Function at 0x14009b8f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xf08
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0xef8], rax
cmp dword [0x14012ea10], 1
je 0x14009b925
xor eax, eax
jmp 0x14009bbd9
xor eax, eax
test eax, eax
jne 0x14009b915
lea rdi, [rsp + 0x60]
lea rsi, str.product
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x70]
xor eax, eax
mov ecx, 0x1fa
rep stosb byte [rdi], al
lea rdi, [rsp + 0x26a]
lea rsi, [0x1400f4bc8]
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x274]
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
lea rdi, [rsp + 0x474]
lea rsi, [0x1400f4bd8]
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x480]
xor eax, eax
mov ecx, 0x1fe
rep stosb byte [rdi], al
lea rdi, [rsp + 0x67e]
lea rsi, [0x1400f4be8]
mov ecx, 0xe
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x68c]
xor eax, eax
mov ecx, 0x1fc
rep stosb byte [rdi], al
lea rdi, [rsp + 0x888]
lea rsi, [0x1400f4bf8]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x898]
xor eax, eax
mov ecx, 0x1fa
rep stosb byte [rdi], al
lea rdi, [rsp + 0xa92]
lea rsi, [0x1400f4c08]
mov ecx, 0xe
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0xaa0]
xor eax, eax
mov ecx, 0x1fc
rep stosb byte [rdi], al
mov rax, qword [0x1400f4c18]
mov qword [rsp + 0xc9c], rax
lea rdi, [rsp + 0xca4]
xor eax, eax
mov ecx, 0x202
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0x15
mov dword [rsp + 0x34], 0x65
mov dword [rsp + 0x38], 0x29
mov dword [rsp + 0x3c], 0x21
mov dword [rsp + 0x40], 0x1f
mov dword [rsp + 0x44], 0x105
mov dword [rsp + 0x48], 0x105
mov rax, qword [rsp + 0xf28]
mov qword [rsp + 0xeb0], rax
mov rax, qword [rsp + 0xf28]
add rax, 0x510
mov qword [rsp + 0xeb8], rax
mov rax, qword [rsp + 0xf28]
add rax, 0x4be
mov qword [rsp + 0xec0], rax
mov rax, qword [rsp + 0xf28]
add rax, 0x47c
mov qword [rsp + 0xec8], rax
mov rax, qword [rsp + 0xf28]
add rax, 0x2a
mov qword [rsp + 0xed0], rax
mov rax, qword [rsp + 0xf28]
add rax, 0x68
mov qword [rsp + 0xed8], rax
mov rax, qword [rsp + 0xf28]
add rax, 0x272
mov qword [rsp + 0xee0], rax
mov dword [rsp + 0x50], 1
mov dword [rsp + 0xee8], 0
jmp 0x14009bb1d
mov eax, dword [rsp + 0xee8]
add eax, 1
mov dword [rsp + 0xee8], eax
movsxd rax, dword [rsp + 0xee8]
cmp rax, 7
jae 0x14009bbd5
movsxd rax, dword [rsp + 0xee8]
mov ecx, dword [rsp + rax*4 + 0x30]
shl rcx, 1
movsxd rdi, dword [rsp + 0xee8]
mov rdi, qword [rsp + rdi*8 + 0xeb0]
xor eax, eax
rep stosb byte [rdi], al
movsxd rax, dword [rsp + 0xee8]
mov eax, dword [rsp + rax*4 + 0x30]
shl rax, 1
mov dword [rsp + 0xef0], eax
movsxd rcx, dword [rsp + 0xee8]
movsxd rax, dword [rsp + 0xee8]
imul rax, rax, 0x20a
lea rdx, [rsp + rax + 0x60]
lea rax, [rsp + 0xef0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + rcx*8 + 0xeb0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0xf20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0xeec], eax
cmp dword [rsp + 0xeec], 0
je 0x14009bbd0
mov dword [rsp + 0x50], 0
jmp 0x14009bb0c
jmp 0x14009bb0c
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0xef8]
xor rcx, rsp
call fcn.1400ad2c0
add rsp, 0xf08
pop rdi
pop rsi
ret