Function at 0x140026a2d
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push r15
mov rax, 0xc
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140026a4b
sub rsp, 0x28
call fcn.14004bec0
mov rcx, qword [rsp + 0xc8]
call fcn.14002d704
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.14004bf30
add rsp, 0x10
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.14004bf30
add rsp, 0x10
mov dword [0x140104001], 0x30001c5
mov dword [0x140104001], 0x30001c6
mov qword [rsp + 0x48], 0x20019
mov dword [0x140104001], 0x30001c9
cmp qword [rsp + 0xb8], 0
je 0x140026af3
mov dword [0x140104001], 0x30001c9
mov r15, qword [rsp + 0x48]
or r15, 0x200
mov qword [rsp + 0x48], r15
mov dword [0x140104001], 0x30001c9
mov dword [0x140104001], 0x30001c9
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
push 1
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400494e0
add rsp, 0x28
call fcn.14004bca0
movabs rcx, 0x140104686
pop rdx
push rcx
mov rcx, rdx
sub rsp, 0x20
call fcn.14004bcd0
add rsp, 0x20
pop rcx
mov rdx, rax
call fcn.14004bc40
or rax, rax
je 0x140026be2
mov dword [0x140104001], 0x30001c9
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.1400494c0
add rsp, 0x28
mov r15, rax
dec r15
mov rax, r15
push rax
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140049160
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.14004bb60
mov dword [0x140104001], 0x30001c9
mov dword [0x140104001], 0x30001c9
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
push 1
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140049160
add rsp, 0x28
call fcn.14004bca0
movabs rcx, 0x140104686
pop rdx
push rcx
mov rcx, rdx
sub rsp, 0x20
call fcn.14004bcd0
add rsp, 0x20
pop rcx
mov rdx, rax
call fcn.14004bc40
or rax, rax
je 0x140026cd1
mov dword [0x140104001], 0x30001c9
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.1400494c0
add rsp, 0x28
mov r15, rax
dec r15
mov rax, r15
push rax
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400494e0
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.14004bb60
mov dword [0x140104001], 0x30001c9
mov dword [0x140104001], 0x30001c9
mov r15, qword [rsp + 0xc0]
and r15, r15
je 0x140026d1c
mov dword [0x140104001], 0x30001c9
movabs rax, 0x140108560
push rax
push 0x30
push qword [rsp + 0xd0]
pop rcx
pop rdx
pop r8
call fcn.14004a6a0
mov dword [0x140104001], 0x30001c9
mov dword [0x140104001], 0x30001c9
sub rsp, 8
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push qword [rsp + 0x58]
push 0
push qword [rsp + 0x48]
push qword [rsp + 0xc8]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegOpenKeyExW
add rsp, 0x30
mov qword [rsp + 0x38], rax
mov dword [0x140104001], 0x30001c9
cmp qword [rsp + 0x38], 0
je 0x140026e79
mov dword [0x140104001], 0x30001c9
mov r15, qword [rsp + 0xc0]
and r15, r15
je 0x140026dfe
mov dword [0x140104001], 0x30001c9
push qword [rsp + 0x38]
mov rbp, qword [rsp + 0xc8]
pop rax
mov dword [rbp + 8], eax
mov dword [0x140104001], 0x30001c9
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14004baa0
add rsp, 0x20
pop rcx
push rax
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.140028060
add rsp, 0x28
mov rbp, qword [rsp + 0xc8]
lea rcx, [rbp + 0xc]
pop rdx
call fcn.14004bb60
mov dword [0x140104001], 0x30001c9
mov dword [0x140104001], 0x30001c9
cmp qword [rsp + 0x50], 0
je 0x140026e2e
mov dword [0x140104001], 0x30001c9
push qword [rsp + 0x50]
pop rcx
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [0x140104001], 0x30001c9
mov dword [0x140104001], 0x30001c9
movabs rcx, 0x140104286
