Function at 0x140132740
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140462840]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rdi, rcx
mov r8, qword [rcx + 0x20]
cmp dword [r8 - 0x10], 0
jne 0x14013278d
xor al, al
jmp 0x140132b87
xor r12d, r12d
mov qword [rbp - 0x29], r12
mov dword [rbp - 0x21], r12d
mov qword [rbp - 0x19], r12
mov dword [rbp - 0x49], Ordinal_266
xor r14b, r14b
mov rdx, 0xffffffff80000002
mov r9d, 0x20019
lea rcx, [rbp - 0x29]
call fcn.14008ff80
test eax, eax
jne 0x1401328b3
mov edx, Ordinal_261
lea rcx, [rdi + 0x18]
call qword [sym.imp.mfc120u.dll_Ordinal_4855]
mov rbx, rax
mov ecx, dword [rbp - 0x49]
add ecx, ecx
mov dword [rbp - 0x41], ecx
mov dword [rbp - 0x49], r12d
lea rax, [rbp - 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x39]
xor r8d, r8d
mov rdx, qword [str.SerialNumber]
mov rsi, qword [rbp - 0x29]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140132842
mov eax, dword [rbp - 0x39]
dec eax
cmp eax, 1
ja 0x140132842
mov ecx, dword [rbp - 0x41]
test rbx, rbx
je 0x14013283d
test ecx, ecx
je 0x140132839
test cl, 1
jne 0x140132842
mov eax, ecx
shr rax, 1
cmp word [rbx + rax*2 - 2], r12w
je 0x14013283d
jmp 0x140132842
mov word [rbx], r12w
shr ecx, 1
mov dword [rbp - 0x49], ecx
or edx, 0xffffffff
lea rcx, [rdi + 0x18]
call qword [sym.imp.mfc120u.dll_Ordinal_12110]
lea rax, [rbp - 0x39]
mov qword [rbp - 0x41], rax
lea rdx, [rdi + 0x28]
lea rcx, [rbp - 0x39]
call qword [sym.imp.mfc120u.dll_Ordinal_280]
mov rbx, rax
lea rdx, [rdi + 0x18]
lea rcx, [rbp - 0x11]
call qword [sym.imp.mfc120u.dll_Ordinal_280]
nop
mov r9, rbx
lea r8, [rbp - 0x31]
mov rdx, rax
mov rcx, rdi
call fcn.1401337e0
test al, al
je 0x14013289d
movzx r14d, r14b
mov eax, 1
cmp dword [rdi + 0x30], eax
cmove r14d, eax
test rsi, rsi
je 0x1401328af
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x29], r12
mov dword [rbp - 0x21], r12d
mov r9d, 0x20019
mov r8, qword [rdi + 0x20]
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 0x29]
call fcn.14008ff80
test eax, eax
jne 0x140132b6e
mov dword [rbp - 0x49], Ordinal_266
mov edx, Ordinal_261
mov rcx, rdi
call qword [sym.imp.mfc120u.dll_Ordinal_4855]
mov rsi, rax
mov ecx, dword [rbp - 0x49]
add ecx, ecx
mov dword [rbp - 0x41], ecx
mov dword [rbp - 0x49], r12d
lea rax, [rbp - 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x39]
xor r8d, r8d
mov rdx, qword [str.FirstName]
mov rbx, qword [rbp - 0x29]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140132959
mov eax, dword [rbp - 0x39]
dec eax
cmp eax, 1
ja 0x140132959
mov ecx, dword [rbp - 0x41]
test rsi, rsi
je 0x140132954
test ecx, ecx
je 0x140132950
test cl, 1
jne 0x140132959
mov eax, ecx
shr rax, 1
cmp word [rsi + rax*2 - 2], 0
je 0x140132954
jmp 0x140132959
mov word [rsi], r12w
shr ecx, 1
mov dword [rbp - 0x49], ecx
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.mfc120u.dll_Ordinal_12110]
mov dword [rbp - 0x49], Ordinal_266
mov edx, Ordinal_261
lea rcx, [rdi + 8]
call qword [sym.imp.mfc120u.dll_Ordinal_4855]
mov rsi, rax
mov ecx, dword [rbp - 0x49]
add ecx, ecx
mov dword [rbp - 0x41], ecx
mov dword [rbp - 0x49], r12d
lea rax, [rbp - 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x39]
xor r8d, r8d
mov rdx, qword [str.LastName]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401329e6
mov eax, dword [rbp - 0x39]
dec eax
cmp eax, 1
ja 0x1401329e6
mov ecx, dword [rbp - 0x41]
test rsi, rsi
je 0x1401329e1
test ecx, ecx
je 0x1401329dd
test cl, 1
jne 0x1401329e6
mov eax, ecx
shr rax, 1
cmp word [rsi + rax*2 - 2], 0
je 0x1401329e1
jmp 0x1401329e6
mov word [rsi], r12w
shr ecx, 1
mov dword [rbp - 0x49], ecx
or edx, 0xffffffff
lea rcx, [rdi + 8]
call qword [sym.imp.mfc120u.dll_Ordinal_12110]
mov dword [rbp - 0x49], Ordinal_266
mov edx, Ordinal_261
lea rcx, [rdi + 0x10]
call qword [sym.imp.mfc120u.dll_Ordinal_4855]
mov rsi, rax
mov ecx, dword [rbp - 0x49]
add ecx, ecx
mov dword [rbp - 0x41], ecx
mov dword [rbp - 0x49], r12d
lea rax, [rbp - 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x39]
xor r8d, r8d
mov rdx, qword [str.Company]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140132a74
mov eax, dword [rbp - 0x39]
dec eax
cmp eax, 1
ja 0x140132a74
mov ecx, dword [rbp - 0x41]
test rsi, rsi
je 0x140132a6f
test ecx, ecx
je 0x140132a6b
test cl, 1
jne 0x140132a74
mov eax, ecx
shr rax, 1
cmp word [rsi + rax*2 - 2], 0
je 0x140132a6f
jmp 0x140132a74
mov word [rsi], r12w
shr ecx, 1
mov dword [rbp - 0x49], ecx
or edx, 0xffffffff
lea rcx, [rdi + 0x10]
call qword [sym.imp.mfc120u.dll_Ordinal_12110]
mov dword [rbp - 0x49], Ordinal_266
cmp r14b, 1
jne 0x140132aa7
test rbx, rbx
je 0x140132a9f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r12
mov dil, 1
jmp 0x140132b75
movsd xmm6, qword [0x1402dbe00]
movsd qword [rbp + 0xf], xmm6
movsd qword [rbp - 1], xmm6
mov dword [rbp + 7], 0xffffffff
mov dword [rbp - 0x49], 0x18
lea rax, [rbp - 0x49]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x39]
xor r8d, r8d
mov rdx, qword [str.AppData]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140132b5b
cmp dword [rbp - 0x39], 3
jne 0x140132b5b
movsd xmm1, qword [rbp + 0xf]
ucomisd xmm1, xmm6
jp 0x140132b07
je 0x140132b5b
movsd xmm2, qword [rbp - 1]
ucomisd xmm2, xmm6
jp 0x140132b14
je 0x140132b5b
mov eax, dword [rbp + 7]
cmp eax, 0xffffffff
je 0x140132b5b
xorps xmm0, xmm0
ucomisd xmm1, xmm0
jp 0x140132b33
jne 0x140132b33
mov dword [rdi + 0x80], 2
jmp 0x140132b3f
movsd qword [rdi + 0x78], xmm1
mov dword [rdi + 0x80], r12d
movsd qword [rdi + 0x68], xmm2
mov dword [rdi + 0x70], r12d
mov dword [rdi + 0x88], eax
mov rcx, rdi
call fcn.140132280
movzx edi, al
jmp 0x140132b75
test rbx, rbx
je 0x140132b72
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r12
jmp 0x140132b72
mov rbx, qword [rbp - 0x29]
xor dil, dil
test rbx, rbx
je 0x140132b83
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, dil
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140289bf0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret