Function at 0x14001b090
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rbp + 0x130], rax
mov rbx, rdx
mov r15, rcx
mov rcx, rbx
xor edx, edx
mov r8d, 0x140
call fcn.140133cb0
xorps xmm0, xmm0
mov dword [rbp + 0x10], 0x9c
xor eax, eax
mov dword [rsp + 0x70], __WSAFDIsSet
lea rcx, str.KERNEL32.DLL
mov qword [rbp + 0xa4], rax
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
movups xmmword [rbp + 0x64], xmm0
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r13d, 1
test rax, rax
je 0x14001b330
lea rdx, [0x1401c38c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001b330
lea rcx, [rbp + 0x10]
call rax
test eax, eax
je 0x14001b330
movzx r9d, word [rbp + 0xa8]
mov r11d, 0x200
movzx r10d, byte [rbp + 0xa8]
mov ecx, dword [rbp + 0xa8]
movzx eax, r10b
and ecx, r13d
mov edx, ecx
or edx, 2
and al, 2
movzx eax, r10b
cmove edx, ecx
mov ecx, edx
or ecx, 0x10
and al, 0x10
movzx eax, r10b
cmove ecx, edx
mov edx, ecx
or edx, 0x20
and al, 0x80
movzx eax, r9w
cmove edx, ecx
mov ecx, edx
or ecx, 0x40
and ax, r11w
movzx eax, r9w
cmove ecx, edx
mov edx, 0x400
and ax, dx
mov edx, ecx
bts edx, 7
test ax, ax
movzx eax, r10b
cmove edx, ecx
mov ecx, 0x100
mov r8d, edx
or r8d, ecx
and al, 0x40
movzx eax, r9w
cmove r8d, edx
and ax, cx
mov ecx, r8d
mov edx, 0x4000
or ecx, r11d
test ax, ax
movzx eax, r9w
cmove ecx, r8d
and ax, dx
mov edx, ecx
bts edx, 0x12
test ax, ax
movzx eax, r9w
cmove edx, ecx
mov ecx, 0x2000
mov r8d, edx
bts r8d, 0x13
and ax, cx
mov ecx, 0x1000
movzx eax, r9w
cmove r8d, edx
and ax, cx
mov ecx, r8d
bts ecx, 0x14
test ax, ax
cmove ecx, r8d
mov eax, ecx
bts eax, 0x15
and r10b, 4
cmove eax, ecx
bt r9w, 0xf
jae 0x14001b27b
bts eax, 0x1c
movzx ecx, byte [rbp + 0xaa]
xor edi, edi
mov dword [rbx + 0x130], eax
sub ecx, r13d
je 0x14001b2a7
sub ecx, r13d
je 0x14001b2a0
cmp ecx, r13d
jne 0x14001b2aa
mov edi, 2
jmp 0x14001b2aa
mov edi, 3
jmp 0x14001b2aa
mov edi, r13d
mov eax, dword [rbp + 0x20]
mov rcx, r15
mov r9d, dword [rbp + 0x1c]
mov r8d, dword [rbp + 0x18]
mov edx, dword [rbp + 0x14]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], eax
movzx eax, word [rbp + 0xa6]
mov word [rsp + 0x30], ax
movzx eax, word [rbp + 0xa4]
mov word [rsp + 0x28], ax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
mov dword [rbx + 0x13c], edi
call fcn.14001c280
cmp dword [rbx + 0x13c], r13d
je 0x14001b690
movzx eax, byte [rbp + 0xa8]
test al, 2
jne 0x14001b690
test al, 0x20
jne 0x14001b690
test al, al
js 0x14001b690
or dword [rbx + 0x134], 0x20
mov eax, r13d
jmp 0x14001b697
xor edi, edi
lea rcx, str.KERNEL32.DLL
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14001b4de
lea rdx, [0x1401c38c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001b368
lea rcx, [rsp + 0x70]
call rax
mov esi, eax
test esi, esi
je 0x14001b4de
mov r10d, dword [rbp - 0x80]
movzx ecx, di
mov qword [rsp + 0x290], r12
movzx r12d, di
cmp r10d, 2
jne 0x14001b43f
mov ecx, edi
lea rdx, [rbp - 0x7c]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rdx + rax], cl
jne 0x14001b3a0
test rax, rax
je 0x14001b3f0
movzx eax, byte [rbp - 0x7c]
mov r14d, edi
test al, al
je 0x14001b3da
lea rsi, [rbp - 0x7c]
nop dword [rax]
movsx ecx, al
call fcn.1401438ec
test eax, eax
jne 0x14001b3da
movzx eax, byte [rsi + 1]
inc rsi
inc r14d
test al, al
jne 0x14001b3c0
movsxd rax, r14d
lea rcx, [rbp - 0x7c]
add rcx, rax
call fcn.140143b80
mov r10d, dword [rbp - 0x80]
movzx ecx, ax
mov edx, dword [rsp + 0x74]
mov r9d, dword [rsp + 0x7c]
mov r8d, dword [rsp + 0x78]
mov qword [rsp + 0x48], rbx
lea rax, [rbp - 0x7c]
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], r10d
mov word [rsp + 0x30], r12w
mov word [rsp + 0x28], cx
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.14001c280
cmp dword [rbp - 0x80], 2
mov r12, qword [rsp + 0x290]
jne 0x14001b690
jmp 0x14001b5d8
cmp r10d, r13d
jne 0x14001b3f0
mov edx, dword [rsp + 0x74]
mov r9d, dword [rsp + 0x7c]
cmp edx, 4
jne 0x14001b466
lea eax, [r9 - 0x3b7]
cmp eax, 0x81
ja 0x14001b466
movzx ecx, r13w
jmp 0x14001b3f9
mov r8d, dword [rsp + 0x78]
cmp edx, 4
jne 0x14001b3fe
cmp r8d, 0xa
jae 0x14001b48c
lea eax, [r9 - 0x439]
cmp eax, 0x84
ja 0x14001b48c
lea ecx, [rdx - 2]
jmp 0x14001b3fe
cmp edx, 4
jne 0x14001b3fe
cmp r8d, 0xa
jae 0x14001b4b0
cmp r9d, 0x4be
jb 0x14001b4b0
lea ecx, [rdx - 2]
lea r12d, [rdx + 1]
jmp 0x14001b3fe
cmp edx, 4
jne 0x14001b3fe
cmp r8d, 0xa
jne 0x14001b3fe
lea eax, [r9 - 0x7cf]
cmp eax, 0xb7
ja 0x14001b3fe
movzx ecx, r13w
jmp 0x14001b3fe
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14001b695
lea rdx, [0x1401c38b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001b695
call rax
mov r14d, eax
mov qword [rsp + 0x58], rdi
lea rax, [rsp + 0x58]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
mov esi, edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001b599
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rbp + 0xb0]
mov dword [rsp + 0x54], 0x80
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CurrentBuildNumber
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001b58e
lea rcx, [rbp + 0xb0]
call fcn.140143b80
mov esi, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbx
mov eax, 2
mov dword [rsp + 0x40], edi
mov r9d, esi
mov dword [rsp + 0x38], eax
mov rcx, r15
movzx r8d, r14w
lea rax, [0x14019526c]
mov word [rsp + 0x30], di
mov word [rsp + 0x28], di
shr r8d, 8
movzx edx, r14b
mov qword [rsp + 0x20], rax
call fcn.14001c280
mov rdx, rbx
call fcn.14001b6c0
cmp dword [rbx + 0x13c], r13d
je 0x14001b603
movzx eax, byte [rbp + 0xa8]
test al, 2
jne 0x14001b603
test al, 0x20
jne 0x14001b603
test al, al
js 0x14001b603
or dword [rbx + 0x134], 0x20
lea rax, [rsp + 0x58]
mov qword [rsp + 0x58], rdi
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetControlTerminal_Server
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001b690
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], r13d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.TSAppCompat
mov dword [rsp + 0x54], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001b685
cmp dword [rsp + 0x50], edi
jne 0x14001b685
mov r11d, 0x200
or dword [rbx + 0x130], r11d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r13d
jmp 0x14001b697
xor eax, eax
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.1401312c0
add rsp, 0x240
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret