Function at 0x1400c8450
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x1401b8010]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r13d, r13d
mov dword [rbp - 1], r13d
mov qword [rbp - 0x19], r13
mov r15d, 0x40
mov edx, r15d
lea rcx, [rbp - 0x19]
call fcn.14001c030
test al, al
je 0x1400c8cef
mov rcx, qword [rbp - 0x19]
movups xmm0, xmmword [str.CentralSeamlessUrl]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x14015f8e8]
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [0x14015f8f8]
mov dword [rcx + 0x20], eax
mov rax, qword [rbp - 0x19]
test rax, rax
je 0x1400c8cef
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400c8cef
cmp qword [rcx + 0x10], 0x12
jb 0x1400c8cef
mov qword [rcx + 8], 0x12
mov rax, qword [rbp - 0x19]
mov word [rax + 0x24], r13w
mov rax, qword [rbp - 0x19]
test rax, rax
je 0x1400c853d
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400c853d
cmp dword [rax - 0x10], 0xabcd
jne 0x1400c8cef
cmp dword [rax - 4], 0xabcd
jne 0x1400c8cef
mov rcx, qword [rcx + 0x10]
cmp dword [rax + rcx*2 + 2], 0xabcd
jne 0x1400c8cef
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x29]
call fcn.1400c7940
nop
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400c8563
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400c8563
mov rdi, qword [rcx + 8]
jmp 0x1400c8566
mov rdi, r13
lea rbx, [rdi + 0x2d]
test rax, rax
je 0x1400c8582
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400c8582
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
jmp 0x1400c8588
mov rdx, r13
mov rcx, r15
mov r12d, 0x400
cmp rdx, rbx
jb 0x1400c8598
test rdx, rdx
jne 0x1400c85d2
mov rax, rbx
sub rax, rdx
cmp rax, rcx
cmovae rcx, rax
cmp rdx, r12
jae 0x1400c85b3
cmp rcx, rdx
cmovb rcx, rdx
jmp 0x1400c85ba
cmp rcx, r12
cmovb rcx, r12
add rdx, rcx
lea rcx, [rbp - 0x29]
call fcn.14001c030
test al, al
je 0x1400c8ce5
mov rax, qword [rbp - 0x29]
lea rcx, [rax + rdi*2]
movaps xmm0, xmmword [str._redirect_urlhttps:__central.bitdefender.com]
movups xmmword [rcx], xmm0
movaps xmm1, xmmword [0x14015f9a0]
movups xmmword [rcx + 0x10], xmm1
movaps xmm0, xmmword [0x14015f9b0]
movups xmmword [rcx + 0x20], xmm0
movaps xmm1, xmmword [0x14015f9c0]
movups xmmword [rcx + 0x30], xmm1
movaps xmm0, xmmword [0x14015f9d0]
movups xmmword [rcx + 0x40], xmm0
movsd xmm1, qword [0x14015f9e0]
movsd qword [rcx + 0x50], xmm1
movzx eax, word [0x14015f9e8]
mov word [rcx + 0x58], ax
mov rax, qword [rbp - 0x29]
mov word [rax + rbx*2], r13w
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400c8645
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400c8645
mov rdx, qword [rcx + 0x10]
jmp 0x1400c8648
mov rdx, r13
cmp rbx, rdx
ja 0x1400c8ce5
test rax, rax
je 0x1400c865c
mov rcx, qword [rax - 0xc]
jmp 0x1400c865f
mov rcx, r13
mov qword [rcx + 8], rbx
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400c86ac
mov rdx, qword [rax - 0xc]
test rdx, rdx
je 0x1400c86ac
cmp dword [rax - 0x10], 0xabcd
jne 0x1400c8ce5
cmp dword [rax - 4], 0xabcd
jne 0x1400c8ce5
mov rcx, qword [rdx + 0x10]
cmp dword [rax + rcx*2 + 2], 0xabcd
jne 0x1400c8ce5
test rdx, rdx
je 0x1400c86ac
mov rdi, qword [rdx + 8]
jmp 0x1400c86af
mov rdi, r13
lea rbx, [rdi + 6]
test rax, rax
je 0x1400c86cb
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400c86cb
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
jmp 0x1400c86d1
mov rdx, r13
mov rcx, r15
cmp rdx, rbx
jb 0x1400c86db
test rdx, rdx
jne 0x1400c8715
mov rax, rbx
sub rax, rdx
cmp rax, rcx
cmovae rcx, rax
cmp rdx, r12
jae 0x1400c86f6
cmp rcx, rdx
cmovb rcx, rdx
jmp 0x1400c86fd
cmp rcx, r12
cmovb rcx, r12
add rdx, rcx
lea rcx, [rbp - 0x29]
call fcn.14001c030
test al, al
je 0x1400c8ce5
mov rax, qword [rbp - 0x29]
lea rcx, [rax + rdi*2]
movsd xmm0, qword [0x14015fa08]
movsd qword [rcx], xmm0
mov eax, dword [0x14015fa10]
mov dword [rcx + 8], eax
mov rax, qword [rbp - 0x29]
mov word [rax + rbx*2], r13w
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400c874f
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400c874f
mov rdx, qword [rcx + 0x10]
jmp 0x1400c8752
mov rdx, r13
cmp rbx, rdx
ja 0x1400c8ce5
test rax, rax
je 0x1400c8766
mov rcx, qword [rax - 0xc]
jmp 0x1400c8769
mov rcx, r13
mov qword [rcx + 8], rbx
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400c87ab
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400c87ab
cmp dword [rax - 0x10], 0xabcd
jne 0x1400c8ce5
cmp dword [rax - 4], 0xabcd
jne 0x1400c8ce5
mov rcx, qword [rcx + 0x10]
cmp dword [rax + rcx*2 + 2], 0xabcd
jne 0x1400c8ce5
mov qword [rbp + 7], r13
mov qword [rbp + 0x17], r13
mov qword [rbp + 0x1f], 7
mov word [rbp + 7], r13w
mov dword [rbp - 1], 1
mov qword [rbp - 0x11], r13
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x14015fb70]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdi, 0xffffffffffffffff
test eax, eax
jne 0x1400c88aa
mov dword [rbp - 0x21], r13d
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14015fa98]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c88a0
mov ecx, dword [rbp - 0x21]
shr rcx, 1
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call qword [sym.imp.mfc140u.dll_operator_1]
mov rbx, rax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14015fa78]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c8897
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400c8880
mov rdx, rbx
lea rcx, [rbp + 7]
call fcn.140002f20
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_operator]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp + 7]
mov r8, qword [rbp + 7]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
cmovae rcx, r8
mov rax, qword [rbp + 0x17]
lea r9, [rcx + rax*2]
lea rax, [rbp + 7]
cmovae rax, r8
cmp rax, r9
je 0x1400c88f2
mov ecx, 0x2d
cmp word [rax], 0x5f
jne 0x1400c88e1
mov word [rax], cx
add rax, 2
cmp rax, r9
jne 0x1400c88d8
mov rdx, qword [rbp + 0x1f]
mov r8, qword [rbp + 7]
lea rsi, [rbp + 7]
cmp rdx, 8
jb 0x1400c8908
mov rsi, r8
test r8, r8
je 0x1400c8a46
mov rbx, rdi
nop dword [rax + rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1400c8910
test rbx, rbx
je 0x1400c8a46
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400c893b
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400c893b
mov r12, qword [rcx + 8]
jmp 0x1400c893e
mov r12, r13
lea r14, [r12 + rbx]
test rax, rax
je 0x1400c895a
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400c895a
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
jmp 0x1400c8960
mov rdx, r13
mov rcx, r15
cmp rdx, r14
jb 0x1400c896a
test rdx, rdx
jne 0x1400c89a9
mov rax, r14
sub rax, rdx
cmp rax, rcx
cmovae rcx, rax
mov eax, 0x400
cmp rdx, rax
jae 0x1400c898a
cmp rcx, rdx
cmovb rcx, rdx
jmp 0x1400c8991
cmp rcx, rax
cmovb rcx, rax
add rdx, rcx
lea rcx, [rbp - 0x29]
call fcn.14001c030
test al, al
je 0x1400c8cf9
mov rax, qword [rbp - 0x29]
lea r8, [rbx + rbx]
lea rcx, [rax + r12*2]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbp - 0x29]
mov word [rax + r14*2], r13w
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400c89da
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400c89da
mov rdx, qword [rcx + 0x10]
jmp 0x1400c89dd
mov rdx, r13
cmp r14, rdx
ja 0x1400c8cf9
test rax, rax
je 0x1400c89f1
mov rcx, qword [rax - 0xc]
jmp 0x1400c89f4
mov rcx, r13
mov qword [rcx + 8], r14
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400c8a36
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400c8a36
cmp dword [rax - 0x10], 0xabcd
jne 0x1400c8cf9
cmp dword [rax - 4], 0xabcd
jne 0x1400c8cf9
mov rcx, qword [rcx + 0x10]
cmp dword [rax + rcx*2 + 2], 0xabcd
jne 0x1400c8cf9
mov rdx, qword [rbp + 0x1f]
mov r8, qword [rbp + 7]
mov r12d, 0x400
jmp 0x1400c8a4a
mov rax, qword [rbp - 0x29]
cmp rdx, 8
jb 0x1400c8a8c
lea rdx, [rdx*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x1400c8a80
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c8a80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.14007e2a0
mov rax, qword [rbp - 0x29]
mov rcx, qword [0x1401c1428]
mov qword [rbp - 9], r13
test rcx, rcx
je 0x1400c8c4e
mov rax, qword [rcx]
lea rdx, [rbp - 9]
mov rax, qword [rax + 0x48]
call qword [case.0x140077645.0]
test eax, eax
jne 0x1400c8c4a
mov rcx, qword [rbp - 9]
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
call qword [case.0x140077645.0]
mov rbx, rax
test rax, rax
je 0x1400c8c39
mov rcx, rdi
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400c8ae0
test rcx, rcx
je 0x1400c8c39
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400c8b0b
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400c8b0b
mov r14, qword [rcx + 8]
jmp 0x1400c8b0e
mov r14, r13
lea rsi, [r14 + 0x13]
test rax, rax
je 0x1400c8b2a
mov rdx, qword [rax - 0xc]
test rdx, rdx
je 0x1400c8b2a
mov rcx, qword [rdx + 0x10]
mov r15, qword [rdx + 0x18]
jmp 0x1400c8b2d
mov rcx, r13
cmp rcx, rsi
jb 0x1400c8b37
test rcx, rcx
jne 0x1400c8b72
mov rax, rsi
sub rax, rcx
cmp rax, r15
cmovae r15, rax
cmp rcx, r12
jae 0x1400c8b52
cmp r15, rcx
cmovb r15, rcx
jmp 0x1400c8b59
cmp r15, r12
cmovb r15, r12
lea rdx, [r15 + rcx]
lea rcx, [rbp - 0x29]
call fcn.14001c030
test al, al
je 0x1400c8ce5
mov rax, qword [rbp - 0x29]
lea rcx, [rax + r14*2]
movups xmm0, xmmword [str.credentials_token]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x14015f978]
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [0x14015f988]
mov dword [rcx + 0x20], eax
movzx eax, word [0x14015f98c]
mov word [rcx + 0x24], ax
mov rax, qword [rbp - 0x29]
mov word [rax + rsi*2], r13w
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400c8bc0
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400c8bc0
mov rdx, qword [rcx + 0x10]
jmp 0x1400c8bc3
mov rdx, r13
cmp rsi, rdx
ja 0x1400c8ce5
test rax, rax
je 0x1400c8bd7
mov rcx, qword [rax - 0xc]
jmp 0x1400c8bda
mov rcx, r13
mov qword [rcx + 8], rsi
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400c8c20
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400c8c20
cmp dword [rax - 0x10], 0xabcd
jne 0x1400c8ce5
cmp dword [rax - 4], 0xabcd
jne 0x1400c8ce5
mov rcx, qword [rcx + 0x10]
cmp dword [rax + rcx*2 + 2], 0xabcd
jne 0x1400c8ce5
nop dword [rax]
inc rdi
cmp word [rbx + rdi*2], 0
jne 0x1400c8c20
mov r8, rdi
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.140028810
mov rcx, qword [rbp - 9]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140077645.0]
mov rax, qword [rbp - 0x29]
lea r8, [0x1401836d8]
test rax, rax
cmovne r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea rdx, [0x14015f9f0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400c8cae
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400c8cae
cmp dword [rax - 0x10], 0xabcd
jne 0x1400c8d03
cmp dword [rax - 4], 0xabcd
jne 0x1400c8d03
mov rcx, qword [rcx + 0x10]
cmp dword [rax + rcx*2 + 2], 0xabcd
jne 0x1400c8d03
lea rcx, [rbp - 0x29]
call fcn.14001bab0
nop
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14007e250
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor edx, edx
xor ecx, ecx
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xor edx, edx
xor ecx, ecx
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xor edx, edx
xor ecx, ecx
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xor edx, edx
xor ecx, ecx
call sub.VCRUNTIME140.dll__CxxThrowException
int3