Function at 0x14001a3f6
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x10d8
call fcn.1400a14b0
sub rsp, rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x88], rdx
mov qword [rsp + 0x80], rcx
mov rsi, qword [r8]
lea rdi, [rsp + 0xd8]
xor r14d, r14d
mov ebx, 0x800
mov dword [rsp + 0x60], ebx
mov r8d, 0x1000
mov rcx, rdi
xor edx, edx
call fcn.1400a2c10
mov dword [rsp + 0x5c], ebx
and dword [rsp + 0x64], 0
mov ecx, 0x800
mov edx, 1
call fcn.140096b7f
test rax, rax
je 0x14001a737
mov r15, rax
mov r12d, 0x800
lea rbx, [rsp + 0x5c]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], r15
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov rcx, rsi
mov edx, r14d
mov r8, rdi
lea r9, [rsp + 0x60]
call sub.ADVAPI32.dll_RegEnumValueW
cmp eax, 0xea
jne 0x14001a552
inc dword [rsp + 0x60]
mov ebp, dword [rsp + 0x5c]
cmp r12, rbp
jae 0x14001a47d
lea rax, [r12 + r12]
cmp rax, rbp
cmova rbp, rax
cmp rbp, 9
jae 0x14001a4d8
mov ebp, 8
mov r8, rbp
not r8
shr r8, 0x3f
test r12, r12
je 0x14001a4f8
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r12
mov eax, 1
jmp 0x14001a4fa
xor eax, eax
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0xc0]
mov rdx, rbp
lea r9, [rsp + 0x68]
call fcn.1400484a9
cmp qword [rsp + 0xc0], 0
mov rcx, qword [rsp + 0xc8]
movabs rdx, 0x8000000000000001
mov rbx, rcx
je 0x14001a542
mov rdx, qword [rsp + 0xd0]
mov rbx, r15
mov rbp, r12
call fcn.14001dab8
mov r12, rbp
mov r15, rbx
jmp 0x14001a478
mov r13d, eax
test eax, eax
je 0x14001a569
cmp r13d, 0x103
jne 0x14001a5c0
mov bl, 0xd
mov bpl, 1
jmp 0x14001a5dc
mov edx, dword [rsp + 0x60]
mov rcx, rdi
lea r8, [0x14013b818]
call fcn.1400a13d7
mov r8, rdx
lea rcx, [rsp + 0x68]
mov rdx, rax
call fcn.1400290b0
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x14001a5ce
mov r13, qword [rsp + 0x68]
mov eax, dword [rsp + 0x64]
cmp eax, 0xb
jbe 0x14001a6e6
mov rcx, r13
call fcn.1400a0d76
mov bl, 0xc
xor ebp, ebp
movabs r13, 0xde00000002
jmp 0x14001a5dc
shl r13, 0x20
or r13, 2
mov bl, 0xc
xor ebp, ebp
jmp 0x14001a5dc
mov bl, 0xc
xor ebp, ebp
movabs r13, 0xd00000002
mov rcx, r12
mov rdx, r15
call fcn.1400a0d76
mov al, 0xc
test bpl, bpl
jne 0x14001a5f3
inc r14d
mov ebx, eax
cmp bl, 0xc
je 0x14001a6d1
movzx eax, bl
cmp eax, 0xd
je 0x14001a71c
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xe8], rax
mov byte [rsp + 0xf0], bl
mov rax, qword [rsp + 0x1150]
mov qword [rsp + 0x48], rax
mov al, byte [rsp + 0x1148]
mov byte [rsp + 0x40], al
mov qword [rsp + 0x38], rdi
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov rbx, qword [rsp + 0xb0]
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0x1140]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
mov r8, rsi
mov r9, qword [rsp + 0x90]
call fcn.14001bb8b
mov rbp, rax
mov rcx, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xe0]
call fcn.1400a0d76
mov rcx, r13
mov rdx, rbx
call fcn.1400a0d76
test rbp, rbp
je 0x14001a435
jmp 0x14001a720
mov qword [rsp + 0xd8], r13
mov rcx, rdi
call fcn.140009134
jmp 0x14001a435
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0xb8], rcx
mov ecx, dword [rsp + 0x5c]
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], rdx
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0x98], r15
jmp 0x14001a5ee
xor eax, eax
jmp 0x14001a723
mov rax, rbp
add rsp, 0x10d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 0x800
mov edx, 1
call fcn.1400b0080
ud2