Function at 0x14005adb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140129b78]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor r13d, r13d
mov rax, qword [0x1401600c0]
cmp rax, 0x13
jb 0x14005ae2f
lea rbx, [0x1401600a8]
cmp rax, 0x10
cmovae rbx, qword [0x1401600a8]
mov qword [0x1401600b8], 0x13
lea r8d, [r13 + 0x13]
lea rdx, str.Opening_Emulator...
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x13], r13b
jmp 0x14005ae49
lea r9, str.Opening_Emulator...
xor r8d, r8d
lea edx, [r8 + 0x13]
lea rcx, [0x1401600a8]
call fcn.1400576a0
cmp dword [0x14015fdac], r13d
jle 0x14005af0f
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], recv
mov qword [rbp - 0x50], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.Emulator...]
movsd qword [rbp - 0x68], xmm0
movzx eax, word [0x1400f9890]
mov word [rbp - 0x60], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_46]
mov byte [rbp - 0x5e], al
mov byte [rbp - 0x5d], r13b
mov rax, qword [0x1401604e8]
cmp rax, qword [0x1401604f0]
je 0x14005aeb9
lea rdx, [rbp - 0x68]
mov rcx, rax
call fcn.1400583a0
add qword [0x1401604e8], 0x20
jmp 0x14005aecd
lea r8, [rbp - 0x68]
mov rdx, rax
lea rcx, [0x1401604e0]
call fcn.140057270
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x14005af08
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005af03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005b65e
call fcn.1400c911c
mov dword [0x14015fdac], r13d
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], reloc.WS2_32.dll_ntohs
mov edx, Ordinal_50
lea rcx, [rbp - 0x28]
call fcn.140063790
mov rcx, rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], Ordinal_46
mov qword [rbp - 0x10], Ordinal_50
movups xmm0, xmmword [str.SOFTWAREWOW6432NodeTencentMobileGamePC_]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400f98a8]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1400f98b8]
movsd qword [rax + 0x20], xmm0
movzx eax, word [0x1400f98c0]
mov word [rcx + 0x28], ax
mov byte [rcx + 0x2a], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400fcb70]
movdqu xmmword [rbp + 0x60], xmm1
mov byte [rbp + 0x50], 0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
mov qword [rbp + 0x48], r13
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14005b621
mov dword [rbp - 0x70], r13d
mov rsi, qword [rbp - 0x18]
movabs r12, 0x7fffffffffffffff
mov rax, r12
sub rax, rsi
cmp rax, 2
jb 0x14005b6b2
lea r15, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae r15, qword [rbp - 0x28]
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x28], xmm1
lea r14, [rsi + 2]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp + 0x18]
movabs rcx, 0x8000000000000000
lea eax, [rbx + 7]
cmp r14, rbx
jbe 0x14005b09a
mov rbx, r14
or rbx, 0xf
cmp rbx, r12
jbe 0x14005b061
mov rbx, r12
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.1400c90e0
test rax, rax
je 0x14005b615
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005b096
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005b084
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005b6a0
jmp 0x14005b042
test rcx, rcx
je 0x14005b093
call fcn.1400c90e0
mov rdi, rax
jmp 0x14005b096
mov rdi, r13
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x30], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + rsi], 0x4955
mov byte [rdi + r14], 0
lea rdx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0x10
cmovae rdx, qword [rbp + 0x18]
lea r8, [rbp - 0x80]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x14005b5e3
mov dword [rbp - 0x70], 0xff
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.InstallPath
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14005b5d8
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r13
lea rax, [rbp + 0x70]
mov rdi, 0xffffffffffffffff
mov rbx, rdi
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14005b150
cmp rbx, r12
ja 0x14005b6b8
cmp rbx, 0x10
jae 0x14005b197
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], reloc.WS2_32.dll_ntohs
mov r8, rbx
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x68]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x68], 0
mov r14, qword [rbp - 0x50]
mov rbx, qword [rbp - 0x58]
mov r12, qword [rbp - 0x68]
jmp 0x14005b1e5
mov r14, rbx
or r14, 0xf
cmp r14, r12
jbe 0x14005b1a8
mov r14, r12
jmp 0x14005b1b5
cmp r14, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb r14, rax
lea rdx, [r14 + 1]
lea rcx, [rbp - 0x68]
call fcn.140063790
mov r12, rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], r14
mov r8, rbx
lea rdx, [rbp + 0x70]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + rbx], 0
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rbx
cmp rax, 0x16
jb 0x14005b6be
lea rax, [rbp - 0x68]
cmp r14, 0x10
cmovae rax, r12
