Function at 0x140033d10
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0xd8]
sub rsp, 0x1d8
mov rbx, qword [rcx]
mov rdx, rcx
mov rdi, rcx
mov r8, qword [rbx + 8]
call fcn.1400316d0
mov qword [rbx + 8], rbx
lea rax, [rsp + 0x48]
mov qword [rbx], rbx
lea rdx, str.SYSTEMCurrentControlSetControlNlsCalendarsJapaneseEras
mov qword [rbx + 0x10], rbx
xor esi, esi
mov r9d, 0x20219
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rdi + 8], rsi
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x48], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140033f0a
xorps xmm0, xmm0
lea rcx, [rbp - 0x2e]
xor eax, eax
xor edx, edx
mov r8d, 0xfe
mov qword [rbp - 0x3e], rax
movups xmmword [rsp + 0x52], xmm0
mov dword [rbp - 0x36], eax
movups xmmword [rsp + 0x62], xmm0
mov word [rbp - 0x32], ax
movups xmmword [rsp + 0x72], xmm0
movups xmmword [rbp - 0x7e], xmm0
movups xmmword [rbp - 0x6e], xmm0
movups xmmword [rbp - 0x5e], xmm0
movups xmmword [rbp - 0x4e], xmm0
call fcn.14001e060
mov rcx, qword [rsp + 0x48]
lea rax, [rbp + 0x108]
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x110]
lea rax, [rbp - 0x30]
mov word [rsp + 0x50], si
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x50]
lea rax, [rbp + 0x100]
mov word [rbp - 0x30], si
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rsi
mov ebx, esi
mov dword [rbp + 0x110], 0x3f
mov dword [rbp + 0x108], 0xfe
mov dword [rbp + 0x100], 1
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140033eff
nop dword [rax + rax]
cmp dword [rbp + 0x100], 1
jne 0x140033e8f
lea rax, [rbp + 0x118]
mov dword [rsp + 0x44], esi
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x44]
mov dword [rsp + 0x40], esi
lea rdx, str._d__d__d
mov dword [rbp + 0x118], esi
lea rcx, [rsp + 0x50]
call fcn.140034ab0
mov r9d, dword [rbp + 0x118]
lea rax, [rbp - 0x30]
mov r8d, dword [rsp + 0x40]
mov rcx, rdi
mov edx, dword [rsp + 0x44]
mov qword [rsp + 0x20], rax
call fcn.140033400
mov rcx, qword [rsp + 0x48]
lea rax, [rbp + 0x108]
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x110]
lea rax, [rbp - 0x30]
mov word [rsp + 0x50], si
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x50]
lea rax, [rbp + 0x100]
mov word [rbp - 0x30], si
mov qword [rsp + 0x28], rax
inc ebx
mov edx, ebx
mov qword [rsp + 0x20], rsi
mov dword [rbp + 0x110], 0x3f
mov dword [rbp + 0x108], 0xfe
mov dword [rbp + 0x100], 1
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x140033e30
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rdi + 8]
test rax, rax
jne 0x140033fa9
mov r9d, 1
lea rax, [0x140056938]
mov r8d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0x74c
mov rcx, rdi
call fcn.140033400
mov r9d, 0x1e
lea rax, str.Yck_
mov edx, 0x778
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea r8d, [r9 - 0x17]
call fcn.140033400
mov r9d, 0x19
lea rax, [0x140056978]
mov edx, 0x786
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea r8d, [r9 - 0xd]
call fcn.140033400
mov r9d, 8
lea rax, [0x140056998]
mov edx, 0x7c5
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea r8d, [r9 - 7]
call fcn.140033400
mov rax, qword [rdi + 8]
test rax, rax
setne al
add rsp, 0x1d8
pop rdi
pop rsi
pop rbx
pop rbp
ret