Function at 0x1400b1a18
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
lea r14, [0x1400f3190]
mov rcx, qword [0x1400f3190]
cmp rcx, r14
je 0x1400b1a73
test byte [rcx + 0x1c], 1
je 0x1400b1a73
cmp byte [rcx + 0x19], 5
jb 0x1400b1a73
mov edx, 0x1d
lea r8, [0x1400d8e70]
mov rcx, qword [rcx + 0x10]
call fcn.1400035e4
mov rcx, qword [rsi]
xor r12d, r12d
test rcx, rcx
je 0x1400b1aa9
mov ebx, r12d
cmp dword [rsi + 8], r12d
jle 0x1400b1aa0
movsxd rcx, ebx
shl rcx, 5
add rcx, qword [rsi]
call fcn.14003b96c
inc ebx
cmp ebx, dword [rsi + 8]
jl 0x1400b1a87
mov rcx, qword [rsi]
call qword [sym.imp.msvcrt.dll_free]
mov qword [rsi], r12
mov qword [rsi + 8], r12
mov ebx, 0x54f
mov rdx, qword [rdi + 8]
cmp dword [rdx - 0x10], r12d
je 0x1400b1fdf
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], r12
lea rcx, [rbp - 0x29]
call fcn.1400b2910
mov ebx, eax
mov r13d, 4
mov rcx, qword [0x1400f3190]
cmp rcx, r14
je 0x1400b1b0c
test byte [rcx + 0x1c], 2
je 0x1400b1b0c
cmp byte [rcx + 0x19], r13b
jb 0x1400b1b0c
lea edx, [r13 + 0x1a]
mov r9d, eax
lea r8, [0x1400d8e70]
mov rcx, qword [rcx + 0x10]
call fcn.1400036a8
mov qword [rbp - 0x61], r12
mov qword [rbp - 0x59], r12
test ebx, ebx
jne 0x1400b1fc6
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x29]
call fcn.1400a9158
mov ebx, eax
mov rcx, qword [0x1400f3190]
cmp rcx, r14
je 0x1400b1b5b
test byte [rcx + 0x1c], 2
je 0x1400b1b5b
cmp byte [rcx + 0x19], r13b
jb 0x1400b1b5b
mov edx, 0x1f
mov r9d, eax
lea r8, [0x1400d8e70]
mov rcx, qword [rcx + 0x10]
call fcn.1400036a8
test ebx, ebx
jne 0x1400b1fc6
mov r14d, r12d
mov eax, dword [rbp - 0x59]
test eax, eax
jle 0x1400b1fbf
mov r15, r12
mov rdi, r12
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x41], r12
mov qword [rbp - 0x39], r12
test r15, r15
js 0x1400b2040
cmp r14d, eax
jge 0x1400b2040
mov rax, qword [rbp - 0x61]
mov qword [rbp - 0x31], r12
lea rcx, [rbp - 0x31]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20119
xor r8d, r8d
mov rdx, qword [rax + r15]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400b1bce
mov ebx, r12d
mov rdi, qword [rbp - 0x31]
mov qword [rbp - 0x49], rdi
mov rcx, qword [0x1400f3190]
lea rax, [0x1400f3190]
cmp rcx, rax
je 0x1400b1c05
test byte [rcx + 0x1c], 2
je 0x1400b1c05
cmp byte [rcx + 0x19], r13b
jb 0x1400b1c05
mov edx, 0x20
mov r9d, ebx
lea r8, [0x1400d8e70]
mov rcx, qword [rcx + 0x10]
call fcn.1400036a8
test ebx, ebx
jne 0x1400b1f34
mov rax, qword [0x1400f6030]
lea rbx, [0x1400f6030]
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [str.__f_]
add rax, 0x18
mov qword [rbp - 0x51], rax
mov rax, qword [0x1400f6030]
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [str.__f_]
add rax, 0x18
mov qword [rbp - 0x69], rax
mov rax, qword [0x1400f6030]
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [str.__f_]
add rax, 0x18
mov qword [rbp + 0x7f], rax
mov dword [rbp + 0x67], r13d
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f]
xor r8d, r8d
lea rdx, str.Reason
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1400b1ca8
mov eax, dword [rbp + 0x6f]
sub eax, r13d
neg eax
sbb ebx, ebx
and ebx, 0xd
mov rcx, qword [0x1400f3190]
lea rdi, [0x1400f3190]
cmp rcx, rdi
je 0x1400b1cdf
test byte [rcx + 0x1c], 2
je 0x1400b1cdf
cmp byte [rcx + 0x19], r13b
jb 0x1400b1cdf
mov edx, 0x21
mov r9d, ebx
lea r8, [0x1400d8e70]
mov rcx, qword [rcx + 0x10]
call fcn.1400036a8
test ebx, ebx
jne 0x1400b1dc5
lea r8, [rbp - 0x51]
lea rdx, [0x1400d8e38]
lea rcx, [rbp - 0x49]
call fcn.1400a9468
mov ebx, eax
mov rcx, qword [0x1400f3190]
cmp rcx, rdi
je 0x1400b1d2d
test byte [rcx + 0x1c], 2
je 0x1400b1d2d
cmp byte [rcx + 0x19], r13b
jb 0x1400b1d2d
mov edx, 0x22
mov r9d, eax
lea r8, [0x1400d8e70]
mov rcx, qword [rcx + 0x10]
call fcn.1400036a8
test ebx, ebx
jne 0x1400b1dc5
lea r8, [rbp - 0x69]
lea rdx, [0x1400d8e40]
lea rcx, [rbp - 0x49]
call fcn.1400a9468
mov ebx, eax
mov rcx, qword [0x1400f3190]
cmp rcx, rdi
je 0x1400b1d7b
test byte [rcx + 0x1c], 2
je 0x1400b1d7b
cmp byte [rcx + 0x19], r13b
jb 0x1400b1d7b
mov edx, 0x23
mov r9d, eax
lea r8, [0x1400d8e70]
mov rcx, qword [rcx + 0x10]
call fcn.1400036a8
test ebx, ebx
jne 0x1400b1dc5
lea r8, [rbp + 0x7f]
lea rdx, str.Scope
lea rcx, [rbp - 0x49]
call fcn.1400a9468
mov ebx, eax
mov rcx, qword [0x1400f3190]
cmp rcx, rdi
je 0x1400b1dc5
test byte [rcx + 0x1c], 2
je 0x1400b1dc5
cmp byte [rcx + 0x19], r13b
jb 0x1400b1dc5
mov edx, 0x24
mov r9d, eax
lea r8, [0x1400d8e70]
mov rcx, qword [rcx + 0x10]
call fcn.1400036a8
lea rdx, str.ignored
mov rcx, qword [rbp - 0x69]
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1400b1e0f
lea rcx, [rbp - 0x69]
call fcn.140004db8
mov rcx, qword [0x1400f3190]
cmp rcx, rdi
je 0x1400b1e0f
test byte [rcx + 0x1c], 2
je 0x1400b1e0f
cmp byte [rcx + 0x19], r13b
jb 0x1400b1e0f
mov edx, 0x25
lea r8, [0x1400d8e70]
mov rcx, qword [rcx + 0x10]
call fcn.1400035e4
lea rdx, str.ignored
mov rcx, qword [rbp + 0x7f]
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1400b1e59
lea rcx, [rbp + 0x7f]
call fcn.140004db8
mov rcx, qword [0x1400f3190]
cmp rcx, rdi
je 0x1400b1e59
test byte [rcx + 0x1c], 2
je 0x1400b1e59
cmp byte [rcx + 0x19], r13b
jb 0x1400b1e59
mov edx, 0x26
lea r8, [0x1400d8e70]
mov rcx, qword [rcx + 0x10]
call fcn.1400035e4
test ebx, ebx
jne 0x1400b1ebc
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x69]
mov r8, qword [rbp - 0x51]
mov edx, dword [rbp + 0x77]
lea rcx, [rbp - 9]
call fcn.1400b11ac
nop
mov rdx, rax
mov rcx, rsi
call fcn.1400b2b4c
nop
lea rcx, [rbp - 9]
call fcn.14003b96c
mov rcx, qword [0x1400f3190]
cmp rcx, rdi
je 0x1400b1ebc
test byte [rcx + 0x1c], 2
je 0x1400b1ebc
cmp byte [rcx + 0x19], r13b
jb 0x1400b1ebc
lea edx, [rbx + 0x27]
lea r8, [0x1400d8e70]
mov rcx, qword [rcx + 0x10]
call fcn.1400035e4
nop
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400b1ee5
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [str.__f_]
nop
mov rdx, qword [rbp - 0x69]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400b1f0b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [str.__f_]
nop
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400b1f30
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [str.__f_]
mov rdi, qword [rbp - 0x49]
test rdi, rdi
je 0x1400b1f49
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r12
mov qword [rbp - 0x49], r12
cmp r14d, dword [rbp - 0x59]
jge 0x1400b2035
mov rdx, qword [rbp - 0x61]
mov rdx, qword [rdx + r15]
lea rcx, [rbp - 0x29]
call fcn.1400a96b4
mov ebx, eax
mov rcx, qword [0x1400f3190]
lea rax, [0x1400f3190]
cmp rcx, rax
je 0x1400b1f9e
test byte [rcx + 0x1c], 2
je 0x1400b1f9e
cmp byte [rcx + 0x19], r13b
jb 0x1400b1f9e
mov edx, 0x28
mov r9d, ebx
lea r8, [0x1400d8e70]
mov rcx, qword [rcx + 0x10]
call fcn.1400036a8
nop
test rdi, rdi
je 0x1400b1fac
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r14d
add r15, 8
mov eax, dword [rbp - 0x59]
cmp r14d, eax
jl 0x1400b1b74
lea r14, [0x1400f3190]
lea rcx, [rbp - 0x61]
call fcn.140014a08
nop
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x1400b1fdf
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x1400f3190]
cmp rcx, r14
je 0x1400b201f
test byte [rcx + 0x1c], 1
je 0x1400b201f
movzx r9d, byte [rcx + 0x19]
mov eax, ebx
neg eax
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp r9d, edx
jb 0x1400b201f
mov edx, 0x29
mov r9d, ebx
lea r8, [0x1400d8e70]
mov rcx, qword [rcx + 0x10]
call fcn.1400036a8
mov eax, ebx
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0xc000008c
call fcn.14000518c
int3
mov ecx, 0xc000008c
call fcn.14000518c
int3