Function at 0x140018ea0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x378
mov rax, qword [0x140024138]
xor rax, rsp
mov qword [rsp + 0x360], rax
movsxd r13, edx
mov r14, rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], r8
xor ebx, ebx
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0xc8
mov qword [rsp + 0x68], r9
mov dword [rsp + 0x50], r13d
mov esi, ebx
mov byte [r9], bl
call sub.msvcrt.dll_memset
xor eax, eax
movabs rdx, 0x6c00720075
mov dword [rsp + 0x148], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x140], rdx
mov qword [rsp + 0x40], rbx
cmp rax, rbx
je 0x140019009
lea rax, [rsp + 0x40]
lea rdx, [0x140003f00]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x140019009
cmp qword [rsp + 0x40], rbx
je 0x140019009
mov edi, ebx
mov rbp, rbx
lea rdx, [rsp + 0x146]
lea ecx, [rdi + 1]
mov r8d, 0xa
mov dword [rsp + 0x3c], 0x20a
call qword [sym.imp.msvcrt.dll__itow]
mov rcx, qword [rsp + 0x40]
lea r11, [rsp + 0x3c]
lea rax, [rsp + 0x150]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], r11
lea rdx, [rsp + 0x140]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, ebx
je 0x140018fc4
cmp eax, 0xea
jne 0x140018ffa
jmp 0x140018feb
cmp dword [rsp + 0x38], 1
jne 0x140018ffa
mov edx, dword [rsp + 0x3c]
cmp edx, 2
jbe 0x140018feb
shr edx, 1
lea rcx, [rsp + 0x150]
dec edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + rbp*8 + 0x70], rax
inc rbp
inc edi
cmp rbp, 0x19
jl 0x140018f66
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp edi, ebx
jge 0x14001900b
mov edi, ebx
lea r12d, [r13 + rdi]
mov dword [rsp + 0x3c], r12d
cmp r12d, ebx
je 0x1400196be
cmp r13d, ebx
je 0x140019032
cmp r14, rbx
jne 0x140019032
mov esi, 0x80070057
jmp 0x1400196be
mov r15d, r12d
imul r15d, r15d, 0x5a
inc r15d
mov dword [rsp + 0x34], r15d
cmp r12d, r15d
jae 0x140019028
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov r14, rax
mov qword [rsp + 0x48], rax
cmp rax, rbx
jne 0x140019068
mov esi, 0x8007000e
jmp 0x1400196ae
mov ebp, ebx
mov dword [rsp + 0x30], ebx
mov ecx, ebx
mov dword [rsp + 0x38], ebx
mov rdx, rbx
mov qword [rsp + 0x140], rbx
mov rdi, r13
mov qword [rsp + 0x40], r13
cmp r12d, ebx
jbe 0x1400196ae
cmp ecx, r13d
jae 0x1400190a0
mov rax, qword [rsp + 0x58]
mov r12, qword [rax + rdx*8]
jmp 0x1400190ab
mov rax, rdx
sub rax, rdi
mov r12, qword [rsp + rax*8 + 0x70]
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov r13d, eax
cmp eax, ebx
je 0x140019654
jmp 0x1400190cd
cmp r13d, ebx
jle 0x1400190dc
add r12, 2
dec r13d
movzx ecx, word [r12]
call qword [sym.imp.msvcrt.dll_iswspace]
cmp eax, ebx
jne 0x1400190c1
movsxd rdi, r13d
movzx ecx, word [r12 + rdi*2 - 2]
call qword [sym.imp.msvcrt.dll_iswspace]
cmp eax, ebx
je 0x140019115
lea rbp, [r12 + rdi*2 - 2]
cmp rdi, rbx
jle 0x140019111
sub rbp, 2
dec r13d
dec rdi
movzx ecx, word [rbp]
call qword [sym.imp.msvcrt.dll_iswspace]
cmp eax, ebx
jne 0x1400190f4
mov ebp, dword [rsp + 0x30]
cmp r13d, ebx
je 0x14001964f
cmp r13d, 0x100
jg 0x14001964f
inc r13d
mov edi, 0x7fffffff
cmp r13d, edi
ja 0x14001916e
mov r9d, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x3c]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov edx, ebp
mov ecx, r13d
mov qword [rsp + 0x20], rax
call fcn.140018bd0
mov r15d, dword [rsp + 0x34]
mov r14, qword [rsp + 0x48]
mov esi, eax
jmp 0x140019173
mov esi, 0x80004005
cmp esi, ebx
jne 0x1400196ae
lea eax, [r13 - 1]
mov edx, r15d
mov esi, ebx
movsxd r8, eax
mov eax, ebp
sub edx, ebp
lea rcx, [r14 + rax*2]
cmp rdx, rbx
je 0x140019199
cmp rdx, rdi
jbe 0x14001919e
mov esi, 0x80070057
cmp esi, ebx
jl 0x1400196ae
cmp r8, 0x7ffffffe
jbe 0x1400191b6
mov esi, 0x80070057
jmp 0x1400191f3
mov esi, ebx
cmp rdx, rbx
je 0x1400191ea
mov rdi, r12
sub r8, rdx
sub rdi, rcx
lea rax, [r8 + rdx]
cmp rax, rbx
je 0x1400191e5
movzx eax, word [rdi + rcx]
cmp ax, bx
je 0x1400191e5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400191c6
cmp rdx, rbx
jne 0x1400191f3
sub rcx, 2
mov esi, 0x8007007a
cmp esi, ebx
mov word [rcx], bx
jl 0x1400196ae
or rcx, 0xffffffffffffffff
add ebp, r13d
lea rdi, str.file:___
lea eax, [rbp - 1]
mov rdx, r12
mov dword [rsp + 0x30], ebp
mov word [r14 + rax*2], bx
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, str.file:___
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, ebx
jne 0x14001934f
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, str.file:___
repne scasw ax, word [rdi]
not rcx
dec rcx
sub r13d, ecx
cmp r13d, 2
lea rbp, [r12 + rcx*2]
jl 0x14001964b
mov r12d, dword [rsp + 0x30]
cmp r13d, 0x7fffffff
ja 0x1400192a8
mov r9d, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x3c]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov edx, r12d
mov ecx, r13d
mov qword [rsp + 0x20], rax
call fcn.140018bd0
mov r15d, dword [rsp + 0x34]
mov r14, qword [rsp + 0x48]
mov esi, eax
jmp 0x1400192ad
mov esi, 0x80004005
cmp esi, ebx
jne 0x1400196ae
mov edx, r15d
mov eax, r12d
movsxd rdi, r13d
sub edx, r12d
lea rcx, [r14 + rax*2]
mov esi, ebx
cmp rdx, rbx
je 0x1400192d5
cmp rdx, 0x7fffffff
jbe 0x1400192da
mov esi, 0x80070057
cmp esi, ebx
jl 0x1400196ae
cmp rdi, 0x7ffffffe
jbe 0x1400192f2
mov esi, 0x80070057
jmp 0x14001932c
mov esi, ebx
cmp rdx, rbx
je 0x140019323
sub rdi, rdx
sub rbp, rcx
lea rax, [rdi + rdx]
cmp rax, rbx
je 0x14001931e
movzx eax, word [rcx + rbp]
cmp ax, bx
je 0x14001931e
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400192ff
cmp rdx, rbx
jne 0x14001932c
sub rcx, 2
mov esi, 0x8007007a
cmp esi, ebx
mov word [rcx], bx
jl 0x1400196ae
mov ebp, dword [rsp + 0x30]
add ebp, r13d
mov dword [rsp + 0x30], ebp
lea eax, [rbp - 1]
mov word [r14 + rax*2], bx
jmp 0x14001964f
lea rdx, [0x140003f60]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
jne 0x14001964f
mov r14, r12
mov rbp, rbx
lea rdi, [0x140024268]
mov rdi, qword [rdi + rbp*8]
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
lea rdi, [0x140024268]
mov rdx, r12
not rcx
lea r8, [rcx - 1]
mov rcx, qword [rdi + rbp*8]
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, ebx
je 0x14001946f
inc rbp
cmp rbp, 6
jl 0x140019375
mov ebp, dword [rsp + 0x30]
mov r14, qword [rsp + 0x48]
mov edx, 0x2f
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcschr]
mov rdi, rax
cmp rax, rbx
jne 0x1400193d5
movsxd rax, r13d
lea rdi, [r12 + rax*2 - 2]
mov eax, 0x2e
cmp r12, rdi
jae 0x1400193eb
sub rdi, 2
cmp ax, word [rdi]
jne 0x1400193da
cmp r12, rdi
je 0x14001964f
mov edx, eax
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbx
je 0x14001964f
lea rbp, [rax + 2]
cmp rbp, rdi
jae 0x14001964b
mov rax, rbp
sub rax, r12
sar rax, 1
sub r13d, eax
cmp r13d, 2
jl 0x14001964b
mov r12d, dword [rsp + 0x30]
cmp r13d, 0x7fffffff
ja 0x140019580
mov r9d, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x3c]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov edx, r12d
mov ecx, r13d
mov qword [rsp + 0x20], rax
call fcn.140018bd0
mov r15d, dword [rsp + 0x34]
mov esi, eax
jmp 0x140019585
mov rdi, qword [rdi + rbp*8]
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
dec rcx
sub r13d, ecx
lea r12, [r12 + rcx*2]
cmp r14, r12
je 0x1400193ae
cmp r13d, 2
jl 0x140019646
mov ebp, dword [rsp + 0x30]
mov edi, 0x7fffffff
cmp r13d, edi
ja 0x1400194db
mov r9d, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x3c]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov edx, ebp
mov ecx, r13d
mov qword [rsp + 0x20], rax
call fcn.140018bd0
mov r15d, dword [rsp + 0x34]
mov esi, eax
jmp 0x1400194e0
mov esi, 0x80004005
cmp esi, ebx
jne 0x1400196ae
mov r14, qword [rsp + 0x48]
mov edx, r15d
mov eax, ebp
sub edx, ebp
movsxd r8, r13d
mov esi, ebx
lea rcx, [r14 + rax*2]
cmp rdx, rbx
je 0x140019507
cmp rdx, rdi
jbe 0x14001950c
mov esi, 0x80070057
cmp esi, ebx
jl 0x1400196ae
cmp r8, 0x7ffffffe
jbe 0x140019524
mov esi, 0x80070057
jmp 0x140019561
mov esi, ebx
cmp rdx, rbx
je 0x140019558
mov rdi, r12
sub r8, rdx
sub rdi, rcx
lea rax, [r8 + rdx]
cmp rax, rbx
je 0x140019553
movzx eax, word [rdi + rcx]
cmp ax, bx
je 0x140019553
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140019534
cmp rdx, rbx
jne 0x140019561
sub rcx, 2
mov esi, 0x8007007a
cmp esi, ebx
mov word [rcx], bx
jl 0x1400196ae
add ebp, r13d
mov dword [rsp + 0x30], ebp
lea eax, [rbp - 1]
mov word [r14 + rax*2], bx
jmp 0x1400193b7
mov esi, 0x80004005
cmp esi, ebx
jne 0x1400196ae
mov r14, qword [rsp + 0x48]
mov edx, r15d
mov eax, r12d
sub edx, r12d
movsxd r9, r13d
mov esi, ebx
lea rcx, [r14 + rax*2]
cmp rdx, rbx
je 0x1400195b2
cmp rdx, 0x7fffffff
jbe 0x1400195b7
mov esi, 0x80070057
cmp esi, ebx
jl 0x1400196ae
cmp r9, 0x7ffffffe
jbe 0x1400195cf
mov esi, 0x80070057
jmp 0x14001960d
mov esi, ebx
cmp rdx, rbx
je 0x140019604
mov r8, rbp
sub r9, rdx
sub r8, rcx
lea rax, [r9 + rdx]
cmp rax, rbx
je 0x1400195ff
movzx eax, word [r8 + rcx]
cmp ax, bx
je 0x1400195ff
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400195df
cmp rdx, rbx
jne 0x14001960d
sub rcx, 2
mov esi, 0x8007007a
cmp esi, ebx
mov word [rcx], bx
jl 0x1400196ae
add r12d, r13d
mov edx, 0x2e
mov rcx, rbp
lea eax, [r12 - 1]
mov dword [rsp + 0x30], r12d
mov r12, rbp
mov word [r14 + rax*2], bx
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbx
jne 0x140019405
jmp 0x14001964b
mov r14, qword [rsp + 0x48]
mov ebp, dword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x140]
mov r13d, dword [rsp + 0x50]
inc ecx
inc rdx
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x140], rdx
cmp ecx, dword [rsp + 0x3c]
jb 0x140019090
cmp ebp, ebx
je 0x1400196ae
mov rax, qword [rsp + 0x68]
mov edx, ebp
mov rcx, r14
mov byte [rax], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov ecx, esi
mov esi, 0x8007000e
cmp rax, rbx
cmove ecx, esi
mov esi, ecx
mov rcx, qword [rsp + 0x48]
cmp rcx, rbx
je 0x1400196be
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + rbx*8 + 0x70]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
inc rbx
cmp rbx, 0x19
jl 0x1400196be
mov eax, esi
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.14001b920
add rsp, 0x378
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret