsp + 0x140]
cmp qword [rsp + 0x40], 0xffffffffffffffff
mov r8, r9
mov rcx, qword [rsp + 0x88]
jne 0x140044084
jmp 0x140044087
lea rcx, [rdi + rbp]
cmp qword [rsp + 0x40], 0xffffffffffffffff
mov eax, 0
cmovne r10, rax
mov qword [rsp + 0x40], r10
mov rax, rcx
mov qword [rsp + 0xa8], rcx
mov rbp, rcx
mov r8, r9
jmp 0x140044227
test r9b, r9b
je 0x140044331
xor r9b, 1
mov byte [rsp + 0x3f], r9b
mov r15, r14
mov rdi, r14
mov rbp, r14
jmp 0x140044227
xor r9b, 1
mov byte [rsp + 0x3f], r9b
mov rdi, r15
mov rbp, r15
mov rbx, qword [rsp + 0xb0]
add rbx, r13
add rdi, r13
sub rdi, rbx
mov rax, qword [rsp + 0x70]
sub rax, r8
cmp rax, rdi
jb 0x1400442bf
mov rcx, qword [rsp + 0x80]
add rcx, r8
mov rdx, rbx
mov rbx, r8
mov r8, rdi
call fcn.1400931b0
mov r8, rbx
add r8, rdi
mov qword [rsp + 0x78], r8
cmp qword [rsp + 0x70], r8
je 0x1400442e6
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x80], rax
mov byte [rax + r8], 0xa
add r8, 1
mov qword [rsp + 0x78], r8
mov rax, rbp
mov qword [rsp + 0xb0], rbp
mov rcx, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x90]
mov r9b, byte [rsp + 0x3f]
cmp qword [rsp + 0x158], 1
jne 0x140043f60
jmp 0x140043ef2
lea rcx, [rsp + 0x68]
mov rdx, r8
mov r8, rdi
call fcn.1400949ca
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x80], rax
mov r8, qword [rsp + 0x78]
jmp 0x140044245
mov rdx, r8
mov r8d, 1
lea rcx, [rsp + 0x68]
call fcn.1400949ca
mov r8, qword [rsp + 0x78]
jmp 0x140044270
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xa0]
mov qword [rcx + 0x18], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rcx + 8], xmm0
mov qword [rcx], 0
mov r13, qword [rsp + 0x98]
jmp 0x1400443b8
mov rbx, qword [rsp + 0xb0]
add rbx, r13
add rsi, r13
sub rsi, rbx
mov rax, qword [rsp + 0x70]
sub rax, r8
cmp rax, rsi
jb 0x140044435
mov rdi, qword [rsp + 0xa0]
mov r13, qword [rsp + 0x98]
mov r14d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x80]
add rcx, r8
mov rdx, rbx
mov rbx, r8
mov r8, rsi
call fcn.1400931b0
add rbx, rsi
mov qword [rsp + 0x78], rbx
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rdi + 8], xmm0
mov qword [rdi + 0x18], rbx
mov qword [rdi], 0
cmp qword [rsp + 0x50], 0
je 0x1400443b8
mov r8, qword [rsp + 0x48]
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rsi, qword [rsp + 0xb8]
test r14b, r14b
jne 0x140044407
test rsi, rsi
jne 0x1400443f1
jmp 0x140044407
movabs rax, 0xde00000000
mov qword [r12 + 8], rax
mov qword [r12 + 0x10], 0
mov qword [r12], 1
test rsi, rsi
je 0x140044407
test r13, r13
je 0x140044407
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r13
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
shr r8, 2
lea rcx, [rsp + 0x48]
xor edx, edx
call fcn.1400949ca
jmp 0x140043ac7
ud2
lea rcx, [rsp + 0x68]
mov rdx, r8
mov r8, rsi
call fcn.1400949ca
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x80], rax
mov r8, qword [rsp + 0x78]
jmp 0x140044353
mov rdx, r14
mov r8, r15
mov r9, r14
call fcn.140094a0f
ud2
mov ecx, 0x800
mov edx, 1
call fcn.1400949bf
ud2