Function at 0x140111c10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
and dword [rbp - 0x10], 0
and dword [rbp + 0x20], 0
cmp qword [rbp + 0x40], 0
mov rsi, r9
mov r14, r8
mov r15, rcx
mov ebx, 0x80004005
mov qword [rbp - 8], rcx
jne 0x140111c51
mov eax, 0x80070057
jmp 0x140111e87
mov eax, dword [rbp + 0x50]
test rdx, rdx
jne 0x140111c5d
test eax, eax
je 0x140111cdb
neg eax
lea rax, [rbp - 8]
sbb r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
and r9d, 0x100
or r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test eax, eax
je 0x140111cd7
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
cmovns eax, ebx
mov ebx, eax
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x140111e71
test byte [rcx + 0x1c], 1
je 0x140111e71
mov rcx, qword [rcx + 0x10]
lea r8, [0x140001368]
mov edx, 0x40
mov r9d, ebx
call fcn.14000fd64
jmp 0x140111e71
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x10]
lea r9, [rbp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test eax, eax
je 0x140111d40
test rsi, rsi
je 0x140111d2c
cmp dword [rbp + 0x48], 0
je 0x140111d1e
mov rdx, qword [rbp + 0x40]
mov rcx, rsi
call fcn.140110b40
mov ebx, eax
jmp 0x140111e71
mov rcx, qword [rbp + 0x40]
mov rdx, rsi
call fcn.14010bed8
jmp 0x140111d17
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
cmovns eax, ebx
jmp 0x140111d17
mov eax, dword [rbp + 0x20]
dec eax
cmp eax, 1
jbe 0x140111d54
mov ebx, 0x8007065d
jmp 0x140111e71
mov ecx, dword [rbp - 0x10]
mov eax, 2
shr rcx, 1
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140105a40
mov rsi, rax
test rax, rax
jne 0x140111db6
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x140111e71
test byte [rcx + 0x1c], 1
je 0x140111e71
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x41]
lea r8, [0x140001368]
call fcn.14000fcb0
jmp 0x140111e71
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x10]
lea r9, [rbp + 0x20]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140111e11
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovns ecx, ebx
mov ebx, ecx
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x140111e69
test byte [rcx + 0x1c], 1
je 0x140111e69
mov edx, 0x42
jmp 0x140111e52
mov eax, dword [rbp + 0x20]
dec eax
cmp eax, 1
jbe 0x140111e22
mov ebx, 0x8007065d
jmp 0x140111e69
mov rcx, qword [rbp + 0x40]
mov rdx, rsi
call fcn.14010bed8
mov ebx, eax
test eax, eax
jns 0x140111e67
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x140111e69
test byte [rcx + 0x1c], 1
je 0x140111e69
mov edx, 0x43
mov rcx, qword [rcx + 0x10]
lea r8, [0x140001368]
mov r9d, ebx
call fcn.14000fd64
jmp 0x140111e69
xor ebx, ebx
mov rcx, rsi
call fcn.140105ac0
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140111e85
cmp rcx, r15
je 0x140111e85
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret