Function at 0x1401ad144
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r14, rdx
lea rax, [rbp - 0x10]
xor r15d, r15d
mov qword [rsp + 0x20], rax
xor ebx, ebx
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion_
and qword [rbp - 0x10], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000002
xor edi, edi
lea r9d, [r15 + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401ad19c
mov rdi, qword [rbp - 0x10]
xor esi, esi
and qword [rbp - 0x10], rbx
jmp 0x1401ad1b1
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, esi
call fcn.14007ac40
mov ecx, esi
call fcn.14007ace8
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1401ad1cb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x10], rbx
mov r13d, 0x8007000d
test esi, esi
js 0x1401ad26f
and dword [rbp + 0x40], ebx
lea rax, [rbp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x50]
lea rdx, str.DigitalProductId4
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401ad261
test rbx, rbx
jne 0x1401ad23d
mov eax, dword [rbp + 0x40]
test eax, eax
je 0x1401ad236
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1401ad1dc
mov esi, 0x8007000e
jmp 0x1401ad26f
mov esi, 0x8000ffff
jmp 0x1401ad26f
cmp dword [rbp + 0x50], 3
je 0x1401ad24b
mov esi, r13d
mov ecx, r13d
jmp 0x1401ad271
mov r15, rbx
xor ecx, ecx
call fcn.14007ace8
mov eax, dword [rbp + 0x40]
xor esi, esi
mov dword [rbp + 0x58], eax
xor ebx, ebx
jmp 0x1401ad276
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, esi
call fcn.14007ac40
mov ecx, esi
call fcn.14007ace8
test rbx, rbx
je 0x1401ad296
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rdi, rdi
je 0x1401ad2a4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jns 0x1401ad2b4
mov ecx, esi
call fcn.14007ac40
jmp 0x1401ad36d
mov eax, 0x4f8
cmp dword [rbp + 0x58], eax
je 0x1401ad2c6
mov esi, r13d
mov ecx, r13d
jmp 0x1401ad2aa
cmp dword [r15], eax
jne 0x1401ad2be
mov eax, 9
mov rdx, r15
lea ecx, [rax + 0x77]
movups xmm0, xmmword [rdx]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [r14 + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [r14 + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [r14 + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [r14 + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [r14 + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [r14 + 0x60], xmm0
add r14, rcx
movups xmm1, xmmword [rdx + 0x70]
add rdx, rcx
movups xmmword [r14 - 0x10], xmm1
sub rax, 1
jne 0x1401ad2d6
movups xmm0, xmmword [rdx]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [r14 + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [r14 + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [r14 + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [r14 + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [r14 + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [r14 + 0x60], xmm0
mov rdx, qword [rdx + 0x70]
mov qword [r14 + 0x70], rdx
mov ecx, esi
call fcn.14007ace8
test r15, r15
je 0x1401ad382
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret