Function at 0x1400cc2c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x14035dc30]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r15, rdx
mov r12, rcx
mov qword [rsp + 0x60], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [r11 - 0x78], xmm0
movups xmmword [r11 - 0x68], xmm0
movups xmmword [r11 - 0x58], xmm0
movss dword [rsp + 0xe0], xmm0
xor esi, esi
mov qword [r11 - 0x80], rsi
mov qword [r11 - 0x78], rsi
lea ecx, [rsi + 0x50]
call fcn.1402695b8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf8], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x118], 8
movss xmm0, dword [0x140314970]
movss dword [rsp + 0xe0], xmm0
mov r8, rax
lea edx, [rsi + 0x10]
lea rcx, [rsp + 0xf8]
call fcn.140033ff0
nop
mov dword [rsp + 0xd0], esi
mov dword [rsp + 0xc8], esi
mov dword [rsp + 0xcc], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0xcc]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x1400cc49f
lea rdx, [rsp + 0xe0]
mov rcx, r15
call fcn.140039ca0
nop
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf8]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov r8, rcx
cmp rdx, 0x1000
jb 0x1400cc449
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x1400cc78c
call fcn.140269844
xorps xmm0, xmm0
mov qword [rsp + 0xf8], rsi
movdqa xmmword [rsp + 0x100], xmm0
lea rcx, [rsp + 0xe8]
call fcn.140033680
mov rax, r15
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140269300
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
inc dword [rsp + 0xcc]
inc dword [rsp + 0xc8]
mov ecx, dword [rsp + 0xcc]
mov eax, 2
mul rcx
mov rbx, rax
mov r13, 0xffffffffffffffff
cmovo rbx, r13
mov rcx, rbx
call fcn.140269b2c
mov rdi, rax
test rax, rax
je 0x1400cc4e9
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14026c200
jmp 0x1400cc4ec
mov rdi, rsi
mov qword [rsp + 0x120], rdi
mov ecx, dword [rsp + 0xc8]
mov eax, 2
mul rcx
mov r14, rax
cmovo r14, r13
mov rcx, r14
call fcn.140269b2c
mov rbx, rax
test rax, rax
je 0x1400cc529
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.14026c200
jmp 0x1400cc52c
mov rbx, rsi
mov qword [rsp + 0x128], rbx
mov r14d, esi
nop word [rax + rax]
cmp r14d, dword [rsp + 0xd0]
jae 0x1400cc716
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0xdc], eax
mov eax, dword [rsp + 0xcc]
mov dword [rsp + 0xd8], eax
mov dword [rsp + 0xd4], esi
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0xd4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xdc]
mov r8, rbx
mov edx, r14d
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1400cc64c
mov rcx, r15
call fcn.140039e40
nop
test rbx, rbx
je 0x1400cc5cc
mov rcx, rbx
call fcn.140269844
nop
test rdi, rdi
je 0x1400cc5da
mov rcx, rdi
call fcn.140269844
nop
mov rax, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf8]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cc61e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400cc792
call fcn.140269844
mov qword [rsp + 0xf8], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x100], xmm0
lea rcx, [rsp + 0xe8]
call fcn.140033680
mov rax, r15
jmp 0x1400cc472
mov eax, dword [rsp + 0xd4]
dec eax
cmp eax, 1
ja 0x1400cc70e
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], si
mov r8, r13
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400cc680
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140025e70
nop
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], si
mov r8, r13
inc r8
cmp word [rdi + r8*2], 0
jne 0x1400cc6c0
mov rdx, rdi
lea rcx, [rsp + 0x90]
call fcn.140025e70
nop
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xe0]
call fcn.1400ca7d0
nop
lea rcx, [rsp + 0x90]
call fcn.140025de0
lea rcx, [rsp + 0x70]
call fcn.140025de0
inc r14d
jmp 0x1400cc540
test rbx, rbx
je 0x1400cc724
mov rcx, rbx
call fcn.140269844
nop
test rdi, rdi
je 0x1400cc732
mov rcx, rdi
call fcn.140269844
nop
jmp 0x1400cc73b
lea rdx, [rsp + 0xe0]
mov rcx, r15
call fcn.140039ca0
nop
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf8]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cc449
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400cc449
call fcn.140277ff8
int3
call fcn.140277ff8
int3