Function at 0x140004420
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xd0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x48], 0xfffffffffffffffe
mov qword [rbp + 0x20], r9
mov qword [rbp + 0x28], r8
mov qword [rbp + 0x30], rdx
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x40], rcx
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004480
jmp 0x140004f71
mov eax, 0x10
mov qword [rbp + 8], rax
call fcn.140046420
sub rsp, rax
mov rax, qword [rbp + 8]
mov rcx, rsp
mov qword [rbp - 0x18], rcx
call fcn.140046420
sub rsp, rax
mov rax, qword [rbp + 8]
mov rcx, rsp
mov qword [rbp - 0x10], rcx
call fcn.140046420
sub rsp, rax
mov rax, qword [rbp + 8]
mov rcx, rsp
mov qword [rbp - 8], rcx
call fcn.140046420
sub rsp, rax
mov rax, qword [rbp + 8]
mov rcx, rsp
mov qword [rbp], rcx
call fcn.140046420
sub rsp, rax
mov rax, qword [rbp + 8]
mov rcx, rsp
mov qword [rbp + 0x10], rcx
call fcn.140046420
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x18], rax
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004529
jmp 0x140004f71
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000455b
jmp 0x140004f76
mov rcx, qword [rbp]
mov rdx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x28]
mov r9, qword [rbp - 0x10]
mov r10, qword [rbp + 0x20]
mov r11, qword [rbp - 0x18]
mov rsi, qword [rbp + 0x38]
mov eax, 0x10
mov qword [rbp - 0x38], rax
call fcn.140046420
sub rsp, rax
mov rax, qword [rbp - 0x38]
mov rdi, rsp
mov qword [rbp - 0x40], rdi
call fcn.140046420
sub rsp, rax
mov rax, qword [rbp - 0x38]
mov rdi, rsp
mov qword [rbp - 0x30], rdi
call fcn.140046420
sub rsp, rax
mov rax, qword [rbp - 8]
mov rdi, rsp
mov qword [rbp - 0x28], rdi
mov qword [r11], rsi
mov qword [r9], r10
mov qword [rax], r8
mov qword [rcx], rdx
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.140007f60
mov rcx, qword [rbp]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rcx, qword [rcx]
xor r8d, r8d
mov r9d, 0x20019
sub rsp, 0x30
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add rsp, 0x30
cmp eax, 0
sete al
mov byte [rbp - 0x19], al
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000463a
jmp 0x140004f76
mov al, byte [rbp - 0x19]
test al, 1
jne 0x14000464a
jmp 0x140004e1c
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000467c
jmp 0x140004fe1
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.140007f60
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x50], rcx
mov rax, qword [rax]
mov qword [rbp - 0x48], rax
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400046d4
jmp 0x140004fe1
mov rax, qword [rbp - 0x40]
mov r9, qword [rbp + 0x18]
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x48]
xor r8d, r8d
sub rsp, 0x30
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add rsp, 0x30
cmp eax, 0
jne 0x140004d3a
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000473e
jmp 0x140004ffa
mov rax, qword [rbp + 0x18]
cmp dword [rax], 1
sete al
mov byte [rbp - 0x51], al
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000477d
jmp 0x140004ffa
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400047af
jmp 0x140004fff
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400047e1
jmp 0x140004fff
mov al, byte [rbp - 0x51]
test al, 1
jne 0x1400047f1
jmp 0x140004cd1
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004823
jmp 0x140005004
mov rcx, qword [rbp + 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
mov byte [rdx], 0
mov eax, dword [rax]
mov edx, eax
xor r8d, r8d
sub rsp, 0x20
call fcn.140008240
mov rcx, qword [rbp + 0x38]
add rsp, 0x20
xor eax, eax
mov edx, eax
sub rsp, 0x20
call fcn.140008450
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x68], rcx
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.140007f60
add rsp, 0x20
mov qword [rbp - 0x60], rax
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400048ac
jmp 0x140005004
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400048de
jmp 0x140005055
mov rax, qword [rbp - 0x40]
mov r10, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x60]
mov rcx, qword [rbp + 0x10]
mov rcx, qword [rcx]
xor r8d, r8d
mov r9d, r8d
sub rsp, 0x30
mov r8, r9
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add rsp, 0x30
cmp eax, 0
sete al
mov byte [rbp - 0x69], al
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000494d
jmp 0x140005055
mov al, byte [rbp - 0x69]
test al, 1
jne 0x14000495d
jmp 0x1400049ad
mov rcx, qword [rbp + 0x38]
mov rax, qword [rbp - 0x40]
mov eax, dword [rax]
dec eax
mov edx, eax
sub rsp, 0x20
xor eax, eax
mov r8b, al
call fcn.140008660
add rsp, 0x20
jmp 0x140004982
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x30]
add rsp, 0x20
mov rax, qword [rbp - 0x28]
mov byte [rcx], 1
mov dword [rax], 1
jmp 0x140004a20
mov rax, qword [rbp - 0x28]
mov dword [rax], 0
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400049e9
jmp 0x14000508e
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004a1b
jmp 0x14000508e
jmp 0x140004a20
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004a52
jmp 0x140005093
mov rax, qword [rbp - 0x30]
mov al, byte [rax]
mov byte [rbp - 0x6a], al
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004a8d
jmp 0x140005093
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004abf
jmp 0x140005098
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004af1
jmp 0x140005098
mov al, byte [rbp - 0x6a]
test al, 1
jne 0x140004b7b
jmp 0x140004b01
mov rcx, qword [rbp + 0x38]
sub rsp, 0x20
call fcn.140006880
add rsp, 0x20
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004b44
jmp 0x14000509d
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004b76
jmp 0x14000509d
jmp 0x140004b7b
mov rax, qword [rbp - 0x28]
mov eax, dword [rax]
mov dword [rbp - 0x70], eax
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004bb6
jmp 0x1400050a2
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004be8
jmp 0x1400050a2
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004c1a
jmp 0x1400050a7
mov eax, dword [rbp - 0x70]
cmp eax, 1
sete al
mov byte [rbp - 0x71], al
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004c58
jmp 0x1400050a7
mov al, byte [rbp - 0x71]
test al, 1
jne 0x140004f01
jmp 0x140004c68
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004c9a
jmp 0x1400050ac
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004ccc
jmp 0x1400050ac
jmp 0x140004cd1
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004d03
jmp 0x1400050b1
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004d35
jmp 0x1400050b1
jmp 0x140004d3a
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004d6c
jmp 0x1400050b6
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x20
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004db3
jmp 0x1400050b6
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004de5
jmp 0x1400050d0
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004e17
jmp 0x1400050d0
jmp 0x140004e1c
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004e4e
jmp 0x1400050d5
mov rcx, qword [rbp + 0x38]
lea rdx, [0x140048a2c]
sub rsp, 0x20
call fcn.140008ee0
add rsp, 0x20
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004e98
jmp 0x1400050d5
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004eca
jmp 0x1400050f2
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004efc
jmp 0x1400050f2
jmp 0x140004f01
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004f33
jmp 0x1400050f7
mov eax, dword [0x14004b33c]
mov ecx, dword [0x14004b340]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140004f65
jmp 0x1400050f7
mov rax, qword [rbp + 0x40]
lea rsp, [rbp + 0x50]
pop rdi
pop rsi
pop rbp
ret
jmp 0x140004480
mov rcx, qword [rbp]
mov rax, qword [rbp - 8]
mov rdx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x28]
mov r9, qword [rbp - 0x10]
mov r10, qword [rbp + 0x20]
mov r11, qword [rbp - 0x18]
mov rsi, qword [rbp + 0x38]
mov qword [r11], rsi
mov qword [r9], r10
mov qword [rax], r8
mov qword [rcx], rdx
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.140007f60
mov rcx, qword [rbp]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rcx, qword [rcx]
xor r8d, r8d
mov r9d, 0x20019
sub rsp, 0x30
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add rsp, 0x30
jmp 0x14000455b
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.140007f60
add rsp, 0x20
jmp 0x14000467c
jmp 0x14000473e
jmp 0x1400047af
mov rcx, qword [rbp + 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
mov byte [rdx], 0
mov eax, dword [rax]
mov edx, eax
xor r8d, r8d
sub rsp, 0x20
call fcn.140008240
mov rcx, qword [rbp + 0x38]
add rsp, 0x20
xor eax, eax
mov edx, eax
sub rsp, 0x20
call fcn.140008450
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.140007f60
add rsp, 0x20
jmp 0x140004823
mov rax, qword [rbp - 0x40]
mov r10, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x60]
mov rcx, qword [rbp + 0x10]
mov rcx, qword [rcx]
xor r8d, r8d
mov r9d, r8d
sub rsp, 0x30
mov r8, r9
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add rsp, 0x30
jmp 0x1400048de
jmp 0x1400049e9
jmp 0x140004a52
jmp 0x140004abf
jmp 0x140004b44
jmp 0x140004bb6
jmp 0x140004c1a
jmp 0x140004c9a
jmp 0x140004d03
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x20
jmp 0x140004d6c
jmp 0x140004de5
mov rcx, qword [rbp + 0x38]
lea rdx, [0x140048a2c]
sub rsp, 0x20
call fcn.140008ee0
add rsp, 0x20
jmp 0x140004e4e
jmp 0x140004eca
jmp 0x140004f33