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14004baf0
add rsp, 0x28
pop rax
push rax
call fcn.14004be10
pop rdx
add rax, rdx
jmp 0x14002801d
mov dword [0x140104001], 0x30001c9
mov dword [0x140104001], 0x30001cb
lea rax, [rsp + 0x68]
mov rax, rax
push rax
push 0
push 0
push 0
push qword [rsp + 0x50]
push qword [rsp + 0x78]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegQueryValueExW
add rsp, 0x30
mov qword [rsp + 0x38], rax
mov dword [0x140104001], 0x30001cc
cmp qword [rsp + 0x38], 0
je 0x140026fb9
mov dword [0x140104001], 0x30001cd
mov r15, qword [rsp + 0xc0]
and r15, r15
je 0x140026f5a
mov dword [0x140104001], 0x30001ce
push qword [rsp + 0x38]
mov rbp, qword [rsp + 0xc8]
pop rax
mov dword [rbp + 8], eax
mov dword [0x140104001], 0x30001cf
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14004baa0
add rsp, 0x20
pop rcx
push rax
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.140028060
add rsp, 0x28
mov rbp, qword [rsp + 0xc8]
lea rcx, [rbp + 0xc]
pop rdx
call fcn.14004bb60
mov dword [0x140104001], 0x30001d0
mov dword [0x140104001], 0x30001d2
push qword [rsp + 0x50]
pop rcx
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [0x140104001], 0x30001d3
movabs rcx, 0x140104286
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14004baf0
add rsp, 0x28
pop rax
push rax
call fcn.14004be10
pop rdx
add rax, rdx
jmp 0x14002801d
mov dword [0x140104001], 0x30001d4
mov dword [0x140104001], 0x30001d6
cmp dword [rsp + 0x68], 0
je 0x1400270cc
mov dword [0x140104001], 0x30001d7
movsxd rax, dword [rsp + 0x68]
mov rax, rax
push rax
pop rcx
call fcn.14004a430
mov qword [rsp + 0x60], rax
mov dword [0x140104001], 0x30001d8
mov r15, qword [rsp + 0x60]
and r15, r15
jne 0x1400270c2
mov dword [0x140104001], 0x30001d9
mov r15, qword [rsp + 0xc0]
and r15, r15
je 0x140027063
mov dword [0x140104001], 0x30001da
mov rbp, qword [rsp + 0xc0]
mov dword [rbp + 8], 0xffffffff
mov dword [0x140104001], 0x30001db
mov rbp, qword [rsp + 0xc0]
movabs rdx, str.Error:_Cant_allocate_memory
lea rcx, [rbp + 0xc]
call fcn.14004bd20
mov dword [0x140104001], 0x30001dc
mov dword [0x140104001], 0x30001de
push qword [rsp + 0x50]
pop rcx
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [0x140104001], 0x30001df
movabs rcx, 0x140104286
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14004baf0
add rsp, 0x28
pop rax
push rax
call fcn.14004be10
pop rdx
add rax, rdx
jmp 0x14002801d
mov dword [0x140104001], 0x30001e0
mov dword [0x140104001], 0x30001e1
mov dword [0x140104001], 0x30001e3
lea rax, [rsp + 0x68]
mov rax, rax
push rax
push qword [rsp + 0x68]
lea rax, [rsp + 0x68]
mov rax, rax
push rax
push 0
push qword [rsp + 0x50]
push qword [rsp + 0x78]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegQueryValueExW
add rsp, 0x30
mov qword [rsp + 0x38], rax
mov dword [0x140104001], 0x30001e4
push qword [rsp + 0x50]
pop rcx
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [0x140104001], 0x30001e5
cmp qword [rsp + 0x38], 0
je 0x140027223
mov dword [0x140104001], 0x30001e6
mov r15, qword [rsp + 0xc0]
and r15, r15
je 0x1400271c4
mov dword [0x140104001], 0x30001e7
push qword [rsp + 0x38]
mov rbp, qword [rsp + 0xc8]
pop rax
mov dword [rbp + 8], eax
mov dword [0x140104001], 0x30001e8
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14004baa0
add rsp, 0x20
pop rcx
push rax
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.140028060
add rsp, 0x28
mov rbp, qword [rsp + 0xc8]
lea rcx, [rbp + 0xc]
pop rdx
call fcn.14004bb60
mov dword [0x140104001], 0x30001e9
mov dword [0x140104001], 0x30001eb
push qword [rsp + 0x60]
pop rcx
call fcn.14004a640
mov dword [0x140104001], 0x30001ec
movabs rcx, 0x140104286
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14004baf0
add rsp, 0x28
pop rax
push rax
call fcn.14004be10
pop rdx
add rax, rdx
jmp 0x14002801d
mov dword [0x140104001], 0x30001ed
mov dword [0x140104001], 0x30001ef
mov r15, qword [rsp + 0xc0]
and r15, r15
je 0x140027260
mov dword [0x140104001], 0x30001f0
movsxd rax, dword [rsp + 0x58]
push rax
mov rbp, qword [rsp + 0xc8]
pop rax
mov dword [rbp], eax
mov dword [0x140104001], 0x30001f1
mov dword [0x140104001], 0x30001f3
movsxd rax, dword [rsp + 0x58]
push rax
mov dword [0x140104001], 0x30001f4
mov r15, 3
cmp r15, qword [rsp]
jne 0x1400276db
mov dword [0x140104001], 0x30001f5
movsxd r15, dword [rsp + 0x70]
cmp r15, 0x830
jg 0x14002742c
mov dword [0x140104001], 0x30001f6
mov qword [rsp + 0x88], 0
jmp 0x1400272d3
mov dword [0x140104001], 0x30001f6
movsxd r15, dword [rsp + 0x70]
dec r15
cmp r15, qword [rsp + 0x88]
jl 0x14002741d
mov dword [0x140104001], 0x30001f7
mov rcx, qword [rsp + 0x48]
push rcx
sub rsp, 0x20
call fcn.14004baa0
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14004baf0
add rsp, 0x20
movabs rcx, 0x14010442c
sub rsp, 0x20
call fcn.14004baf0
add rsp, 0x20
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
movabs rax, 0x1401044ec
push rax
push 2
push rcx
sub rsp, 0x20
call fcn.14004baa0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov r15, qword [rsp + 0xb0]
add r15, qword [rsp + 0xd0]
mov rax, r15
push rax
pop rcx
sub rsp, 0x20
call fcn.14004a6b0
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140049790
add rsp, 0x20
push rax
call fcn.14004be40
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140049eb0
add rsp, 0x28
pop rax
movabs rcx, str._._01
sub rsp, 0x20
call fcn.14004baf0
add rsp, 0x20
lea rcx, [rsp + 0x50]
pop rdx
sub rsp, 0x28
call fcn.14004bb60
add rsp, 0x28
mov dword [0x140104001], 0x30001f8
inc qword [rsp + 0x88]
jno 0x1400272c9
mov dword [0x140104001], 0x30001f9
jmp 0x1400275a1
mov dword [0x140104001], 0x30001f9
mov dword [0x140104001], 0x30001fa
mov qword [rsp + 0x88], 0
jmp 0x140027458
mov dword [0x140104001], 0x30001fa
mov rax, 0x82f
cmp rax, qword [rsp + 0x88]
jl 0x1400275a1
mov dword [0x140104001], 0x30001fb
mov rcx, qword [rsp + 0x48]
push rcx
sub rsp, 0x20
call fcn.14004baa0
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14004baf0
add rsp, 0x20
movabs rcx, 0x14010442c
sub rsp, 0x20
call fcn.14004baf0
add rsp, 0x20
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
movabs rax, 0x1401044ec
push rax
push 2
push rcx
sub rsp, 0x20
call fcn.14004baa0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov r15, qword [rsp + 0xb0]
add r15, qword [rsp + 0xd0]
mov rax, r15
push rax
pop rcx
sub rsp, 0x20
call fcn.14004a6b0
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140049790
add rsp, 0x20
push rax
call fcn.14004be40
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140049eb0
add rsp, 0x28
pop rax
movabs rcx, str._._01
sub rsp, 0x20
call fcn.14004baf0
add rsp, 0x20
lea rcx, [rsp + 0x50]
pop rdx
sub rsp, 0x28
call fcn.14004bb60
add rsp, 0x28
mov dword [0x140104001], 0x30001fc
inc qword [rsp + 0x88]
jno 0x14002744e
mov dword [0x140104001], 0x30001fd
mov dword [0x140104001], 0x30001fe
push rcx
sub rsp, 0x20
call fcn.14004baa0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14004baa0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push qword [rsp + 0x60]
pop rcx
sub rsp, 0x20
call fcn.1400494c0
invalid
invalid
invalid