Function at 0x140032d30
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2a0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400da088]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rsi, rcx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
mov qword [rcx + 0x48], rdx
mov qword [rbp + 0x60], 0x11c
mov qword [rbp + 0x68], r13
mov dword [rbp + 0x70], r13d
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x74]
call fcn.14005be80
mov dword [rbp + 0x174], r13d
mov dword [rbp + 0x178], 0x10000
mov r8b, 1
mov edx, 0x80
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8, rax
mov edx, 0x80
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
sete al
mov byte [rsi + 0x5c], al
xor r12b, r12b
mov r15d, r13d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [r13 + 1]
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rdi, [r13 - 1]
test eax, eax
jne 0x140033001
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.CurrentMajorVersionNumber
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140032ff3
cmp dword [rsp + 0x44], 4
jne 0x140032ff3
mov eax, dword [rsp + 0x48]
mov dword [rsi + 0x50], eax
mov dword [rsp + 0x48], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.CurrentMinorVersionNumber
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140032ff3
cmp dword [rsp + 0x44], 4
jne 0x140032ff3
mov eax, dword [rsp + 0x40]
mov dword [rsi + 0x54], eax
mov dword [rsp + 0x40], 0xa
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x180]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.CurrentBuildNumber
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140032ff3
cmp dword [rsp + 0x48], 1
jne 0x140032ff3
mov eax, dword [rsp + 0x40]
cmp rax, 0xb
jae 0x140033549
mov byte [rbp + rax + 0x180], r12b
movdqa xmm0, xmmword [0x14009a480]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], r12b
lea rax, [rbp + 0x180]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140032f36
lea rdx, [rbp + 0x180]
lea rcx, [rbp - 0x60]
call fcn.1400079d0
nop
lea rdx, [rsp + 0x44]
lea rcx, [rbp - 0x60]
call fcn.14004b8f0
movzx r14d, al
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140032f9e
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032f99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003353d
call fcn.140059fc8
test r14b, r14b
je 0x140032ff3
mov eax, dword [rsp + 0x44]
mov dword [rsi + 0x58], eax
mov dword [rsp + 0x48], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, [0x1400a35a8]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140032ff3
cmp dword [rsp + 0x44], 4
jne 0x140032ff3
mov r15d, dword [rsp + 0x40]
mov r12b, 1
test rbx, rbx
je 0x140033001
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movdqa xmm0, xmmword [0x14009a470]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r13w
lea rdx, str.kernel32.dll
nop word [rax + rax]
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x140033020
mov r8, rdi
lea rcx, [rbp - 0x60]
call fcn.140029650
nop
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x20]
call fcn.14004e740
nop
lea rdx, [rsp + 0x68]
mov rcx, rax
call fcn.14004ba90
movzx ebx, al
lea rcx, [rbp + 0x20]
call fcn.140031900
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14003309f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003309a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033543
call fcn.140059fc8
test bl, bl
je 0x140033507
mov edx, dword [rbp - 0x7c]
lea rcx, [rbp - 0x60]
call fcn.140032a50
nop
mov eax, dword [rbp - 0x78]
and eax, 0x40004
movdqa xmm0, xmmword [0x14009a480]
mov byte [rbp - 0x20], 0
lea rcx, [rbp - 0x20]
movdqu xmmword [rbp - 0x10], xmm0
cmp eax, 0x40004
jne 0x1400330e7
mov r8d, 0xa
lea rdx, str.Windows_NT
jmp 0x1400330f4
mov r8d, 7
lea rdx, str.Unknown
call fcn.1400079d0
nop
test r12b, r12b
jne 0x140033121
mov ecx, dword [rsp + 0x70]
mov eax, ecx
shr eax, 0x10
mov dword [rsi + 0x50], eax
movzx eax, cx
mov dword [rsi + 0x54], eax
mov ecx, dword [rsp + 0x74]
mov eax, ecx
shr eax, 0x10
mov dword [rsi + 0x58], eax
movzx r15d, cx
mov r8d, r15d
lea rdx, [0x1400a35b0]
lea rcx, [rbp + 0x20]
call fcn.140050d70
mov rbx, rax
lea rdi, [rsi + 0x28]
cmp rdi, rax
je 0x140033165
mov rcx, rdi
call fcn.140003640
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1400331a0
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003319b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003354f
call fcn.140059fc8
mov rbx, qword [rbp - 0x50]
test rbx, rbx
jne 0x1400331ba
lea rdx, [0x140098e08]
mov ebx, 8
jmp 0x1400332d6
movdqa xmm0, xmmword [0x14009a480]
movdqu xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x40], 0
mov r8d, 2
lea rdx, [0x14009a360]
lea rcx, [rbp + 0x40]
call fcn.1400079d0
nop
mov dword [rsp + 0x40], 9
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rdx, qword [rbp - 0x60]
mov r8, rbx
lea rcx, [rbp + 0x40]
call fcn.140007940
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x40], 0x1b
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14003327d
lea rax, [rcx + 1]
mov qword [rbp - 0x30], rax
lea rbx, [rbp - 0x40]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x40]
add rbx, rcx
mov r8d, 1
lea rdx, [0x14009a354]
mov rcx, rbx
call fcn.14005ba20
mov byte [rbx + 1], 0
lea rax, [rbp - 0x40]
jmp 0x14003329d
mov qword [rsp + 0x20], 1
lea r9, [0x14009a354]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x40]
call fcn.1400021c0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov ebx, 0x3f
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rdx, qword [rbp]
mov dword [rsp + 0x40], ebx
cmp qword [rdi + 0x18], 0x10
jb 0x1400332e4
mov rdi, qword [rdi]
mov eax, dword [rsi + 0x58]
mov ecx, dword [rsi + 0x54]
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae r8, qword [rbp - 0x20]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsi + 0x50]
lea rdx, str._s__u._u._u._s_s
lea rcx, [rbp + 0x20]
call fcn.140050d70
mov rdi, rax
add rsi, 8
cmp rsi, rax
je 0x14003334f
mov rcx, rsi
call fcn.140003640
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x14003338a
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033385
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033555
call fcn.140059fc8
movdqa xmm0, xmmword [0x14009a480]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
test bl, 4
je 0x1400333ef
and ebx, 0xfffffffb
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x1400333de
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400333d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003355b
call fcn.140059fc8
movdqa xmm0, xmmword [0x14009a480]
movdqu xmmword [rbp + 0x10], xmm0
mov byte [rbp], 0
test bl, 2
je 0x140033443
and ebx, 0xfffffffd
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140033432
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003342d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033561
call fcn.140059fc8
movdqa xmm0, xmmword [0x14009a480]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
test bl, 1
je 0x140033484
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x140033484
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003347e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033567
call fcn.140059fc8
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400334bf
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400334ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003356d
call fcn.140059fc8
movdqa xmm0, xmmword [0x14009a480]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140033507
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033502
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033537
call fcn.140059fc8
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14005a430
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14005e364
nop
call fcn.14005e364
nop
call fcn.14005e364
nop
call fcn.14005a590
nop
call fcn.14005e364
nop
call fcn.14005e364
nop
call fcn.14005e364
nop
call fcn.14005e364
nop
call fcn.14005e364
nop
call fcn.14005e364
int3