Function at 0x14013ab54
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rsi, rcx
mov rdi, qword [0x140db8f30]
movabs rax, 0x4428a7a3fe0973bf
mov qword [rbp - 0x19], rax
movabs r12, 0x7c76a5234c77e89c
mov qword [rbp - 0x11], r12
movabs rax, 0x214fc6d6996712d3
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], r12
movdqa xmm0, xmmword [rbp - 0x19]
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x19], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x19]
or rbx, 0xffffffffffffffff
mov r8, rbx
xor r14d, r14d
inc r8
cmp byte [rax + r8], r14b
jne 0x14013abda
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.140131988
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rdx, qword [rbp + 7]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov r15d, 0x1000
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14013ac56
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, r15
jb 0x14013ac51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013b2eb
call fcn.140c4bba0
test edi, edi
jne 0x14013ad5f
mov rdi, qword [0x140db8f30]
movabs rax, 0x4428a7a3fe0973bf
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], r12
movabs rax, 0x214fc6d6996712d3
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], r12
movdqa xmm0, xmmword [rbp - 0x19]
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x19], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x19]
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x14013acad
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.140131988
nop
lea r8, [rbp + 7]
lea rdx, [rbp + 0x27]
mov rcx, rdi
call fcn.14013624c
lea rcx, [rsi + 0x20]
mov rdx, rax
call fcn.14012d934
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0xf
jbe 0x14013ad17
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, r15
jb 0x14013ad12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013b2f1
call fcn.140c4bba0
movdqa xmm0, xmmword [0x140d88bb0]
movdqu xmmword [rbp + 0x37], xmm0
mov byte [rbp + 0x27], r14b
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14013ad5f
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, r15
jb 0x14013ad5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013b2f7
call fcn.140c4bba0
mov rdi, qword [0x140db8f30]
movabs rax, 0x4e10abb3ed146ba0
mov qword [rbp + 7], rax
movabs rax, 0x817df4a211e9cec
mov qword [rbp + 0xf], rax
movabs rax, 0xbdbe415885fc0514
mov qword [rbp + 0x17], rax
movabs rax, 0x4ce4a14dd01594be
mov qword [rbp + 0x1f], rax
movabs rcx, 0x214fc6d6996712d3
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x11], r12
movabs rcx, 0xbdbe415885926a7d
mov qword [rbp - 9], rcx
mov qword [rbp - 1], rax
movdqa xmm0, xmmword [rbp + 7]
xorps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm1, xmmword [rbp + 0x17]
xorps xmm1, xmmword [rbp - 9]
movdqa xmmword [rbp + 0x17], xmm1
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea rax, [rbp + 7]
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x14013adf4
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x19]
call fcn.140131988
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14013ae6a
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, r15
jb 0x14013ae65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013b2fd
call fcn.140c4bba0
test edi, edi
jne 0x14013af69
mov rdi, qword [0x140db8f30]
movabs rax, 0x4e10abb3ed146ba0
mov qword [rbp + 7], rax
movabs rax, 0x817df4a211e9cec
mov qword [rbp + 0xf], rax
movabs rax, 0xbdbe415885fc0514
mov qword [rbp + 0x17], rax
movabs rax, 0x4ce4a14dd01594be
mov qword [rbp + 0x1f], rax
movabs rcx, 0x214fc6d6996712d3
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x11], r12
movabs rcx, 0xbdbe415885926a7d
mov qword [rbp - 9], rcx
mov qword [rbp - 1], rax
movdqa xmm0, xmmword [rbp + 7]
xorps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm1, xmmword [rbp + 0x17]
xorps xmm1, xmmword [rbp - 9]
movdqa xmmword [rbp + 0x17], xmm1
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea rax, [rbp + 7]
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x14013af07
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x19]
call fcn.140131988
nop
lea rdx, [rbp - 0x19]
mov rcx, rdi
call fcn.1401366ec
test eax, eax
setne al
mov byte [rsi + 0x40], al
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14013af69
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, r15
jb 0x14013af64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013b303
call fcn.140c4bba0
mov rdi, qword [0x140db8f30]
movabs rax, 0x403bb589f61367b2
mov qword [rbp - 0x19], rax
movabs rax, 0x7c76a5234c779cee
mov qword [rbp - 0x11], rax
movabs rax, 0x214fc6d6996712d3
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], r12
movdqa xmm0, xmmword [rbp - 0x19]
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x19], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x19]
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x14013afc2
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.140131988
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rdx, qword [rbp + 7]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14013b038
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, r15
jb 0x14013b033
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013b309
call fcn.140c4bba0
test edi, edi
jne 0x14013b0fb
mov rdi, qword [0x140db8f30]
movabs rax, 0x403bb589f61367b2
mov qword [rbp - 0x19], rax
movabs rax, 0x7c76a5234c779cee
mov qword [rbp - 0x11], rax
movabs rax, 0x214fc6d6996712d3
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], r12
movdqa xmm0, xmmword [rbp - 0x19]
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x19], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x19]
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x14013b099
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.140131988
nop
lea rdx, [rbp + 7]
mov rcx, rdi
call fcn.1401366ec
test eax, eax
setne al
mov byte [rsi + 0x41], al
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14013b0fb
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, r15
jb 0x14013b0f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013b30f
call fcn.140c4bba0
mov rdi, qword [0x140db8f30]
movabs rax, 0x214fc6d6f11373a3
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], r12
movabs rax, 0x214fc6d6996712d3
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], r12
movdqa xmm0, xmmword [rbp - 0x19]
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x19], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x19]
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x14013b14a
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.140131988
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rdx, qword [rbp + 7]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14013b1c0
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, r15
jb 0x14013b1bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013b315
call fcn.140c4bba0
test edi, edi
jne 0x14013b2c4
mov rdi, qword [0x140db8f30]
movabs rax, 0x214fc6d6f11373a3
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], r12
movabs rax, 0x214fc6d6996712d3
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], r12
movdqa xmm0, xmmword [rbp - 0x19]
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x19], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x19]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x14013b214
mov r8, rbx
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.140131988
nop
lea r8, [rbp + 7]
lea rdx, [rbp + 0x27]
mov rcx, rdi
call fcn.14013624c
mov rdx, rax
mov rcx, rsi
call fcn.14012d934
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0xf
jbe 0x14013b280
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, r15
jb 0x14013b27b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013b31b
call fcn.140c4bba0
movdqa xmm0, xmmword [0x140d88bb0]
movdqu xmmword [rbp + 0x37], xmm0
mov byte [rbp + 0x27], r14b
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14013b2c4
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, r15
jb 0x14013b2bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013b2e5
call fcn.140c4bba0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140c5acfc
int3
call fcn.140c5acfc
nop
call fcn.140c5acfc
nop
call fcn.140c5acfc
int3
call fcn.140c5acfc
int3
call fcn.140c5acfc
int3
call fcn.140c5acfc
int3
call fcn.140c5acfc
int3
call fcn.140c5acfc
nop
call fcn.140c5acfc
int3