Function at 0x1400d99d0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [0x1403856c0], 0
je 0x1400d9ced
xorps xmm0, xmm0
lea rcx, [rsp + 0x50]
movaps xmmword [rcx], xmm0
mov rdx, r14
call sub.ntdll.dll_RtlInitUnicodeString
mov dword [rsp + 0x4c], 0x18
mov ecx, 0x18
call fcn.1401ae97c
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea rcx, [rax + 0x18]
mov qword [rsp + 0x40], rcx
test rax, rax
je 0x1400d9cda
mov byte [rax], 0
cmp rax, 0xffffffffffffffff
je 0x1400d9cda
mov byte [rax + 1], 0
cmp rax, 0xfffffffffffffffe
je 0x1400d9cda
mov byte [rax + 2], 0
cmp rax, 0xfffffffffffffffd
je 0x1400d9cda
mov byte [rax + 3], 0
cmp rax, 0xfffffffffffffffc
je 0x1400d9cda
mov byte [rax + 4], 0
cmp rax, 0xfffffffffffffffb
je 0x1400d9cda
mov byte [rax + 5], 0
cmp rax, 0xfffffffffffffffa
je 0x1400d9cda
mov byte [rax + 6], 0
cmp rax, 0xfffffffffffffff9
je 0x1400d9cda
mov byte [rax + 7], 0
cmp rax, 0xfffffffffffffff8
je 0x1400d9cda
mov byte [rax + 8], 0
cmp rax, 0xfffffffffffffff7
je 0x1400d9cda
mov byte [rax + 9], 0
cmp rax, 0xfffffffffffffff6
je 0x1400d9cda
mov byte [rax + 0xa], 0
cmp rax, 0xfffffffffffffff5
je 0x1400d9cda
mov byte [rax + 0xb], 0
cmp rax, 0xfffffffffffffff4
je 0x1400d9cda
mov byte [rax + 0xc], 0
cmp rax, 0xfffffffffffffff3
je 0x1400d9cda
mov byte [rax + 0xd], 0
cmp rax, 0xfffffffffffffff2
je 0x1400d9cda
mov byte [rax + 0xe], 0
cmp rax, 0xfffffffffffffff1
je 0x1400d9cda
mov byte [rax + 0xf], 0
cmp rax, 0xfffffffffffffff0
je 0x1400d9cda
mov byte [rax + 0x10], 0
cmp rax, 0xffffffffffffffef
je 0x1400d9cda
mov byte [rax + 0x11], 0
cmp rax, 0xffffffffffffffee
je 0x1400d9cda
mov byte [rax + 0x12], 0
cmp rax, 0xffffffffffffffed
je 0x1400d9cda
mov byte [rax + 0x13], 0
cmp rax, 0xffffffffffffffec
je 0x1400d9cda
mov byte [rax + 0x14], 0
cmp rax, 0xffffffffffffffeb
je 0x1400d9cda
mov byte [rax + 0x15], 0
cmp rax, 0xffffffffffffffea
je 0x1400d9cda
mov byte [rax + 0x16], 0
cmp rax, 0xffffffffffffffe9
je 0x1400d9cda
mov byte [rax + 0x17], 0
lea r14, [rsp + 0x30]
mov qword [r14 + 8], rcx
mov ebp, 5
lea r13, [rsp + 0x4c]
lea r15, [rsp + 0x50]
mov eax, dword [rsp + 0x4c]
mov r12, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov r8, rcx
sub r8, r12
mov rdx, rax
sub rdx, r8
ja 0x1400d9bf6
jae 0x1400d9c07
lea rdx, [rax + r12]
mov r8, rcx
sub r8, rdx
dec rcx
cmp r8, rcx
jbe 0x1400d9cc4
lea rcx, [0x1402f4f7c]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
call fcn.1401ec0b0
dec ebp
jne 0x1400d9ba6
jmp 0x1400d9c81
mov rcx, r14
call fcn.14003bc40
mov r12, qword [rsp + 0x30]
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], eax
mov rcx, rbx
mov rdx, r15
mov r8d, 1
mov r9, r12
call sub.ntdll.dll_NtQueryValueKey
cmp eax, 0x80000005
je 0x1400d9bed
cmp eax, 0xc0000023
je 0x1400d9bed
test eax, eax
js 0x1400d9c81
mov eax, dword [r12 + 4]
mov dword [rdi], eax
mov r9d, dword [r12 + 0xc]
test r9, r9
je 0x1400d9c85
mov edx, dword [r12 + 8]
add rdx, r12
lea r8, [rdx + r9]
mov rcx, rsi
call fcn.140039040
mov sil, 1
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400d9ca4
mov rax, qword [rsp + 0x38]
mov rdx, rax
sub rdx, rcx
dec rax
cmp rdx, rax
ja 0x1400d9bda
jmp 0x1400d9cce
xor esi, esi
jmp 0x1400d9c5e
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov rdx, rcx
sub rdx, rax
dec rcx
cmp rdx, rcx
ja 0x1400d9bda
mov qword [rsi + 8], rax
jmp 0x1400d9c5b
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401b0080
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x38], rdx
jmp 0x1400d9c07
mov qword [rsp + 0x38], rcx
call fcn.1401ae9b8
jmp 0x1400d9ca4
lea rcx, [0x1402f4f7c]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.1401ec0b0
call fcn.1400d90c0
test al, al
jne 0x1400d9a08
xor esi, esi
jmp 0x1400d9ca4