Function at 0x140013050
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x300]
sub rsp, 0x400
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x450], rbx
mov rax, qword [0x1400bc190]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
mov r14, rdx
mov rsi, rcx
mov qword [rbp - 0x18], 0xf
xor r15d, r15d
mov qword [rbp - 0x20], r15
mov byte [rbp - 0x30], r15b
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], r15
mov byte [rbp - 0x58], r15b
mov qword [rbp + 0x10], 0xf
mov qword [rbp + 8], r15
mov byte [rbp - 8], r15b
xor edx, edx
lea r8d, [r15 + 1]
call fcn.140014600
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140013970
test rax, rax
je 0x140013970
mov r9, rax
xor r8d, r8d
lea rdx, [rbp + 0xc0]
mov rcx, rsi
call fcn.140009520
mov rbx, rax
lea rax, [rbp - 8]
cmp rax, rbx
je 0x14001316d
cmp qword [rbp + 0x10], 0x10
jb 0x140013118
mov rcx, qword [rbp - 8]
call fcn.140058288
mov qword [rbp + 0x10], 0xf
mov qword [rbp + 8], r15
mov byte [rbp - 8], 0
cmp qword [rbx + 0x18], 0x10
jae 0x140013144
mov r8, qword [rbx + 0x10]
inc r8
mov rdx, rbx
lea rcx, [rbp - 8]
call fcn.140057d50
jmp 0x14001314e
mov rax, qword [rbx]
mov qword [rbp - 8], rax
mov qword [rbx], r15
mov rax, qword [rbx + 0x10]
mov qword [rbp + 8], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp + 0x10], rax
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], r15
mov byte [rbx], 0
cmp qword [rbp + 0xd8], 0x10
jb 0x140013183
mov rcx, qword [rbp + 0xc0]
call fcn.140058288
lea rcx, [rbp - 8]
call fcn.140012d90
mov r13, rax
lea rbx, [rdi + 1]
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call fcn.140014600
mov rdi, rax
or r12, 0xffffffffffffffff
cmp rax, r12
je 0x14001331a
cmp rbx, rdi
jae 0x14001331a
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rcx, qword [rbp - 0x30]
xor r8d, r8d
lea rdx, [0x14009b802]
call fcn.14005fe80
movsxd rcx, eax
test eax, eax
jne 0x1400131ed
mov eax, r15d
cmp qword [rbp - 0x20], rax
setne al
mov ecx, eax
test ecx, ecx
sete al
test al, al
sete al
mov r9, rdi
mov r8, rbx
mov rcx, rsi
sub r9, rbx
test al, al
je 0x14001326e
lea rdx, [rbp + 0xe8]
call fcn.140009520
nop
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.140015b00
nop
mov r9, r12
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.1400066e0
nop
cmp qword [rbp + 0x38], 0x10
jb 0x140013244
mov rcx, qword [rbp + 0x20]
call fcn.140058288
mov qword [rbp + 0x38], 0xf
mov qword [rbp + 0x30], r15
mov byte [rbp + 0x20], 0
cmp qword [rbp + 0x100], 0x10
jb 0x1400132f8
mov rcx, qword [rbp + 0xe8]
jmp 0x1400132f3
lea rdx, [rbp + 0x48]
call fcn.140009520
mov rbx, rax
lea rax, [rbp - 0x30]
cmp rax, rbx
je 0x1400132e8
cmp qword [rbp - 0x18], 0x10
jb 0x140013293
mov rcx, qword [rbp - 0x30]
call fcn.140058288
mov qword [rbp - 0x18], 0xf
mov qword [rbp - 0x20], r15
mov byte [rbp - 0x30], 0
cmp qword [rbx + 0x18], 0x10
jae 0x1400132bf
mov r8, qword [rbx + 0x10]
inc r8
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.140057d50
jmp 0x1400132c9
mov rax, qword [rbx]
mov qword [rbp - 0x30], rax
mov qword [rbx], r15
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x20], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp - 0x18], rax
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], r15
mov byte [rbx], 0
cmp qword [rbp + 0x60], 0x10
jb 0x1400132f8
mov rcx, qword [rbp + 0x48]
call fcn.140058288
lea rbx, [rdi + 1]
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call fcn.140014600
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400131b4
mov r9, qword [rsi + 0x10]
mov r8, rbx
lea rdx, [rbp + 0x70]
mov rcx, rsi
call fcn.140009520
mov rbx, rax
lea rax, [rbp - 0x58]
cmp rax, rbx
je 0x14001339e
cmp qword [rbp - 0x40], 0x10
jb 0x140013349
mov rcx, qword [rbp - 0x58]
call fcn.140058288
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], r15
mov byte [rbp - 0x58], 0
cmp qword [rbx + 0x18], 0x10
jae 0x140013375
mov r8, qword [rbx + 0x10]
inc r8
mov rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.140057d50
jmp 0x14001337f
mov rax, qword [rbx]
mov qword [rbp - 0x58], rax
mov qword [rbx], r15
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x48], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp - 0x40], rax
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], r15
mov byte [rbx], 0
cmp qword [rbp + 0x88], 0x10
jb 0x1400133b1
mov rcx, qword [rbp + 0x70]
call fcn.140058288
lea rdi, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdi, qword [rbp - 0x30]
mov ecx, 0x18
call fcn.140058324
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400133ee
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
mov rcx, rdi
call fcn.1400575c0
mov qword [rbx], rax
jmp 0x1400133f1
mov rbx, r15
test rbx, rbx
jne 0x140013401
mov ecx, 0x8007000e
call fcn.140057860
int3
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
setne dil
mov eax, r12d
lock xadd dword [rbx + 0x10], eax
dec eax
jne 0x140013456
mov rcx, qword [rbx]
test rcx, rcx
je 0x140013440
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001344e
call fcn.140058280
mov rcx, rbx
call fcn.140058288
test dil, dil
je 0x1400135b7
lea rdi, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdi, qword [rbp - 0x30]
mov ecx, 0x18
call fcn.140058324
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001349c
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
mov rcx, rdi
call fcn.1400575c0
mov qword [rbx], rax
jmp 0x14001349f
mov rbx, r15
test rbx, rbx
jne 0x1400134af
mov ecx, 0x8007000e
call fcn.140057860
int3
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
setne dil
mov eax, r12d
lock xadd dword [rbx + 0x10], eax
dec eax
jne 0x140013504
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400134ee
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400134fc
call fcn.140058280
mov rcx, rbx
call fcn.140058288
test dil, dil
je 0x1400135b7
lea rdx, str.iusl::WindowsRegistry::GetValueString
lea rcx, [rbp + 0x110]
call fcn.140011fd0
nop
mov dword [rax + 0x5c], 1
lea rdx, str._DBG___N_A_
mov rcx, rax
call fcn.140001cf0
mov rcx, rax
lea rdx, str.Key__
call fcn.140001cf0
mov rbx, rax
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.140001da0
lea rdx, str.__not_found.
mov rcx, rbx
call fcn.140001cf0
nop
lea rcx, [rbp + 0x110]
call fcn.140001b60
nop
cmp qword [rbp + 0x10], 0x10
jb 0x140013582
mov rcx, qword [rbp - 8]
call fcn.140058288
mov qword [rbp + 0x10], 0xf
mov qword [rbp + 8], r15
mov byte [rbp - 8], 0
cmp qword [rbp - 0x40], 0x10
jb 0x1400135a2
mov rcx, qword [rbp - 0x58]
call fcn.140058288
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], r15
mov byte [rbp - 0x58], 0
jmp 0x140013a17
mov r13, qword [rsp + 0x40]
lea rdi, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdi, qword [rbp - 0x58]
mov ecx, 0x18
call fcn.140058324
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400135f9
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
mov rcx, rdi
call fcn.1400575c0
mov qword [rbx], rax
jmp 0x1400135fc
mov rbx, r15
test rbx, rbx
jne 0x14001360c
mov ecx, 0x8007000e
call fcn.140057860
int3
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
dec ecx
jne 0x140013661
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001364b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140013659
call fcn.140058280
mov rcx, rbx
call fcn.140058288
test esi, esi
jne 0x14001388b
mov ecx, dword [rsp + 0x38]
call fcn.1400589d4
mov rdi, rax
test rax, rax
jne 0x140013719
lea rdx, str.iusl::WindowsRegistry::GetValueString
lea rcx, [rbp + 0x230]
call fcn.140011fd0
nop
mov dword [rax + 0x5c], 3
lea rdx, str._ERR___N_A_
mov rcx, rax
call fcn.140001cf0
mov rcx, rax
lea rdx, str.Malloc_failed_
call fcn.140001cf0
mov rcx, rax
lea rdx, str.Value__
call fcn.140001cf0
mov rbx, rax
lea rdx, [rbp - 0x58]
mov rcx, rax
call fcn.140001da0
lea rdx, str.__from_key__
mov rcx, rbx
call fcn.140001cf0
mov rbx, rax
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.140001da0
lea rdx, str.__not_read.
mov rcx, rbx
call fcn.140001cf0
nop
lea rcx, [rbp + 0x230]
call fcn.140001b60
mov esi, 0xea
jmp 0x14001390d
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
lea rcx, [rsp + 0x48]
call fcn.140011910
mov rdx, qword [rax]
test rdx, rdx
je 0x14001373e
mov rdx, qword [rdx]
jmp 0x140013741
mov rdx, r15
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x1400137a1
lock xadd dword [rbx + 0x10], r12d
dec r12d
jne 0x1400137a1
test rbx, rbx
je 0x1400137a1
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001378b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140013799
call fcn.140058280
mov rcx, rbx
call fcn.140058288
mov rdx, rdi
lea rcx, [rbp - 0x80]
call fcn.140004400
mov rdx, rax
lea rcx, [rbp + 0x98]
call fcn.140011a80
nop
mov rdx, rax
mov rcx, r14
call fcn.140004f10
nop
cmp qword [rbp + 0xb0], 0x10
jb 0x1400137df
mov rcx, qword [rbp + 0x98]
call fcn.140058288
lea rdx, str.iusl::WindowsRegistry::GetValueString
lea rcx, [rbp + 0x170]
call fcn.140011fd0
nop
mov dword [rax + 0x5c], 1
lea rdx, str._DBG___N_A_
mov rcx, rax
call fcn.140001cf0
mov rcx, rax
lea rdx, str.Value__
call fcn.140001cf0
mov rbx, rax
lea rdx, [rbp - 0x58]
mov rcx, rax
call fcn.140001da0
lea rdx, str.__from_key__
mov rcx, rbx
call fcn.140001cf0
mov rbx, rax
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.140001da0
lea rdx, str.__read_successfully._Value_
mov rcx, rbx
call fcn.140001cf0
mov rbx, rax
mov rdx, r14
mov rcx, rax
call fcn.140001da0
lea rdx, [0x14009d098]
mov rcx, rbx
call fcn.140001cf0
nop
lea rcx, [rbp + 0x170]
call fcn.140001b60
mov rcx, rdi
call fcn.140058084
jmp 0x14001390d
lea rdx, str.iusl::WindowsRegistry::GetValueString
lea rcx, [rbp + 0x1d0]
call fcn.140011fd0
nop
mov dword [rax + 0x5c], 1
lea rdx, str._DBG___N_A_
mov rcx, rax
call fcn.140001cf0
mov rcx, rax
lea rdx, str.Value__
call fcn.140001cf0
mov rbx, rax
lea rdx, [rbp - 0x58]
mov rcx, rax
call fcn.140001da0
lea rdx, str.__from_key__
mov rcx, rbx
call fcn.140001cf0
mov rbx, rax
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.140001da0
lea rdx, str.__not_read.
mov rcx, rbx
call fcn.140001cf0
nop
lea rcx, [rbp + 0x1d0]
call fcn.140001b60
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ebx, si
cmp qword [rbp + 0x10], 0x10
jb 0x140013929
mov rcx, qword [rbp - 8]
call fcn.140058288
mov qword [rbp + 0x10], 0xf
mov qword [rbp + 8], r15
mov byte [rbp - 8], 0
cmp qword [rbp - 0x40], 0x10
jb 0x140013949
mov rcx, qword [rbp - 0x58]
call fcn.140058288
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], r15
mov byte [rbp - 0x58], 0
cmp qword [rbp - 0x18], 0x10
jb 0x140013969
mov rcx, qword [rbp - 0x30]
call fcn.140058288
mov eax, ebx
jmp 0x140013a2c
mov dword [rsp + 0x50], 0xdf
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rdx, str.iusl::WindowsRegistry::GetValueString
lea rcx, [rbp + 0x290]
call fcn.140011fd0
nop
mov dword [rax + 0x5c], 3
lea rdx, str._ERR___N_A_
mov rcx, rax
call fcn.140001cf0
mov rcx, rax
lea rdx, [rsp + 0x50]
call fcn.140012200
nop
lea rcx, [rbp + 0x290]
call fcn.140001b60
nop
lea rcx, [rsp + 0x58]
call fcn.14000cb40
nop
cmp qword [rbp + 0x10], 0x10
jb 0x1400139e7
mov rcx, qword [rbp - 8]
call fcn.140058288
mov qword [rbp + 0x10], 0xf
mov qword [rbp + 8], r15
mov byte [rbp - 8], 0
cmp qword [rbp - 0x40], 0x10
jb 0x140013a07
mov rcx, qword [rbp - 0x58]
call fcn.140058288
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], r15
mov byte [rbp - 0x58], 0
cmp qword [rbp - 0x18], 0x10
jb 0x140013a27
mov rcx, qword [rbp - 0x30]
call fcn.140058288
mov eax, 5
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.1400579a0
mov rbx, qword [rsp + 0x450]
add rsp, 0x400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret