Function at 0x140035404
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0x90
mov r15, r8
mov r12, rcx
lea rbx, section..data
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x140035467
test byte [rcx + 0x1c], 1
je 0x140035467
cmp byte [rcx + 0x19], 5
jb 0x140035467
mov eax, dword [r8 + 0x10]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.1400a0b50
and qword [rbp - 0x41], 0
and dword [rbp - 0x39], 0
and dword [rbp - 0x35], 0
lea rdx, [rbp - 0x41]
mov rcx, r12
call fcn.140035ea4
mov esi, eax
mov r10, qword [section..data]
cmp r10, rbx
je 0x1400354bb
test byte [r10 + 0x1c], 2
je 0x1400354bb
cmp byte [r10 + 0x19], 4
jb 0x1400354bb
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400afc70]
mov rcx, qword [r10 + 0x10]
call fcn.1400438d8
mov r10, qword [section..data]
and qword [rbp - 9], 0
and dword [rbp - 1], 0
and dword [rbp + 3], 0
test esi, esi
jne 0x1400355bd
mov rax, qword [r12]
movabs r10, 0x8ba916ea3852e270
mov rcx, r12
mov rax, qword [rax + 0x58]
call qword [case.0x140028cb6.0]
test rax, rax
je 0x1400355b6
and qword [rbp + 7], 0
and qword [rbp + 0xf], 0
and qword [rbp + 0x17], 0
mov rax, qword [r12]
movabs r10, 0x8ba916ea3852e270
mov rcx, r12
mov rax, qword [rax + 0x58]
call qword [case.0x140028cb6.0]
mov r8, rax
mov rdx, 0xffffffff80000002
mov r9d, 0x20119
lea rcx, [rbp + 7]
call fcn.140005e00
mov esi, eax
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x140035569
test byte [rcx + 0x1c], 2
je 0x140035569
cmp byte [rcx + 0x19], 4
jb 0x140035569
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400afc70]
mov rcx, qword [rcx + 0x10]
call fcn.1400438d8
test esi, esi
jne 0x1400355ad
lea rdx, [rbp - 9]
lea rcx, [rbp + 7]
call fcn.1400239e8
mov esi, eax
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400355ad
test byte [rcx + 0x1c], 2
je 0x1400355ad
cmp byte [rcx + 0x19], 4
jb 0x1400355ad
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400afc70]
mov rcx, qword [rcx + 0x10]
call fcn.1400438d8
nop
lea rcx, [rbp + 7]
call fcn.140006bec
mov r10, qword [section..data]
xor r14d, r14d
cmp dword [rbp - 0x39], r14d
jle 0x140035af1
xor r13d, r13d
and dword [rbp + 0x77], 0
test r14d, r14d
js 0x140035b9e
lea r8, [rbp + 0x77]
mov rdx, qword [rbp - 0x41]
mov rdx, qword [rdx + r13]
mov rcx, r12
call fcn.140035bf4
mov esi, eax
mov r10, qword [section..data]
cmp r10, rbx
je 0x140035629
test byte [r10 + 0x1c], 2
je 0x140035629
cmp byte [r10 + 0x19], 4
jb 0x140035629
mov edx, SysStringByteLen
mov r9d, eax
lea r8, [0x1400afc70]
mov rcx, qword [r10 + 0x10]
call fcn.1400438d8
mov r10, qword [section..data]
test esi, esi
jne 0x140035682
cmp dword [rbp + 0x77], 1
jne 0x140035682
cmp r10, rbx
je 0x140035ae0
test byte [r10 + 0x1c], 2
je 0x140035ae0
cmp byte [r10 + 0x19], 4
jb 0x140035ae0
mov edx, r14d
lea rcx, [rbp - 0x41]
call fcn.14003a7f0
mov edx, reloc.OLEAUT32.dll_SysStringByteLen
mov r9, qword [rax]
mov rax, qword [section..data]
lea r8, [0x1400afc70]
mov rcx, qword [rax + 0x10]
call fcn.140043490
jmp 0x140035ad9
and dword [rbp - 0x31], 0
cmp r14d, dword [rbp - 0x39]
jge 0x140035b93
lea r9, [rbp - 0x31]
lea r8, str.DefaultAuthorization
mov rdx, qword [rbp - 0x41]
mov rdx, qword [rdx + r13]
mov rcx, r12
call fcn.140005c04
test eax, eax
jne 0x1400356f1
cmp dword [rbp - 0x31], 1
jne 0x1400356f1
mov r10, qword [section..data]
cmp r10, rbx
je 0x140035ae0
test byte [r10 + 0x1c], 2
je 0x140035ae0
cmp byte [r10 + 0x19], 4
jb 0x140035ae0
mov edx, r14d
lea rcx, [rbp - 0x41]
call fcn.14003a7f0
mov edx, 0x95
jmp 0x140035663
cmp r14d, dword [rbp - 0x39]
jge 0x140035b88
movsxd rcx, r14d
mov rax, qword [rbp - 0x41]
lea rdi, [rax + rcx*8]
xor ebx, ebx
mov rax, qword [rbp + 0x67]
cmp ebx, dword [rax + 8]
jge 0x140035773
movsxd rcx, ebx
mov rax, qword [rax]
lea rcx, [rax + rcx*8]
mov rdx, rdi
call fcn.140035bb0
test al, al
jne 0x14003572b
inc ebx
jmp 0x140035708
cmp ebx, 0xffffffff
je 0x140035773
mov r10, qword [section..data]
lea rbx, section..data
cmp r10, rbx
je 0x140035ae0
test byte [r10 + 0x1c], 2
je 0x140035ae0
cmp byte [r10 + 0x19], 4
jb 0x140035ae0
mov edx, r14d
lea rcx, [rbp - 0x41]
call fcn.14003a7f0
mov edx, 0x96
jmp 0x140035663
cmp qword [r15 + 0x10], 0
je 0x14003587a
mov rax, qword [0x1400c9e40]
movabs r10, 0xb1a8ae8f5a5da170
lea rcx, [0x1400c9e40]
mov rax, qword [rax + 0x18]
call qword [case.0x140028cb6.0]
add rax, 0x18
mov qword [rbp - 0x19], rax
cmp r14d, dword [rbp - 0x39]
jge 0x140035b67
lea r9, [rbp - 0x19]
lea r8, str.NetworkInterface
mov rdx, qword [rbp - 0x41]
mov rdx, qword [rdx + r13]
mov rcx, r12
call fcn.140006358
mov rbx, qword [rbp - 0x19]
test eax, eax
jne 0x140035871
cmp dword [rbx - 0x10], eax
je 0x140035871
mov rcx, qword [r15]
test rcx, rcx
je 0x140035813
mov rax, qword [rcx + 0x10]
mov r9, rbx
sub r9, rax
movzx edx, word [rax]
movzx r8d, word [rax + r9]
sub edx, r8d
jne 0x14003580a
add rax, 2
test r8d, r8d
jne 0x1400357f4
test edx, edx
je 0x140035871
mov rcx, qword [rcx]
jmp 0x1400357e5
mov rax, qword [section..data]
lea rcx, section..data
cmp rax, rcx
je 0x140035863
test byte [rax + 0x1c], 2
je 0x140035863
cmp byte [rax + 0x19], 4
jb 0x140035863
mov edx, r14d
lea rcx, [rbp - 0x41]
call fcn.14003a7f0
mov r9, qword [rax]
mov rax, qword [section..data]
mov edx, 0x97
mov qword [rsp + 0x20], rbx
lea r8, [0x1400afc70]
mov rcx, qword [rax + 0x10]
call fcn.140052630
nop
lea rcx, [rbp - 0x19]
call fcn.1400043f0
jmp 0x140035ad2
lea rcx, [rbx - 0x18]
call fcn.14000ccd0
xor edi, edi
cmp edi, dword [rbp - 1]
jge 0x140035a9f
xor r15d, r15d
mov qword [rbp + 7], r15
and qword [rbp + 0xf], r15
and qword [rbp + 0x17], r15
mov rax, qword [r12]
movabs r10, 0x8ba916ea3852e270
mov rcx, r12
mov rax, qword [rax + 0x58]
call qword [case.0x140028cb6.0]
mov rdx, rax
lea rcx, [rbp - 0x11]
call fcn.140017070
lea rdx, [0x1400aca54]
lea rcx, [rbp - 0x11]
call fcn.14000ee80
test edi, edi
js 0x140035b7d
movsxd rcx, edi
mov rax, qword [rbp - 9]
lea rdx, [rax + rcx*8]
lea rcx, [rbp - 0x11]
call fcn.14000d234
and qword [rbp - 0x29], r15
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rbx, qword [rbp - 0x11]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x140035921
mov r15, qword [rbp - 0x29]
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140035958
test byte [rcx + 0x1c], 2
je 0x140035958
cmp byte [rcx + 0x19], 4
jb 0x140035958
mov edx, 0x98
mov r9d, esi
lea r8, [0x1400afc70]
mov rcx, qword [rcx + 0x10]
call fcn.1400438d8
test esi, esi
jne 0x140035a0b
and dword [rbp + 0x77], esi
test r13, r13
js 0x140035b72
cmp r14d, dword [rbp - 0x39]
jge 0x140035b72
mov rax, qword [rbp - 0x41]
mov dword [rbp - 0x29], 4
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x77]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x21]
xor r8d, r8d
mov rdx, qword [rax + r13]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x1400359c0
mov eax, dword [rbp - 0x21]
sub eax, 4
neg eax
sbb esi, esi
and esi, 0xd
mov rax, qword [section..data]
lea rcx, section..data
cmp rax, rcx
je 0x140035a05
test byte [rax + 0x1c], 2
je 0x140035a05
cmp byte [rax + 0x19], 4
jb 0x140035a05
mov edx, 0x99
mov r9d, esi
lea r8, [0x1400afc70]
mov rcx, qword [rax + 0x10]
call fcn.1400438d8
mov rax, qword [section..data]
lea rcx, section..data
cmp dword [rbp + 0x77], 0
jne 0x140035a30
lea rcx, [rbx - 0x18]
call fcn.14000ccd0
nop
test r15, r15
je 0x140035a29
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
inc edi
jmp 0x14003587c
cmp rax, rcx
je 0x140035a7f
test byte [rax + 0x1c], 2
je 0x140035a7f
cmp byte [rax + 0x19], 4
jb 0x140035a7f
mov edx, edi
lea rcx, [rbp - 9]
call fcn.14003a7f0
mov rdi, qword [rax]
mov edx, r14d
lea rcx, [rbp - 0x41]
call fcn.14003a7f0
mov r9, qword [rax]
mov rax, qword [section..data]
mov edx, 0x9a
mov qword [rsp + 0x20], rdi
lea r8, [0x1400afc70]
mov rcx, qword [rax + 0x10]
call fcn.140052630
lea rcx, [rbx - 0x18]
call fcn.14000ccd0
nop
test r15, r15
je 0x140035ace
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x140035ace
mov edx, r14d
lea rcx, [rbp - 0x41]
call fcn.14003a7f0
mov rdx, qword [rax]
mov rcx, r12
call fcn.14009f5f8
mov edx, r14d
lea rcx, [rbp - 0x41]
call fcn.14003a7f0
mov rdx, rax
mov rcx, qword [rbp + 0x7f]
call fcn.140023d34
mov r15, qword [rbp + 0x6f]
lea rbx, section..data
mov r10, qword [section..data]
inc r14d
add r13, 8
cmp r14d, dword [rbp - 0x39]
jl 0x1400355cd
cmp r10, rbx
je 0x140035b36
test byte [r10 + 0x1c], 1
je 0x140035b36
movzx edx, byte [r10 + 0x19]
mov eax, esi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x140035b36
mov rax, qword [rbp + 0x7f]
mov eax, dword [rax + 8]
mov edx, 0x9b
mov dword [rsp + 0x20], eax
mov r9d, esi
lea r8, [0x1400afc70]
mov rcx, qword [r10 + 0x10]
call fcn.140052590
nop
lea rcx, [rbp - 9]
call fcn.14000aa8c
nop
lea rcx, [rbp - 0x41]
call fcn.14000aa8c
mov eax, esi
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0xc000008c
call fcn.1400407ec
nop
mov ecx, 0xc000008c
call fcn.1400407ec
int3
mov ecx, 0xc000008c
call fcn.1400407ec
nop
mov ecx, 0xc000008c
call fcn.1400407ec
int3
mov ecx, 0xc000008c
call fcn.1400407ec
int3
mov ecx, 0xc000008c
call fcn.1400407ec
int3