Function at 0x140061c00
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x140c9a1c0]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor r12d, r12d
mov rax, qword [0x140cd2e48]
cmp rax, 0x13
jb 0x140061c80
lea rbx, [0x140cd2e30]
cmp rax, 0xf
cmova rbx, qword [0x140cd2e30]
mov qword [0x140cd2e40], 0x13
lea r8d, [r12 + 0x13]
lea rdx, str.Opening_Emulator...
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x13], r12b
jmp 0x140061c9e
lea r9, str.Opening_Emulator...
movzx r8d, byte [rsp + 0x40]
mov edx, reloc.WS2_32.dll_send
lea rcx, [0x140cd2e30]
call fcn.14005e010
mov edx, 0xa
lea rcx, [rsp + 0x48]
call fcn.14006eb90
mov rbx, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 0x5d
jb 0x140061d48
lea rax, [r8 + 0x5d]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0xf
jbe 0x140061cdc
mov rdi, qword [rbx]
lea rax, [0x14012af2d]
mov r15d, 0x5d
lea r14, str.reg_add_HKEY_CURRENT_USERSoftwareTencentMobileGamePC__v_VMDeviceManufacturer__t_REG_SZ__d
cmp rax, rdi
jbe 0x140061d10
lea rax, [rdi + r8]
cmp r14, rax
ja 0x140061d10
cmp rdi, r14
ja 0x140061d08
mov rsi, r12
jmp 0x140061d13
mov rsi, rdi
sub rsi, r14
jmp 0x140061d13
mov rsi, r15
inc r8
lea rcx, [rdi + 0x5d]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 0x5d]
add rdx, rsi
lea rcx, [rdi + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140061d76
mov r15d, 0x5d
mov qword [rsp + 0x28], r15
lea r14, str.reg_add_HKEY_CURRENT_USERSoftwareTencentMobileGamePC__v_VMDeviceManufacturer__t_REG_SZ__d
mov qword [rsp + 0x20], r14
xor r9d, r9d
movzx r8d, byte [rsp + 0x40]
mov edx, r15d
mov rcx, rbx
call fcn.14005e4b0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0xe
jb 0x140061dee
lea rax, [rcx + 0xe]
mov qword [rbp - 0x20], rax
lea rbx, [rbp - 0x30]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x30]
add rbx, rcx
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.__f___nul_2_1
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xe], 0
lea rax, [rbp - 0x30]
jmp 0x140061e12
mov qword [rsp + 0x20], reloc.WS2_32.dll_ntohl
lea r9, str.__f___nul_2_1
movzx r8d, byte [rsp + 0x40]
mov edx, reloc.WS2_32.dll_ntohl
lea rcx, [rbp - 0x30]
call fcn.14005e150
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rbp + 0x10]
call fcn.14006e170
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140061e87
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061e82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140061e82
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d503c
movdqa xmm0, xmmword [0x14012f2b0]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140061ed8
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ed3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140061ed3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d503c
mov edx, 0xa
lea rcx, [rsp + 0x68]
call fcn.14006eb90
mov rbx, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 0x56
jb 0x140061f82
lea rax, [r8 + 0x56]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0xf
jbe 0x140061f16
mov rdi, qword [rbx]
lea rax, [0x14012af86]
mov r15d, 0x56
lea r14, str.reg_add_HKEY_CURRENT_USERSoftwareTencentMobileGamePC__v_VMDeviceModel__t_REG_SZ__d
cmp rax, rdi
jbe 0x140061f4a
lea rax, [rdi + r8]
cmp r14, rax
ja 0x140061f4a
cmp rdi, r14
ja 0x140061f42
mov rsi, r12
jmp 0x140061f4d
mov rsi, rdi
sub rsi, r14
jmp 0x140061f4d
mov rsi, r15
inc r8
lea rcx, [rdi + 0x56]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 0x56]
add rdx, rsi
lea rcx, [rdi + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140061fb0
mov r15d, 0x56
mov qword [rsp + 0x28], r15
lea r14, str.reg_add_HKEY_CURRENT_USERSoftwareTencentMobileGamePC__v_VMDeviceModel__t_REG_SZ__d
mov qword [rsp + 0x20], r14
xor r9d, r9d
movzx r8d, byte [rsp + 0x40]
mov edx, r15d
mov rcx, rbx
call fcn.14005e4b0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov rax, rdx
sub rax, rcx
cmp rax, 0xe
jb 0x140062028
lea rax, [rcx + 0xe]
mov qword [rbp - 0x40], rax
lea rbx, [rbp - 0x50]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x50]
add rbx, rcx
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.__f___nul_2_1
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xe], 0
lea rax, [rbp - 0x50]
jmp 0x14006204c
mov qword [rsp + 0x20], reloc.WS2_32.dll_ntohl
lea r9, str.__f___nul_2_1
movzx r8d, byte [rsp + 0x40]
mov edx, reloc.WS2_32.dll_ntohl
lea rcx, [rbp - 0x50]
call fcn.14005e150
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r12
mov qword [rbp + 8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rbp - 0x10]
call fcn.14006e170
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400620c1
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400620bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400620bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d503c
movdqa xmm0, xmmword [0x14012f2b0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140062111
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006210c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006210c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d503c
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r12
mov r8d, Ordinal_46
lea rdx, str.SOFTWAREWOW6432NodeTencentMobileGamePC_
lea rcx, [rbp + 0x30]
call fcn.14005d6f0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
movdqa xmm1, xmmword [0x14012f2b0]
movdqu xmmword [rbp + 0x78], xmm1
mov byte [rbp + 0x68], 0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov qword [rbp + 0x60], r12
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0xf
cmova rdx, qword [rbp + 0x30]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140062645
mov dword [rbp - 0x58], r12d
mov rsi, qword [rbp + 0x40]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, rsi
cmp rax, 2
jb 0x1400626d0
lea r15, [rbp + 0x30]
cmp qword [rbp + 0x48], 0xf
cmova r15, qword [rbp + 0x30]
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
lea r14, [rsi + 2]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp + 0x10]
movabs rcx, 0x8000000000000000
lea eax, [rbx + 7]
cmp r14, rbx
jbe 0x140062259
mov rbx, r14
or rbx, 0xf
cmp rbx, r13
jbe 0x140062220
mov rbx, r13
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.1400d5000
test rax, rax
je 0x140062639
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140062255
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140062243
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400626c4
jmp 0x140062201
test rcx, rcx
je 0x140062252
call fcn.1400d5000
mov rdi, rax
jmp 0x140062255
mov rdi, r12
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rsi + rdi], 0x4955
mov byte [rdi + r14], 0
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova rdx, qword [rbp + 0x10]
lea r8, [rbp - 0x68]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140062607
mov dword [rbp - 0x58], 0xff
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.InstallPath
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400625fc
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r12
mov qword [rbp + 8], r12
lea rax, [rbp + 0x90]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140062310
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x10]
call fcn.14005d6f0
nop
mov rax, r13
mov rcx, qword [rbp]
sub rax, rcx
cmp rax, 0x16
jb 0x1400626d6
lea r9, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova r9, qword [rbp - 0x10]
mov qword [rsp + 0x30], reloc.WLDAP32.dll_Ordinal_22
lea rax, str.AndroidEmulatorEn.exe
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x10]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x50]
call fcn.14005f8f0
nop
mov r9b, Ordinal_35
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [rbp - 0x50]
call fcn.14006f540
lea rax, [rsp + 0x68]
mov qword [rbp - 0x70], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
mov r8d, 5
lea rdx, str..exe_
lea rcx, [rsp + 0x68]
call fcn.14005d6f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov r8d, 4
lea rdx, str..exe
lea rcx, [rsp + 0x48]
call fcn.14005d6f0
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x50]
call fcn.14006e9a0
mov r13, qword [rbp - 0x40]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 8
jb 0x1400626be
lea r15, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova r15, qword [rbp - 0x50]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea r14, [r13 + 8]
mov edi, reloc.WS2_32.dll_ntohs
lea rsi, [rbp - 0x30]
cmp r14, rdi
jbe 0x1400624c6
mov rdi, r14
or rdi, 0xf
cmp rdi, rcx
jbe 0x140062480
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400d5000
test rax, rax
je 0x1400624a9
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400624c2
cmp rdi, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400624b0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400626ca
jmp 0x140062465
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400624bf
call fcn.1400d5000
mov rsi, rax
jmp 0x1400624c2
mov rsi, r12
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], rdi
mov r8, r13
mov rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movabs rax, 0x303031206d762d20
mov qword [rsi + r13], rax
mov byte [rsi + r14], 0
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
nop
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140062510
mov r8, rbx
lea rcx, [rsp + 0x48]
call fcn.14005d6f0
lea rcx, [rsp + 0x48]
call fcn.14006e380
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140062570
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006256a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006256a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d503c
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400625ae
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400625a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400625a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d503c
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x1400625fc
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400625f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400625f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d503c
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140062645
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062640
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140062640
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d503c
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x14006268e
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062689
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140062689
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d503c
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400d4fe0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14006d9f0
nop
call fcn.14006d990
nop
call fcn.14006d990
nop
call fcn.14006d9f0
nop
call fcn.14006d9f0
int3