Function at 0x140024f28
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x378
mov rax, qword [0x140036138]
xor rax, rsp
mov qword [rsp + 0x360], rax
movsxd r13, edx
mov r14, rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], r8
xor ebx, ebx
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0xc8
mov qword [rsp + 0x68], r9
mov dword [rsp + 0x50], r13d
mov esi, ebx
mov byte [r9], bl
call sub.msvcrt.dll_memset
xor eax, eax
movabs rdx, 0x6c00720075
mov dword [rsp + 0x148], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x140], rdx
mov qword [rsp + 0x40], rbx
cmp rax, rbx
je 0x140025091
lea rax, [rsp + 0x40]
lea rdx, [0x140006610]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x140025091
cmp qword [rsp + 0x40], rbx
je 0x140025091
mov edi, ebx
mov rbp, rbx
lea rdx, [rsp + 0x146]
lea ecx, [rdi + 1]
mov r8d, 0xa
mov dword [rsp + 0x3c], 0x20a
call qword [sym.imp.msvcrt.dll__itow]
mov rcx, qword [rsp + 0x40]
lea r11, [rsp + 0x3c]
lea rax, [rsp + 0x150]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], r11
lea rdx, [rsp + 0x140]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x14002504c
cmp eax, 0xea
jne 0x140025082
jmp 0x140025073
cmp dword [rsp + 0x38], 1
jne 0x140025082
mov edx, dword [rsp + 0x3c]
cmp edx, 2
jbe 0x140025073
shr edx, 1
lea rcx, [rsp + 0x150]
dec edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + rbp*8 + 0x70], rax
inc rbp
inc edi
cmp rbp, 0x19
jl 0x140024fee
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jge 0x140025093
mov edi, ebx
lea r12d, [r13 + rdi]
mov dword [rsp + 0x3c], r12d
cmp r12d, ebx
je 0x140025746
cmp r13d, ebx
je 0x1400250ba
cmp r14, rbx
jne 0x1400250ba
mov esi, 0x80070057
jmp 0x140025746
mov r15d, r12d
imul r15d, r15d, 0x5a
inc r15d
mov dword [rsp + 0x34], r15d
cmp r12d, r15d
jae 0x1400250b0
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov r14, rax
mov qword [rsp + 0x48], rax
cmp rax, rbx
jne 0x1400250f0
mov esi, 0x8007000e
jmp 0x140025736
mov ebp, ebx
mov dword [rsp + 0x30], ebx
mov ecx, ebx
mov dword [rsp + 0x38], ebx
mov rdx, rbx
mov qword [rsp + 0x140], rbx
mov rdi, r13
mov qword [rsp + 0x40], r13
cmp r12d, ebx
jbe 0x140025736
cmp ecx, r13d
jae 0x140025128
mov rax, qword [rsp + 0x58]
mov r12, qword [rax + rdx*8]
jmp 0x140025133
mov rax, rdx
sub rax, rdi
mov r12, qword [rsp + rax*8 + 0x70]
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov r13d, eax
cmp eax, ebx
je 0x1400256dc
jmp 0x140025155
cmp r13d, ebx
jle 0x140025164
add r12, 2
dec r13d
movzx ecx, word [r12]
call qword [sym.imp.msvcrt.dll_iswspace]
cmp eax, ebx
jne 0x140025149
movsxd rdi, r13d
movzx ecx, word [r12 + rdi*2 - 2]
call qword [sym.imp.msvcrt.dll_iswspace]
cmp eax, ebx
je 0x14002519d
lea rbp, [r12 + rdi*2 - 2]
cmp rdi, rbx
jle 0x140025199
sub rbp, 2
dec r13d
dec rdi
movzx ecx, word [rbp]
call qword [sym.imp.msvcrt.dll_iswspace]
cmp eax, ebx
jne 0x14002517c
mov ebp, dword [rsp + 0x30]
cmp r13d, ebx
je 0x1400256d7
cmp r13d, 0x100
jg 0x1400256d7
inc r13d
mov edi, 0x7fffffff
cmp r13d, edi
ja 0x1400251f6
mov r9d, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x3c]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov edx, ebp
mov ecx, r13d
mov qword [rsp + 0x20], rax
call fcn.140024c58
mov r15d, dword [rsp + 0x34]
mov r14, qword [rsp + 0x48]
mov esi, eax
jmp 0x1400251fb
mov esi, 0x80004005
cmp esi, ebx
jne 0x140025736
lea eax, [r13 - 1]
mov edx, r15d
mov esi, ebx
movsxd r8, eax
mov eax, ebp
sub edx, ebp
lea rcx, [r14 + rax*2]
cmp rdx, rbx
je 0x140025221
cmp rdx, rdi
jbe 0x140025226
mov esi, 0x80070057
cmp esi, ebx
jl 0x140025736
cmp r8, 0x7ffffffe
jbe 0x14002523e
mov esi, 0x80070057
jmp 0x14002527b
mov esi, ebx
cmp rdx, rbx
je 0x140025272
mov rdi, r12
sub r8, rdx
sub rdi, rcx
lea rax, [r8 + rdx]
cmp rax, rbx
je 0x14002526d
movzx eax, word [rdi + rcx]
cmp ax, bx
je 0x14002526d
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14002524e
cmp rdx, rbx
jne 0x14002527b
sub rcx, 2
mov esi, 0x8007007a
cmp esi, ebx
mov word [rcx], bx
jl 0x140025736
or rcx, 0xffffffffffffffff
add ebp, r13d
lea rdi, str.file:___
lea eax, [rbp - 1]
mov rdx, r12
mov dword [rsp + 0x30], ebp
mov word [r14 + rax*2], bx
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, str.file:___
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, ebx
jne 0x1400253d7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, str.file:___
repne scasw ax, word [rdi]
not rcx
dec rcx
sub r13d, ecx
cmp r13d, 2
lea rbp, [r12 + rcx*2]
jl 0x1400256d3
mov r12d, dword [rsp + 0x30]
cmp r13d, 0x7fffffff
ja 0x140025330
mov r9d, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x3c]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov edx, r12d
mov ecx, r13d
mov qword [rsp + 0x20], rax
call fcn.140024c58
mov r15d, dword [rsp + 0x34]
mov r14, qword [rsp + 0x48]
mov esi, eax
jmp 0x140025335
mov esi, 0x80004005
cmp esi, ebx
jne 0x140025736
mov edx, r15d
mov eax, r12d
movsxd rdi, r13d
sub edx, r12d
lea rcx, [r14 + rax*2]
mov esi, ebx
cmp rdx, rbx
je 0x14002535d
cmp rdx, 0x7fffffff
jbe 0x140025362
mov esi, 0x80070057
cmp esi, ebx
jl 0x140025736
cmp rdi, 0x7ffffffe
jbe 0x14002537a
mov esi, 0x80070057
jmp 0x1400253b4
mov esi, ebx
cmp rdx, rbx
je 0x1400253ab
sub rdi, rdx
sub rbp, rcx
lea rax, [rdi + rdx]
cmp rax, rbx
je 0x1400253a6
movzx eax, word [rcx + rbp]
cmp ax, bx
je 0x1400253a6
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140025387
cmp rdx, rbx
jne 0x1400253b4
sub rcx, 2
mov esi, 0x8007007a
cmp esi, ebx
mov word [rcx], bx
jl 0x140025736
mov ebp, dword [rsp + 0x30]
add ebp, r13d
mov dword [rsp + 0x30], ebp
lea eax, [rbp - 1]
mov word [r14 + rax*2], bx
jmp 0x1400256d7
lea rdx, [0x140006670]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
jne 0x1400256d7
mov r14, r12
mov rbp, rbx
lea rdi, [0x1400361b0]
mov rdi, qword [rdi + rbp*8]
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
lea rdi, [0x1400361b0]
mov rdx, r12
not rcx
lea r8, [rcx - 1]
mov rcx, qword [rdi + rbp*8]
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, ebx
je 0x1400254f7
inc rbp
cmp rbp, 6
jl 0x1400253fd
mov ebp, dword [rsp + 0x30]
mov r14, qword [rsp + 0x48]
mov edx, 0x2f
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcschr]
mov rdi, rax
cmp rax, rbx
jne 0x14002545d
movsxd rax, r13d
lea rdi, [r12 + rax*2 - 2]
mov eax, 0x2e
cmp r12, rdi
jae 0x140025473
sub rdi, 2
cmp ax, word [rdi]
jne 0x140025462
cmp r12, rdi
je 0x1400256d7
mov edx, eax
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbx
je 0x1400256d7
lea rbp, [rax + 2]
cmp rbp, rdi
jae 0x1400256d3
mov rax, rbp
sub rax, r12
sar rax, 1
sub r13d, eax
cmp r13d, 2
jl 0x1400256d3
mov r12d, dword [rsp + 0x30]
cmp r13d, 0x7fffffff
ja 0x140025608
mov r9d, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x3c]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov edx, r12d
mov ecx, r13d
mov qword [rsp + 0x20], rax
call fcn.140024c58
mov r15d, dword [rsp + 0x34]
mov esi, eax
jmp 0x14002560d
mov rdi, qword [rdi + rbp*8]
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
dec rcx
sub r13d, ecx
lea r12, [r12 + rcx*2]
cmp r14, r12
je 0x140025436
cmp r13d, 2
jl 0x1400256ce
mov ebp, dword [rsp + 0x30]
mov edi, 0x7fffffff
cmp r13d, edi
ja 0x140025563
mov r9d, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x3c]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov edx, ebp
mov ecx, r13d
mov qword [rsp + 0x20], rax
call fcn.140024c58
mov r15d, dword [rsp + 0x34]
mov esi, eax
jmp 0x140025568
mov esi, 0x80004005
cmp esi, ebx
jne 0x140025736
mov r14, qword [rsp + 0x48]
mov edx, r15d
mov eax, ebp
sub edx, ebp
movsxd r8, r13d
mov esi, ebx
lea rcx, [r14 + rax*2]
cmp rdx, rbx
je 0x14002558f
cmp rdx, rdi
jbe 0x140025594
mov esi, 0x80070057
cmp esi, ebx
jl 0x140025736
cmp r8, 0x7ffffffe
jbe 0x1400255ac
mov esi, 0x80070057
jmp 0x1400255e9
mov esi, ebx
cmp rdx, rbx
je 0x1400255e0
mov rdi, r12
sub r8, rdx
sub rdi, rcx
lea rax, [r8 + rdx]
cmp rax, rbx
je 0x1400255db
movzx eax, word [rdi + rcx]
cmp ax, bx
je 0x1400255db
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400255bc
cmp rdx, rbx
jne 0x1400255e9
sub rcx, 2
mov esi, 0x8007007a
cmp esi, ebx
mov word [rcx], bx
jl 0x140025736
add ebp, r13d
mov dword [rsp + 0x30], ebp
lea eax, [rbp - 1]
mov word [r14 + rax*2], bx
jmp 0x14002543f
mov esi, 0x80004005
cmp esi, ebx
jne 0x140025736
mov r14, qword [rsp + 0x48]
mov edx, r15d
mov eax, r12d
sub edx, r12d
movsxd r9, r13d
mov esi, ebx
lea rcx, [r14 + rax*2]
cmp rdx, rbx
je 0x14002563a
cmp rdx, 0x7fffffff
jbe 0x14002563f
mov esi, 0x80070057
cmp esi, ebx
jl 0x140025736
cmp r9, 0x7ffffffe
jbe 0x140025657
mov esi, 0x80070057
jmp 0x140025695
mov esi, ebx
cmp rdx, rbx
je 0x14002568c
mov r8, rbp
sub r9, rdx
sub r8, rcx
lea rax, [r9 + rdx]
cmp rax, rbx
je 0x140025687
movzx eax, word [r8 + rcx]
cmp ax, bx
je 0x140025687
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140025667
cmp rdx, rbx
jne 0x140025695
sub rcx, 2
mov esi, 0x8007007a
cmp esi, ebx
mov word [rcx], bx
jl 0x140025736
add r12d, r13d
mov edx, 0x2e
mov rcx, rbp
lea eax, [r12 - 1]
mov dword [rsp + 0x30], r12d
mov r12, rbp
mov word [r14 + rax*2], bx
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbx
jne 0x14002548d
jmp 0x1400256d3
mov r14, qword [rsp + 0x48]
mov ebp, dword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x140]
mov r13d, dword [rsp + 0x50]
inc ecx
inc rdx
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x140], rdx
cmp ecx, dword [rsp + 0x3c]
jb 0x140025118
cmp ebp, ebx
je 0x140025736
mov rax, qword [rsp + 0x68]
mov edx, ebp
mov rcx, r14
mov byte [rax], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov ecx, esi
mov esi, 0x8007000e
cmp rax, rbx
cmove ecx, esi
mov esi, ecx
mov rcx, qword [rsp + 0x48]
cmp rcx, rbx
je 0x140025746
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + rbx*8 + 0x70]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
inc rbx
cmp rbx, 0x19
jl 0x140025746
mov eax, esi
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.140029f80
add rsp, 0x378
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret