Function at 0x14007a810
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x14016d080]
xor rax, rsp
mov qword [rbp + 0x37], rax
movdqa xmm1, xmmword [0x14015ae90]
movdqu xmmword [rbp - 1], xmm1
movdqa xmm2, xmmword [0x14015ae60]
movdqu xmmword [rbp + 0xf], xmm2
mov dl, 0x64
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp], al
xor byte [rbp + 1], cl
xor byte [rbp + 2], cl
xor byte [rbp + 3], cl
xor byte [rbp + 4], cl
xor byte [rbp + 5], cl
xor byte [rbp + 6], cl
xor byte [rbp + 7], cl
xor byte [rbp + 8], cl
xor byte [rbp + 9], cl
xor byte [rbp + 0xa], cl
xor byte [rbp + 0xb], cl
xor byte [rbp + 0xc], cl
xor byte [rbp + 0xd], cl
xor byte [rbp + 0xe], cl
movd eax, xmm2
xor al, cl
mov byte [rbp + 0xf], al
xor byte [rbp + 0x10], cl
xor byte [rbp + 0x11], cl
xor byte [rbp + 0x12], cl
xor byte [rbp + 0x13], cl
xor byte [rbp + 0x14], cl
xor byte [rbp + 0x15], cl
xor byte [rbp + 0x16], cl
xor byte [rbp + 0x17], cl
xor byte [rbp + 0x18], cl
xor byte [rbp + 0x19], cl
xor byte [rbp + 0x1a], cl
xor byte [rbp + 0x1b], cl
xor byte [rbp + 0x1c], cl
xor byte [rbp + 0x1d], cl
xor byte [rbp + 0x1e], cl
xor dl, cl
mov byte [rbp + 0x1f], dl
mov byte [rbp + 0x20], 0
movdqa xmm1, xmmword [0x14015abf0]
movdqu xmmword [rbp - 0x39], xmm1
mov dl, 0x37
mov r8b, 0x3f
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x38], al
xor byte [rbp - 0x37], cl
xor byte [rbp - 0x36], cl
xor byte [rbp - 0x35], cl
xor byte [rbp - 0x34], cl
xor byte [rbp - 0x33], cl
xor byte [rbp - 0x32], cl
xor byte [rbp - 0x31], cl
xor byte [rbp - 0x30], cl
xor byte [rbp - 0x2f], cl
xor byte [rbp - 0x2e], cl
xor byte [rbp - 0x2d], cl
xor byte [rbp - 0x2c], cl
xor byte [rbp - 0x2b], cl
xor byte [rbp - 0x2a], cl
xor dl, cl
mov byte [rbp - 0x29], dl
xor r8b, cl
mov byte [rbp - 0x28], r8b
mov byte [rbp - 0x27], 0
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14007ae42
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x2f]
xor r8d, r8d
lea rdx, [rbp - 0x38]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14007ad29
cmp dword [rbp + 0x2f], 1
jne 0x14007ac90
mov ecx, dword [rbp - 0x11]
call fcn.1400d08c4
mov rsi, rax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x38]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14007ab84
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], rbx
mov qword [rbp + 0x17], rbx
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rsi + r8], bl
jne 0x14007a9f0
mov rdx, rsi
lea rcx, [rbp - 1]
call fcn.1400031c0
nop
lea r9, [rbp - 1]
mov rbx, qword [rbp - 1]
mov r15, qword [rbp + 0x17]
cmp r15, 0xf
cmova r9, rbx
mov r14, qword [rbp + 0xf]
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp r14, rax
ja 0x14007aa59
lea rdi, [0x14016d1c8]
cmp rax, 0xf
cmova rdi, qword [0x14016d1c8]
mov qword [0x14016d1d8], r14
mov r8, r14
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rdi], 0
jmp 0x14007aa70
mov rdx, r14
lea rcx, [0x14016d1c8]
call fcn.14006bea0
mov r15, qword [rbp + 0x17]
mov rbx, qword [rbp - 1]
movdqa xmm1, xmmword [0x14015ac70]
movdqu xmmword [rbp - 0x39], xmm1
movdqa xmm2, xmmword [0x14015aca0]
movdqu xmmword [rbp - 0x29], xmm2
mov r8b, 0x54
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rbp - 0x38], al
xor byte [rbp - 0x37], dl
xor byte [rbp - 0x36], dl
xor byte [rbp - 0x35], dl
xor byte [rbp - 0x34], dl
xor byte [rbp - 0x33], dl
xor byte [rbp - 0x32], dl
xor byte [rbp - 0x31], dl
xor byte [rbp - 0x30], dl
xor byte [rbp - 0x2f], dl
xor byte [rbp - 0x2e], dl
xor byte [rbp - 0x2d], dl
xor byte [rbp - 0x2c], dl
xor byte [rbp - 0x2b], dl
xor byte [rbp - 0x2a], dl
movd eax, xmm2
xor al, dl
mov byte [rbp - 0x29], al
xor byte [rbp - 0x28], dl
xor byte [rbp - 0x27], dl
xor byte [rbp - 0x26], dl
xor byte [rbp - 0x25], dl
xor byte [rbp - 0x24], dl
xor byte [rbp - 0x23], dl
xor byte [rbp - 0x22], dl
xor byte [rbp - 0x21], dl
xor byte [rbp - 0x20], dl
xor byte [rbp - 0x1f], dl
xor byte [rbp - 0x1e], dl
xor byte [rbp - 0x1d], dl
xor byte [rbp - 0x1c], dl
xor byte [rbp - 0x1b], dl
xor byte [rbp - 0x1a], dl
xor r8b, dl
mov byte [rbp - 0x19], r8b
mov byte [rbp - 0x18], 0
lea rdx, [rbp - 0x38]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14006b480
lea rdx, [0x14006b650]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
cmp r15, 0xf
jbe 0x14007ac79
lea rdx, [r15 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14007ab65
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007ab65
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400d03f0
mov rcx, rsi
call fcn.1400d03f0
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14007aef6
movdqa xmm1, xmmword [0x14015abc0]
movdqu xmmword [rbp - 1], xmm1
movdqa xmm2, xmmword [0x14015ad20]
movdqu xmmword [rbp + 0xf], xmm2
mov cl, 0x33
mov r8b, 0x24
mov r9b, 0x26
movzx r10d, r8b
mov r11b, 0x25
mov bl, Ordinal_41
mov dil, 0x35
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rbp], al
xor byte [rbp + 1], dl
xor byte [rbp + 2], dl
xor byte [rbp + 3], dl
xor byte [rbp + 4], dl
xor byte [rbp + 5], dl
xor byte [rbp + 6], dl
xor byte [rbp + 7], dl
xor byte [rbp + 8], dl
xor byte [rbp + 9], dl
xor byte [rbp + 0xa], dl
xor byte [rbp + 0xb], dl
xor byte [rbp + 0xc], dl
xor byte [rbp + 0xd], dl
xor byte [rbp + 0xe], dl
movd eax, xmm2
xor al, dl
mov byte [rbp + 0xf], al
xor byte [rbp + 0x10], dl
xor byte [rbp + 0x11], dl
xor byte [rbp + 0x12], dl
xor byte [rbp + 0x13], dl
xor byte [rbp + 0x14], dl
xor byte [rbp + 0x15], dl
xor byte [rbp + 0x16], dl
xor byte [rbp + 0x17], dl
xor byte [rbp + 0x18], dl
xor byte [rbp + 0x19], dl
xor byte [rbp + 0x1a], dl
xor byte [rbp + 0x1b], dl
xor byte [rbp + 0x1c], dl
xor byte [rbp + 0x1d], dl
xor byte [rbp + 0x1e], dl
xor cl, dl
mov byte [rbp + 0x1f], cl
xor r8b, dl
mov byte [rbp + 0x20], r8b
xor r9b, dl
mov byte [rbp + 0x21], r9b
xor r10b, dl
mov byte [rbp + 0x22], r10b
xor r11b, dl
mov byte [rbp + 0x23], r11b
xor bl, dl
mov byte [rbp + 0x24], bl
xor dil, dl
mov byte [rbp + 0x25], dil
mov byte [rbp + 0x26], 0
lea rdx, [rbp]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14006b480
lea rdx, [0x14006b650]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rsi
call fcn.1400d03f0
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14007aef6
movdqa xmm1, xmmword [0x14015ac50]
movdqu xmmword [rbp - 0x39], xmm1
movdqa xmm2, xmmword [0x14015a9d0]
movdqu xmmword [rbp - 0x29], xmm2
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rbp - 0x38], al
xor byte [rbp - 0x37], dl
xor byte [rbp - 0x36], dl
xor byte [rbp - 0x35], dl
xor byte [rbp - 0x34], dl
xor byte [rbp - 0x33], dl
xor byte [rbp - 0x32], dl
xor byte [rbp - 0x31], dl
xor byte [rbp - 0x30], dl
xor byte [rbp - 0x2f], dl
xor byte [rbp - 0x2e], dl
xor byte [rbp - 0x2d], dl
xor byte [rbp - 0x2c], dl
xor byte [rbp - 0x2b], dl
xor byte [rbp - 0x2a], dl
movd eax, xmm2
xor al, dl
mov byte [rbp - 0x29], al
xor byte [rbp - 0x28], dl
xor byte [rbp - 0x27], dl
xor byte [rbp - 0x26], dl
xor byte [rbp - 0x25], dl
xor byte [rbp - 0x24], dl
xor byte [rbp - 0x23], dl
xor byte [rbp - 0x22], dl
xor byte [rbp - 0x21], dl
xor byte [rbp - 0x20], dl
xor byte [rbp - 0x1f], dl
xor byte [rbp - 0x1e], dl
xor byte [rbp - 0x1d], dl
xor byte [rbp - 0x1c], dl
xor byte [rbp - 0x1b], dl
mov byte [rbp - 0x1a], bl
lea rdx, [rbp - 0x38]
jmp 0x14007ae17
movdqa xmm1, xmmword [0x14015ab20]
movdqu xmmword [rbp - 1], xmm1
movdqa xmm2, xmmword [0x14015ac00]
movdqu xmmword [rbp + 0xf], xmm2
mov cl, 0x3d
mov r8b, reloc.WS2_32.dll_WSAStartup
mov r9b, reloc.WLDAP32.dll_Ordinal_33
mov r10b, 0x36
mov r11b, 0x34
movzx ebx, r10b
mov dil, gethostname
mov sil, Ordinal_60
mov r14b, Ordinal_41
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rbp], al
xor byte [rbp + 1], dl
xor byte [rbp + 2], dl
xor byte [rbp + 3], dl
xor byte [rbp + 4], dl
xor byte [rbp + 5], dl
xor byte [rbp + 6], dl
xor byte [rbp + 7], dl
xor byte [rbp + 8], dl
xor byte [rbp + 9], dl
xor byte [rbp + 0xa], dl
xor byte [rbp + 0xb], dl
xor byte [rbp + 0xc], dl
xor byte [rbp + 0xd], dl
xor byte [rbp + 0xe], dl
movd eax, xmm2
xor al, dl
mov byte [rbp + 0xf], al
xor byte [rbp + 0x10], dl
xor byte [rbp + 0x11], dl
xor byte [rbp + 0x12], dl
xor byte [rbp + 0x13], dl
xor byte [rbp + 0x14], dl
xor byte [rbp + 0x15], dl
xor byte [rbp + 0x16], dl
xor byte [rbp + 0x17], dl
xor byte [rbp + 0x18], dl
xor byte [rbp + 0x19], dl
xor byte [rbp + 0x1a], dl
xor byte [rbp + 0x1b], dl
xor byte [rbp + 0x1c], dl
xor byte [rbp + 0x1d], dl
xor byte [rbp + 0x1e], dl
xor cl, dl
mov byte [rbp + 0x1f], cl
xor r8b, dl
mov byte [rbp + 0x20], r8b
xor r9b, dl
mov byte [rbp + 0x21], r9b
xor r10b, dl
mov byte [rbp + 0x22], r10b
xor r11b, dl
mov byte [rbp + 0x23], r11b
xor bl, dl
mov byte [rbp + 0x24], bl
xor dil, dl
mov byte [rbp + 0x25], dil
xor sil, dl
mov byte [rbp + 0x26], sil
xor r14b, dl
mov byte [rbp + 0x27], r14b
mov byte [rbp + 0x28], 0
lea rdx, [rbp]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14006b480
lea rdx, [0x14006b650]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14007aef6
movdqa xmm1, xmmword [0x14015ae50]
movdqu xmmword [rbp - 1], xmm1
movdqa xmm2, xmmword [0x14015ad50]
movdqu xmmword [rbp + 0xf], xmm2
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rbp], al
xor byte [rbp + 1], dl
xor byte [rbp + 2], dl
xor byte [rbp + 3], dl
xor byte [rbp + 4], dl
xor byte [rbp + 5], dl
xor byte [rbp + 6], dl
xor byte [rbp + 7], dl
xor byte [rbp + 8], dl
xor byte [rbp + 9], dl
xor byte [rbp + 0xa], dl
xor byte [rbp + 0xb], dl
xor byte [rbp + 0xc], dl
xor byte [rbp + 0xd], dl
xor byte [rbp + 0xe], dl
movd eax, xmm2
xor al, dl
mov byte [rbp + 0xf], al
xor byte [rbp + 0x10], dl
xor byte [rbp + 0x11], dl
xor byte [rbp + 0x12], dl
xor byte [rbp + 0x13], dl
xor byte [rbp + 0x14], dl
xor byte [rbp + 0x15], dl
xor byte [rbp + 0x16], dl
xor byte [rbp + 0x17], dl
xor byte [rbp + 0x18], dl
xor byte [rbp + 0x19], dl
xor byte [rbp + 0x1a], dl
xor byte [rbp + 0x1b], dl
xor byte [rbp + 0x1c], dl
xor byte [rbp + 0x1d], dl
xor byte [rbp + 0x1e], dl
mov byte [rbp + 0x1f], 0
lea rdx, [rbp]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14006b480
lea rdx, [0x14006b650]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400d00f0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
sub rsp, 0x28
call fcn.14007a1b0
add rsp, 0x28
jmp 0x14007a810