Function at 0x14004f53c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x38]
sub rsp, 0x110
mov rdi, r9
mov rsi, r8
mov r15, rdx
mov rbx, rcx
call fcn.1400027c4
mov rcx, rax
xor r14d, r14d
test rax, rax
je 0x14004fb4f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
call fcn.1400027c4
mov rcx, rax
test rax, rax
je 0x14004fb4f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x78], rax
call fcn.1400027c4
mov rcx, rax
test rax, rax
je 0x14004fb4f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], r14
mov dword [rsp + 0x68], r14d
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x60], r14d
mov dword [rdi], r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14004f6a5
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.140006324
lea r12, [rbx + 0x40]
mov rax, qword [r12]
lea rdx, [rbp - 0x80]
mov rcx, r12
call qword [rax]
lea r14, [rbx + 0x18]
mov qword [rbp], r14
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.140055cac
mov edi, eax
xor esi, esi
test eax, eax
js 0x14004f6a5
mov eax, dword [rsp + 0x60]
add eax, 2
mov dword [rbp - 0x54], eax
mov ecx, eax
call fcn.14002657c
mov qword [rbp + 8], rax
mov qword [rbp - 0x60], rax
test rax, rax
jne 0x14004f6d1
mov edi, 0x8007000e
mov rcx, qword [rbp + 8]
call fcn.140002da0
nop
lea rcx, [rbp - 0x80]
call fcn.140013bf0
mov eax, edi
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r13d, esi
cmp dword [rsp + 0x68], esi
jbe 0x14004f69b
mov edx, dword [rsp + 0x6c]
add edx, 1
mov dword [rsp + 0x70], edx
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x64], eax
js 0x14004fb41
mov r8, qword [rbp - 0x78]
mov ecx, 1
sub ecx, dword [r8 - 8]
mov eax, dword [r8 - 0xc]
sub eax, edx
or eax, ecx
jge 0x14004f717
lea rcx, [rbp - 0x78]
call fcn.140002b54
mov r8, qword [rbp - 0x78]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
mov edx, r13d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14004f69b
mov eax, dword [rsp + 0x70]
cmp eax, 0xffffffff
jne 0x14004f776
mov rcx, qword [rbp - 0x78]
movsxd rdx, dword [rcx - 0xc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
test eax, eax
js 0x14004fb41
mov rcx, qword [rbp - 0x78]
cmp eax, dword [rcx - 0xc]
jg 0x14004fb41
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbp - 0x78]
mov word [rax + rcx*2], si
mov ecx, dword [rsp + 0x64]
mov dword [rbp - 0x58], ecx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rsi
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0xa
mov eax, dword [rbp - 0x40]
sub eax, 1
je 0x14004f9cd
sub eax, 1
je 0x14004f9a6
sub eax, 1
je 0x14004f99d
sub eax, 1
je 0x14004f967
sub eax, 3
je 0x14004f82e
cmp eax, 4
jne 0x14004fa0b
mov dword [rbp - 0x70], 5
movsxd rax, ecx
mov rcx, qword [rbp - 0x60]
test rax, rax
je 0x14004fa0b
test rcx, rcx
je 0x14004fa39
cmp rax, 8
ja 0x14004fa39
mov rdx, rcx
lea rcx, [rbp - 0x48]
mov r8, rax
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14004fa0b
mov dword [rbp - 0x70], 2
mov rax, qword [rbp - 0x60]
mov byte [rcx + rax], sil
mov ecx, dword [rsp + 0x64]
inc ecx
mov rax, qword [rbp - 0x60]
mov byte [rcx + rax], sil
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x14004faf7
cmp qword [rbp - 0x28], rsi
ja 0x14004faf7
cmp word [rbx], si
je 0x14004f8b4
mov rdx, rbx
lea rcx, [rbp - 8]
call fcn.140002cec
nop
mov rdx, qword [rbp - 8]
lea rcx, [rbp - 0x38]
call fcn.140008560
mov rax, qword [rbp - 8]
movsxd rcx, dword [rax - 0x10]
lea rbx, [rbx + rcx*2]
add rbx, 2
lea rdx, [rax - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f8ab
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp word [rbx], si
jne 0x14004f867
mov rbx, qword [rbp - 0x60]
mov rdi, qword [rbp - 0x38]
test rdi, rdi
je 0x14004f8d8
mov rdx, rdi
mov rdi, qword [rdi]
add rdx, 0x10
mov rcx, r12
call fcn.140015650
test rdi, rdi
jne 0x14004f8bd
mov rbx, qword [rbp - 0x60]
movsxd rdi, dword [rbp - 0x54]
shr rdi, 1
test rbx, rbx
je 0x14004faf7
mov r15, rbx
mov rsi, qword [rbp - 0x38]
test rsi, rsi
je 0x14004f949
lea r14, [rsi]
mov rsi, qword [rsi]
mov r8, qword [r14 + 0x10]
mov eax, dword [r8 - 0x10]
test eax, eax
je 0x14004fa5f
add eax, 2
cmp eax, edi
jg 0x14004fa58
movsxd rdx, edi
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s
test eax, eax
jne 0x14004fa51
mov rax, qword [r14 + 0x10]
mov edx, dword [rax - 0x10]
lea eax, [rdx + 1]
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
or eax, 0xffffffff
sub eax, edx
add edi, eax
test rsi, rsi
jne 0x14004f8f4
mov r14, qword [rbp]
xor esi, esi
mov word [rbx], si
add rbx, 2
sub rbx, r15
sar rbx, 1
lea eax, [rbx + rbx]
mov dword [rbp - 0x58], eax
mov r15, qword [rbp + 0x48]
jmp 0x14004fa0b
mov dword [rbp - 0x70], 4
movsxd rax, ecx
mov rcx, qword [rbp - 0x60]
test rax, rax
je 0x14004fa0b
test rcx, rcx
je 0x14004fb01
cmp rax, 4
ja 0x14004fb01
mov rdx, rcx
lea rcx, [rbp - 0x50]
jmp 0x14004f821
mov dword [rbp - 0x70], 3
jmp 0x14004fa0b
mov dword [rbp - 0x70], 1
mov rax, qword [rbp - 0x60]
mov byte [rcx + rax], sil
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x14004f9e1
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], si
jne 0x14004f9c2
jmp 0x14004f9f2
mov dword [rbp - 0x70], esi
mov rax, qword [rbp - 0x60]
mov byte [rcx + rax], sil
mov rdx, qword [rbp - 0x60]
test rdx, rdx
jne 0x14004f9e5
mov eax, esi
jmp 0x14004f9f2
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], si
jne 0x14004f9e9
mov r8d, eax
lea rcx, [rbp - 0x68]
call fcn.140002a20
mov rax, qword [r12]
lea rdx, [rbp - 0x68]
mov rcx, r12
call qword [rax]
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.140055cac
mov edi, eax
test eax, eax
js 0x14004fa66
lea rcx, [rbp - 0x38]
call fcn.1400082dc
inc r13d
cmp r13d, dword [rsp + 0x68]
jae 0x14004f69b
jmp 0x14004f6da
xor edx, edx
mov qword [rbp - 0x48], rdx
test rcx, rcx
je 0x14004fb0b
cmp rax, 8
jmp 0x14004fb1c
mov edi, 0x80004005
jmp 0x14004fa64
mov edi, 0x8007007a
jmp 0x14004fa64
mov edi, 0x80070057
xor esi, esi
cmp qword [rbp - 0x28], rsi
jbe 0x14004fac9
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x14004fb5d
mov rax, qword [rbx]
mov qword [rbp - 0x38], rax
mov rdx, qword [rbx + 0x10]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004fa9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbp - 0x18]
mov qword [rbx], rax
mov qword [rbp - 0x18], rbx
mov rax, qword [rbp - 0x28]
sub rax, 1
mov qword [rbp - 0x28], rax
jne 0x14004fac4
lea rcx, [rbp - 0x38]
call fcn.1400082dc
mov rax, qword [rbp - 0x28]
test rax, rax
jne 0x14004fa6c
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x18], rsi
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14004f69b
mov rbx, qword [rcx]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, rbx
test rbx, rbx
jne 0x14004fae2
jmp 0x14004f69b
mov edi, 0x80070057
jmp 0x14004fa66
xor edx, edx
mov dword [rbp - 0x50], edx
test rcx, rcx
jne 0x14004fb18
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayAccessData
jmp 0x14004fb29
cmp rax, 4
jbe 0x14004fb2e
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [rax], SafeArrayAllocDescriptor
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo
mov edi, 0x80004005
lea rcx, [rbp - 0x38]
call fcn.1400082dc
jmp 0x14004f69b
mov ecx, 0x80070057
call fcn.1400312f0
nop
jmp 0x14004fb4e
nop
mov ecx, 0x80004005
call fcn.1400312f0
nop
jmp 0x14004fb5c
nop
mov ecx, 0x80004005
call fcn.1400312f0
int3