Function at 0x14010f200
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0x100
cmp qword [r8 + 8], 0
mov rdi, r9
mov r12, r8
mov r14, rdx
mov r15, rcx
jne 0x14010f24b
mov eax, 0xc000000d
add rsp, 0x100
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rcx, qword [0x14023e0f0]
mov qword [rsp + 0xf8], rbx
mov word [rbp - 0x69], cx
lea eax, [rcx + 2]
mov word [rbp - 0x67], ax
mov rax, qword [str.SoftwareMicrosoftWindows_NTCurrentVersionKnownFunctionTableDlls]
mov qword [rbp - 0x61], rax
cmp rcx, 0xfffe
jbe 0x14010f288
mov ebx, 0xc0000106
lfence
mov eax, ebx
jmp 0x14010f570
xor r8d, r8d
lea rax, [rsp + 0x50]
lea r9, [rbp - 0x21]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x69]
lea rcx, [r8 - 3]
call fcn.14011ab40
mov ebx, eax
test eax, eax
js 0x14010f2dc
lea r8, ds:[rbp - 0x21]
mov edx, 0x20019
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
test rcx, rcx
je 0x14010f2d8
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x14010f2e6
lfence
mov eax, ebx
jmp 0x14010f570
mov rcx, qword ds:[rsp + 0x38]
lea rax, [rsp + 0x48]
mov qword [rsp + 0xf0], rsi
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov esi, 2
mov qword [rsp + 0xe8], r13
mov r8d, esi
xor r13d, r13d
mov rdx, r12
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
cmp ebx, 0xc0000034
jne 0x14010f4ca
mov rax, qword [r12 + 8]
lea r9, [rbp + 0x6f]
xorps xmm0, xmm0
mov qword [rbp - 0x49], rax
lea r8, [rbp - 0x79]
mov qword [rbp - 0x2d], r13
lea rdx, [rsp + 0x30]
mov dword [rbp - 0x25], r13d
lea rcx, [rbp - 0x49]
mov dword [rbp - 0x41], 1
movdqu xmmword [rbp - 0x3d], xmm0
call fcn.140168740
test eax, eax
js 0x14010f505
mov edi, dword [rbp + 0x6f]
mov r14, qword [rbp - 0x79]
test edi, edi
je 0x14010f393
mov rcx, qword [r14]
call fcn.140168de0
mov r13, rax
test r14, r14
je 0x14010f3cc
test edi, edi
je 0x14010f3ba
mov rbx, r14
nop
mov rcx, qword [rbx]
mov rax, qword [0x1402457e8]
call qword [case.0x1400f654f.0]
lea rbx, [rbx + 8]
sub rdi, 1
jne 0x14010f3a0
mov rcx, qword [0x140241998]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test r13, r13
je 0x14010f505
cmp dword [rsp + 0x30], esi
jne 0x14010f4e9
cmp qword [r13], 0x2a
jne 0x14010f4e9
cmp byte [0x140244611], 1
lea r14, str.Microsoft_Corporation
mov rdi, qword [r13 + 8]
jb 0x14010f437
nop
movdqu xmm0, xmmword [r14]
movdqu xmm1, xmmword [rdi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14010f42d
add rdi, 0x10
add r14, 0x10
sub rsi, 1
jne 0x14010f400
mov esi, 5
jmp 0x14010f468
shl rsi, 4
add rsi, 0xa
jmp 0x14010f465
mov esi, 5
nop dword [rax]
mov rax, qword [r14]
cmp qword [rdi], rax
jne 0x14010f45d
add rdi, 8
add r14, 8
sub rsi, 1
jne 0x14010f440
mov esi, 1
jmp 0x14010f468
lea rsi, [rsi*8 + 2]
shr rsi, 1
sub r14, rdi
nop dword [rax + rax]
movzx ecx, word [rdi]
movzx r15d, word [r14 + rdi]
cmp cx, r15w
je 0x14010f498
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14010f4e9
add rdi, 2
sub rsi, 1
jne 0x14010f470
lea rcx, [r13 - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14010f4be
call fcn.1400fbcc0
mov r15, qword [rbp + 0x5f]
mov r14, qword [rbp + 0x67]
mov rdi, qword [rbp + 0x77]
lea r9, [rsp + 0x40]
mov r8, r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_LdrLoadDll]
nop dword [rax]
test eax, eax
jns 0x14010f50c
lfence
jmp 0x14010f560
lea rcx, [r13 - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14010f505
nop dword [rax]
call fcn.1400fbcc0
mov eax, 0xc0000361
jmp 0x14010f560
mov rcx, qword [rsp + 0x40]
lea rax, str.OutOfProcessFunctionTableCallback
lea r9, [rbp - 0x71]
mov qword [rbp - 0x51], rax
xor r8d, r8d
mov dword [rbp - 0x59], 0x220021
lea rdx, [rbp - 0x59]
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov ebx, eax
test eax, eax
js 0x14010f553
mov r8, qword [rbp + 0x7f]
mov r9, rdi
mov rax, qword [rbp - 0x71]
mov rdx, r14
mov rcx, r15
call qword [case.0x1400f654f.0]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_LdrUnloadDll]
mov eax, ebx
mov rsi, qword [rsp + 0xf0]
mov r13, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xf8]
add rsp, 0x100
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret