Function at 0x140081db0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x268
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1d0], xmm6
mov qword [rbp + 0x1c8], 0xfffffffffffffffe
mov r15, rcx
mov qword [rcx + 0x48], rdx
lea rsi, [rbp - 0x3c]
xor r14d, r14d
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi - 4], 0x11c
mov byte [rsi + 0x116], 1
xor ecx, ecx
mov edx, 0x80
mov r8b, 1
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea rcx, [rbp - 0x40]
mov edx, 0x80
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
sete byte [r15 + 0x5c]
mov dword [rbp + 0x19c], 0
lea rax, [rbp + 0x190]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140081fd9
mov rdi, qword [rbp + 0x190]
mov qword [rbp + 0x170], rdi
lea r8, [r15 + 0x50]
lea rdx, str.CurrentMajorVersionNumber
mov rcx, rdi
call fcn.140082df1
test al, al
je 0x140081fc8
lea r8, [r15 + 0x54]
mov rcx, qword [rbp + 0x190]
lea rdx, str.CurrentMinorVersionNumber
call fcn.140082df1
test al, al
je 0x140081fc8
mov rcx, qword [rbp + 0x190]
lea rax, [rbp + 0x100]
mov dword [rax], 0xa
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
lea rdx, str.CurrentBuildNumber
lea r9, [rbp + 0x148]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140081fc8
cmp dword [rbp + 0x148], 1
jne 0x140081fc8
mov eax, dword [rbp + 0x100]
xor ecx, ecx
mov byte [rbp + rax + 0x1a0], cl
lea rsi, [rbp - 0x40]
mov qword [rsi], 0
movaps xmm0, xmmword [section..rdata]
movups xmmword [rsi + 0x10], xmm0
mov byte [rsi], cl
lea rbx, [rbp + 0x1a0]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, rsi
mov rdx, rbx
mov r8, rax
call fcn.14000136e
lea rcx, [rbp - 0x40]
lea rdx, [rbp + 0x120]
call fcn.1400564d4
mov ebx, eax
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x140081f9b
mov rcx, qword [rbp - 0x40]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140081f96
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x140082904
add rax, 0x28
mov rdx, rax
mov rcx, rsi
call fcn.1400e7768
test bl, bl
je 0x140081fc8
mov eax, dword [rbp + 0x120]
mov dword [r15 + 0x58], eax
mov rcx, qword [rbp + 0x190]
lea rdx, [0x140147d84]
lea r8, [rbp + 0x19c]
call fcn.140082df1
mov r14d, eax
jmp 0x140081fcb
xor r14d, r14d
test rdi, rdi
je 0x140081fd9
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r12, [rbp + 0x170]
mov qword [r12], 0
movaps xmm0, xmmword [0x140115390]
movups xmmword [r12 + 0x10], xmm0
mov word [r12], 0
lea r9, [0x1401201a0]
mov edx, 0xc
mov rcx, r12
call fcn.14000a448
lea rcx, [rbp + 0x1a0]
mov rdx, r12
call fcn.1400374a8
lea rcx, [rbp + 0x1a0]
lea rdx, [rbp - 0x40]
call fcn.140081388
mov ebx, eax
lea rsi, [rbp + 0x1a0]
mov rcx, rsi
call fcn.140009ffe
mov rax, qword [rbp + 0x188]
cmp rax, 8
jb 0x14008208c
mov rcx, qword [rbp + 0x170]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140082087
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x1400828cd
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rdi
call fcn.1400e7768
test bl, bl
je 0x1400828b2
mov ebx, dword [rbp - 0x24]
mov qword [rbp + 0x1a0], 0
movaps xmm6, xmmword [section..rdata]
movups xmmword [rbp + 0x1b0], xmm6
mov byte [rbp + 0x1a0], 0
test bl, 1
jne 0x1400820c0
xor eax, eax
jmp 0x1400820ea
mov qword [rbp + 0x1b0], 6
mov dword [rbp + 0x1a0], 0x75626544
mov word [rbp + 0x1a4], 0x2c67
mov byte [rbp + 0x1a6], 0
mov eax, 6
test bl, 4
je 0x140082117
lea rcx, [rax + 8]
mov qword [rbp + 0x1b0], rcx
movabs rdx, 0x2c64656863746150
mov qword [rbp + rax + 0x1a0], rdx
mov byte [rbp + rax + 0x1a8], 0
mov rax, rcx
test bl, 2
je 0x140082179
lea rcx, [rax - 5]
cmp rcx, 0xb
jae 0x140082149
mov qword [rsp + 0x20], send
lea r9, str.Prerelease_
lea rcx, [rbp + 0x1a0]
mov edx, 0xb
call fcn.1400022ee
jmp 0x140082179
lea rcx, [rax + 0xb]
mov qword [rbp + 0x1b0], rcx
movabs rcx, 0x61656c6572657250
mov qword [rbp + rax + 0x1a0], rcx
mov dword [rbp + rax + 0x1a7], 0x2c657361
mov byte [rbp + rax + 0x1ab], 0
test bl, 8
je 0x1400821e6
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov rdx, rcx
sub rdx, rax
cmp rdx, 8
jae 0x1400821bb
mov qword [rsp + 0x20], 8
lea r9, str.Private_
lea rcx, [rbp + 0x1a0]
mov edx, 8
call fcn.1400022ee
jmp 0x1400821e6
lea rdx, [rax + 8]
mov qword [rbp + 0x1b0], rdx
cmp rcx, 0x10
jb 0x1400821d3
mov rsi, qword [rbp + 0x1a0]
movabs rcx, 0x2c65746176697250
mov qword [rsi + rax], rcx
mov byte [rsi + rax + 8], 0
test bl, 0x20
je 0x14008225c
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov rdx, rcx
sub rdx, rax
cmp rdx, 8
jae 0x140082228
mov qword [rsp + 0x20], 8
lea r9, str.Special_
lea rcx, [rbp + 0x1a0]
mov edx, 8
call fcn.1400022ee
jmp 0x14008225c
lea rdx, [rax + 8]
mov qword [rbp + 0x1b0], rdx
cmp rcx, 0x10
jb 0x140082242
mov rcx, qword [rbp + 0x1a0]
jmp 0x140082249
lea rcx, [rbp + 0x1a0]
movabs rdx, 0x2c6c616963657053
mov qword [rcx + rax], rdx
mov byte [rcx + rax + 8], 0
mov rax, qword [rbp + 0x1b0]
test rax, rax
je 0x14008229f
lea r8, [rax - 1]
mov qword [rbp + 0x170], 0
movups xmmword [rbp + 0x180], xmm6
mov byte [rbp + 0x170], 0
cmp rax, r8
cmovb r8, rax
cmp qword [rbp + 0x1b8], 0x10
jb 0x1400822bd
mov rdx, qword [rbp + 0x1a0]
jmp 0x1400822c4
movups xmm0, xmmword [rbp + 0x1a0]
movups xmm1, xmmword [rbp + 0x1b0]
movaps xmmword [rbp + 0x180], xmm1
movaps xmmword [rbp + 0x170], xmm0
jmp 0x140082315
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x170]
call fcn.14000136e
mov rax, qword [rbp + 0x1b8]
cmp rax, 0x10
jb 0x140082315
mov rcx, qword [rbp + 0x1a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140082310
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1400828dc
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400e7768
mov eax, dword [rbp - 0x20]
not eax
mov qword [rbp + 0x1b8], send
test eax, 0x40004
jne 0x14008235a
mov qword [rbp + 0x1b0], 0xa
movabs rax, 0x2073776f646e6957
mov qword [rbp + 0x1a0], rax
mov word [rbp + 0x1a8], 0x544e
mov byte [rbp + 0x1aa], 0
jmp 0x140082380
mov qword [rbp + 0x1b0], 7
mov dword [rbp + 0x1a0], 0x6e6b6e55
mov dword [rbp + 0x1a3], 0x6e776f6e
mov byte [rbp + 0x1a7], 0
test r14b, r14b
je 0x14008238e
mov r8d, dword [rbp + 0x19c]
jmp 0x1400823bd
mov eax, dword [rbp - 0x38]
mov ecx, eax
shr ecx, 0x10
mov dword [r15 + 0x50], ecx
mov ecx, 0xffff
and eax, ecx
mov dword [r15 + 0x54], eax
mov r8d, dword [rbp - 0x34]
mov eax, r8d
shr eax, 0x10
mov dword [r15 + 0x58], eax
and r8d, ecx
mov dword [rbp + 0x19c], r8d
lea rdx, [0x14013a04b]
lea rsi, [rbp + 0x148]
mov rcx, rsi
call fcn.140048ce8
lea r14, [r15 + 0x28]
cmp r14, rsi
je 0x140082433
mov rax, qword [r15 + 0x40]
cmp rax, 0x10
jb 0x14008241a
mov rcx, qword [r14]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140082415
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1400828e1
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400e7768
movups xmm0, xmmword [rbp + 0x148]
movups xmm1, xmmword [rbp + 0x158]
movups xmmword [r14 + 0x10], xmm1
movups xmmword [r14], xmm0
jmp 0x140082478
mov rax, qword [rbp + 0x160]
cmp rax, 0x10
jb 0x140082478
mov rcx, qword [rbp + 0x148]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140082473
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1400828fa
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400e7768
mov r13, qword [rbp + 0x180]
test r13, r13
je 0x14008250d
lea rbx, [rbp + 0xe0]
mov qword [rbx], 0
movups xmmword [rbx + 0x10], xmm6
mov byte [rbx], 0
mov byte [rbp + 0x1c5], 1
lea rdx, [0x140145c40]
mov r8d, 2
mov rcx, rbx
call fcn.14000136e
mov r8, qword [rbp + 0x180]
cmp qword [rbp + 0x188], 0x10
jb 0x1400824d1
mov r12, qword [rbp + 0x170]
mov rcx, qword [rbp + 0xf0]
mov rax, qword [rbp + 0xf8]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x140082519
mov byte [rbp + 0x1c6], 1
mov qword [rsp + 0x20], r8
lea rcx, [rbp + 0xe0]
mov rdx, r8
mov r9, r12
call fcn.1400022ee
mov rbx, rax
jmp 0x140082543
lea rax, [0x140147ab9]
jmp 0x1400825f7
lea rsi, [rcx + r8]
mov qword [rbp + 0xf0], rsi
mov rdi, rbx
cmp rax, 0x10
jb 0x140082534
mov rdi, qword [rbp + 0xe0]
add rcx, rdi
mov rdx, r12
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rsi], 0
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movaps xmmword [rbp + 0x130], xmm1
movaps xmmword [rbp + 0x120], xmm0
movups xmmword [rbx + 0x10], xmm6
mov byte [rbx], 0
mov rcx, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x138]
cmp rdx, rcx
jne 0x14008259c
mov byte [rbp + 0x1c7], 1
mov qword [rsp + 0x20], 1
lea r9, [0x140145c19]
lea rcx, [rbp + 0x120]
mov edx, 1
call fcn.1400022ee
jmp 0x1400825c1
lea rbx, [rcx + 1]
lea rax, [rbp + 0x120]
mov qword [rax + 0x10], rbx
mov rbx, rax
cmp rdx, 0x10
jb 0x1400825bb
mov rbx, qword [rbp + 0x120]
mov word [rbx + rcx], 0x29
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp + 0x110], xmm1
movaps xmmword [rbp + 0x100], xmm0
movups xmmword [rax + 0x10], xmm6
mov byte [rax], 0
cmp qword [rbp + 0x118], 0x10
jb 0x1400825f0
mov rax, qword [rbp + 0x100]
jmp 0x1400825f7
lea rax, [rbp + 0x100]
test r13, r13
setne bl
cmp qword [r15 + 0x40], 0x10
jb 0x140082608
mov r14, qword [r15 + 0x28]
mov ecx, dword [r15 + 0x58]
mov edx, dword [r15 + 0x54]
mov r9d, dword [r15 + 0x50]
cmp qword [rbp + 0x1b8], 0x10
mov qword [rbp + 0x168], r13
mov byte [rbp + 0x1c4], bl
jb 0x140082634
mov r8, qword [rbp + 0x1a0]
jmp 0x14008263b
lea r8, [rbp + 0x1a0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rdx, str._s__u._u._u._s_s
lea rsi, [rbp + 0x148]
mov rcx, rsi
call fcn.140048ce8
lea rdi, [r15 + 8]
cmp rdi, rsi
je 0x1400826d3
mov rax, qword [r15 + 0x20]
cmp rax, 0x10
mov rsi, qword [rbp + 0x168]
jb 0x1400826b1
mov rcx, qword [rdi]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400826ac
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1400828e6
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400e7768
movups xmm0, xmmword [rbp + 0x148]
movups xmm1, xmmword [rbp + 0x158]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov qword [rbp + 0x160], send
jmp 0x14008271f
mov rax, qword [rbp + 0x160]
cmp rax, 0x10
mov rsi, qword [rbp + 0x168]
jb 0x14008271f
mov rcx, qword [rbp + 0x148]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14008271a
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1400828ff
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400e7768
mov qword [rbp + 0x158], 0
mov qword [rbp + 0x160], send
mov byte [rbp + 0x148], 0
test rsi, rsi
je 0x140082830
mov rax, qword [rbp + 0x118]
cmp rax, 0x10
jb 0x14008278a
mov rcx, qword [rbp + 0x100]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140082785
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1400828eb
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400e7768
movaps xmmword [rbp + 0x110], xmm6
mov byte [rbp + 0x100], 0
mov rax, qword [rbp + 0x138]
cmp rax, 0x10
jb 0x1400827dd
mov rcx, qword [rbp + 0x120]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400827d8
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1400828f0
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400e7768
movaps xmmword [rbp + 0x130], xmm6
mov byte [rbp + 0x120], 0
mov rax, qword [rbp + 0xf8]
cmp rax, 0x10
jb 0x140082830
mov rcx, qword [rbp + 0xe0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14008282b
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1400828f5
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400e7768
mov rax, qword [rbp + 0x1b8]
cmp rax, 0x10
jb 0x140082871
mov rcx, qword [rbp + 0x1a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14008286c
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1400828d2
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400e7768
mov rax, qword [rbp + 0x188]
cmp rax, 0x10
jb 0x1400828b2
mov rcx, qword [rbp + 0x170]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400828ad
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1400828d7
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400e7768
movaps xmm6, xmmword [rbp + 0x1d0]
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3