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], r13
lea r13, [rbx + 0x16]
mov esi, reloc.WS2_32.dll_ntohs
lea r15, [rbp - 0x48]
cmp r13, rsi
jbe 0x14005b2ba
mov rsi, r13
or rsi, 0xf
cmp rsi, rcx
jbe 0x14005b276
mov rsi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400c90e0
test rax, rax
je 0x14005b581
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
mov rax, qword [rsp + 0x30]
jmp 0x14005b2b6
cmp rsi, 0x16
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14005b29f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005b6a6
jmp 0x14005b252
test rcx, rcx
je 0x14005b2b3
call fcn.1400c90e0
mov r15, rax
mov rax, qword [rsp + 0x30]
jmp 0x14005b2b6
xor r15d, r15d
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], rsi
mov r8, rbx
mov rdx, rax
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.AndroidEmulatorEn.exe]
movups xmmword [rbx + r15], xmm0
mov eax, dword [0x1400f98e8]
mov dword [rbx + r15 + 0x10], eax
movzx eax, word [0x1400f98ec]
mov word [rbx + r15 + 0x14], ax
mov byte [r15 + r13], 0
mov rcx, qword [rbp - 0x30]
mov rax, rcx
mov r8, qword [rbp - 0x38]
sub rax, r8
cmp rax, 1
jb 0x14005b332
inc r8
mov qword [rbp - 0x38], r8
lea rbx, [rbp - 0x48]
cmp rcx, 0x10
cmovae rbx, qword [rbp - 0x48]
lea rcx, [rbx + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx], Ordinal_35
jmp 0x14005b353
mov byte [rsp + 0x28], Ordinal_35
mov qword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, [rbp - 0x48]
call fcn.140057970
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
lea r8d, [rbx + 5]
lea rdx, str..exe_
lea rcx, [rsp + 0x60]
call fcn.140057130
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
lea r8d, [rbx + 4]
lea rdx, str..exe
lea rcx, [rsp + 0x38]
call fcn.140057130
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x48]
call fcn.1400647f0
mov r13, qword [rbp - 0x38]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 8
jb 0x14005b69a
lea rax, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rax, qword [rbp - 0x48]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
lea r15, [r13 + 8]
mov ebx, reloc.WS2_32.dll_ntohs
lea rsi, [rbp - 8]
cmp r15, rbx
jbe 0x14005b49f
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x14005b455
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400c90e0
test rax, rax
je 0x14005b47e
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
mov rax, qword [rsp + 0x30]
jmp 0x14005b49b
cmp rbx, 0x16
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005b485
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005b6ac
jmp 0x14005b435
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14005b499
call fcn.1400c90e0
mov rsi, rax
mov rax, qword [rsp + 0x30]
jmp 0x14005b49b
xor esi, esi
mov qword [rbp - 8], rsi
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], rbx
mov r8, r13
mov rdx, rax
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movabs rax, 0x303031206d762d20
mov qword [rsi + r13], rax
mov byte [rsi + r15], 0
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae rdx, qword [rbp - 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
nop word [rax + rax]
inc rdi
cmp byte [rdx + rdi], bl
jne 0x14005b4f0
mov r8, rdi
lea rcx, [rsp + 0x38]
call fcn.140057130
lea rcx, [rsp + 0x38]
call fcn.140063910
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x14005b54f
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b549
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b549
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c911c
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14005b58d
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b588
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b588
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c911c
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x48], 0
cmp r14, 0x10
jb 0x14005b5d8
lea rdx, [r14 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x14005b5d0
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b5d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.1400c911c
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x14005b621
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b61c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b61c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c911c
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x14005b66a
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b665
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b665
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c911c
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400c90c0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140063730
nop
call fcn.1400636d0
nop
call fcn.1400636d0
nop
call fcn.1400636d0
nop
call fcn.140063730
nop
call fcn.140063730
nop
call fcn.140063730
int3