Function at 0x1400011c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rdi, rcx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x38]
mov rcx, 0xffffffff80000002
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Pathsmsedge.exe
xor esi, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001314
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x1400033df]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 0x104
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140001314
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov rbx, 0xffffffffffffffff
mov qword [rdi + 0x18], rsi
inc rbx
cmp byte [rax + rbx], sil
jne 0x140001285
movabs rbp, 0x7fffffffffffffff
cmp rbx, rbp
ja 0x1400014d5
mov qword [rdi + 0x18], 0xf
cmp rbx, 0x10
jb 0x1400013d0
mov rax, rbx
or rax, 0xf
cmp rax, rbp
jbe 0x1400012e5
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140001ef0
test rax, rax
jne 0x140001414
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 0x16
mov rbp, rax
cmp rax, rcx
cmovb rbp, rcx
lea rcx, [rbp + 1]
cmp rcx, 0x1000
jb 0x140001454
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400014c9
jmp 0x1400012cd
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Pathschrome.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001482
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x1400033df]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 0x104
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140001482
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov rbx, 0xffffffffffffffff
mov qword [rdi + 0x18], rsi
inc rbx
cmp byte [rax + rbx], sil
jne 0x1400013a6
movabs rbp, 0x7fffffffffffffff
cmp rbx, rbp
ja 0x1400014c3
mov qword [rdi + 0x18], 0xf
cmp rbx, 0x10
jae 0x1400013ed
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x50]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], sil
jmp 0x140001497
mov rax, rbx
or rax, 0xf
cmp rax, rbp
jbe 0x140001422
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140001ef0
test rax, rax
je 0x14000144d
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001461
mov ecx, 0x16
mov rbp, rax
cmp rax, rcx
cmovb rbp, rcx
lea rcx, [rbp + 1]
cmp rcx, 0x1000
jb 0x140001454
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400014cf
jmp 0x140001407
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001461
call fcn.140001ef0
mov rsi, rax
mov qword [rdi], rsi
lea rdx, [rsp + 0x50]
mov qword [rdi + 0x10], rbx
mov r8, rbx
mov rcx, rsi
mov qword [rdi + 0x18], rbp
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
jmp 0x140001497
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 0xf
mov byte [rdi], sil
mov rax, rdi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140001ed0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1400011a0
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.1400011a0
int3