Function at 0x140007cf0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r14, r9
mov qword [rsp + 0x38], r9
mov rsi, r8
mov rbx, rdx
mov r12, rcx
xor r15d, r15d
cmp qword [rcx], r15
je 0x140008056
test rdx, rdx
je 0x140008056
test r8, r8
je 0x140008056
mov rcx, rdx
call fcn.1401bad34
mov r10d, eax
xor edx, edx
div dword [r12 + 0x18]
mov r9, qword [r12 + 0x10]
test r9, r9
je 0x140007f24
mov r9, qword [r9 + rdx*8]
test r9, r9
je 0x140007f24
cmp dword [r9 + 0x18], r10d
jne 0x140007d98
mov rax, qword [r9]
mov r8, rbx
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140007d94
add rax, 2
test ecx, ecx
jne 0x140007d80
test edx, edx
je 0x140007d9e
mov r9, qword [r9 + 0x10]
jmp 0x140007d68
mov rax, qword [r9 + 8]
mov qword [rsi], rax
test r14, r14
je 0x14000805c
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], r15w
jne 0x140007dd0
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140005520
mov r13, qword [r12 + 0x40]
mov rdx, qword [r13 + 8]
mov rdi, r13
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
cmp byte [rdx + 0x19], r15b
jne 0x140007e6e
nop dword [rax + rax]
lea rax, [rsp + 0x48]
cmp r14, 8
cmovae rax, rsi
lea r10, [rdx + 0x20]
cmp qword [rdx + 0x38], 8
jb 0x140007e2c
mov r10, qword [rdx + 0x20]
mov r11, qword [rdx + 0x30]
mov rcx, r11
cmp rbx, r11
cmovb rcx, rbx
test rcx, rcx
je 0x140007e57
sub r10, rax
movzx r8d, word [r10 + rax]
cmp r8w, word [rax]
jne 0x140007e5a
add rax, 2
sub rcx, 1
jne 0x140007e42
cmp r11, rbx
jae 0x140007e62
mov rdx, qword [rdx + 0x10]
jmp 0x140007e68
mov rdi, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], r15b
je 0x140007e10
cmp byte [rdi + 0x19], r15b
jne 0x140007ebf
lea rax, [rdi + 0x20]
cmp qword [rdi + 0x38], 8
jb 0x140007e83
mov rax, qword [rdi + 0x20]
lea r9, [rsp + 0x48]
cmp r14, 8
cmovae r9, rsi
mov r10, qword [rdi + 0x30]
mov rcx, rbx
cmp r10, rbx
cmovb rcx, r10
test rcx, rcx
je 0x140007eba
sub r9, rax
movzx edx, word [r9 + rax]
cmp dx, word [rax]
jne 0x140007ef7
add rax, 2
sub rcx, 1
jne 0x140007ea6
cmp rbx, r10
jae 0x140007ec2
mov rdi, r13
cmp r14, 8
jb 0x140007f03
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140007efb
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008082
jmp 0x140007efb
jb 0x140007ebf
jmp 0x140007ec2
mov rcx, rsi
call fcn.1400079c0
cmp rdi, qword [r12 + 0x40]
je 0x140007f19
mov eax, dword [rdi + 0x40]
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
jmp 0x14000805c
mov r15d, 0x80010080
jmp 0x14000805c
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140008047
mov ecx, dword [rsp + 0x30]
call fcn.140064a50
mov rdi, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140008047
mov qword [rsi], rdi
lea rcx, [r12 + 8]
mov rdx, rbx
call fcn.140008fe0
mov qword [rax], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140007fc0
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140005520
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x88], eax
lea rcx, [r12 + 0x40]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x48]
call fcn.140008da0
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x140008039
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008034
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008088
call fcn.1400079c0
test r14, r14
je 0x14000804d
mov eax, dword [rsp + 0x30]
mov dword [r14], eax
jmp 0x14000804d
mov r15d, 0x80010080
jmp 0x14000805c
mov r15d, 0x80010001
mov eax, r15d
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1401e2900
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.1401ec41c
nop
call fcn.1401ec41c
nop
int3