Function at 0x14003fe40
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x128]
sub rsp, 0x200
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1400f0028]
xor rax, rsp
mov qword [rbp + 0xe0], rax
xor r14d, r14d
mov dword [rbp - 0x80], r14d
lea rcx, str.Settings
call fcn.1400884d0
test al, al
je 0x140040996
lea rbx, [0x1400f1c58]
lea rsi, [r14 - 1]
cmp byte [0x1400f0058], r14b
je 0x140040003
mov byte [0x1400f0058], r14b
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsLeagueClientUx.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14003ffee
mov dword [rbp - 0x80], 0x104
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.debugger
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14003ffa6
mov r8d, dword [rbp - 0x80]
mov qword [rsp + 0x40], r14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x40]
call fcn.140003660
mov rdx, qword [0x1400f1c70]
cmp rdx, 0x10
jb 0x14003ff7a
mov rcx, qword [0x1400f1c58]
inc rdx
cmp rdx, 0x1000
jb 0x14003ff75
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003ff9f
mov rcx, r8
call fcn.1400a4c6c
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [0x1400f1c58], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [0x1400f1c68], xmm1
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140040003
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp eax, 2
jne 0x14003ffb8
lea r8d, [rax + 5]
lea rdx, str.Nothing
jmp 0x14003ffd9
movsxd rdx, eax
lea rax, str.Failed__error_code
add rdx, rax
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], r14b
jne 0x14003ffd0
mov rcx, rbx
call fcn.14000ede0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140040003
mov r8d, 5
lea rdx, str.Error
mov rcx, rbx
call fcn.14000ede0
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400f1fc0], eax
jle 0x140040063
lea rcx, [0x1400f1fc0]
call fcn.1400a4e28
cmp dword [0x1400f1fc0], 0xffffffff
jne 0x140040063
mov qword [0x1400f6430], r14
movdqa xmm0, xmmword [0x1400da350]
movdqu xmmword [0x1400f6440], xmm0
lea rcx, [0x1400ade30]
call fcn.1400a4c4c
lea rcx, [0x1400f1fc0]
call fcn.1400a4dc8
lea rdx, [0x1400f1c10]
lea rcx, str.Auto_rename
call fcn.14007d1d0
movss xmm6, dword [0x1400da2d8]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400629f0
lea rcx, str.Automatically_renames_the_program_on_launch
call fcn.140023590
lea rdx, [0x1400f1c55]
lea rcx, str.Stream_Proof
call fcn.14007d1d0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400629f0
lea rcx, str.Hides_the_program_in_recordings_and_screenshots
call fcn.140023590
lea rdx, [0x1400f1c56]
lea rcx, str.Register_debugger_IFEO
call fcn.14007d1d0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400629f0
cmp qword [0x1400f1c70], 0x10
cmovae rbx, qword [0x1400f1c58]
mov rdx, rbx
lea rcx, str.__Hooked_to:__s
call fcn.14007b1c0
mov qword [rsp + 0x70], 0
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, str.Clean_logs
call fcn.14007bdb0
lea r12, [0x1400f6430]
test al, al
je 0x1400401f2
lea rcx, [rsp + 0x40]
call fcn.140021a50
mov rbx, rax
cmp r12, rax
je 0x1400401b2
mov rdx, qword [0x1400f6448]
cmp rdx, 0x10
jb 0x140040177
mov rcx, qword [0x1400f6430]
inc rdx
cmp rdx, 0x1000
jb 0x140040172
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400401e6
mov rcx, r8
call fcn.1400a4c6c
movdqa xmm0, xmmword [0x1400da350]
movdqu xmmword [0x1400f6440], xmm0
mov byte [0x1400f6430], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x1400f6430], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1400f6440], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1400401f2
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400401ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400401ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a4c6c
lea rdi, [0x1400f1c18]
mov r8, qword [0x1400f1c28]
cmp qword [0x1400f1c30], 0x10
jb 0x140040216
mov rdx, qword [0x1400f1c18]
add r8, rdx
jmp 0x14004021c
add r8, rdi
mov rdx, rdi
sub r8, rdx
lea rbx, [0x1400f62a0]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rcx, str.League_path:
call fcn.14007b1c0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
mov r8, rbx
xor edx, edx
lea rcx, str.leaguePath
call fcn.140081f80
mov r8, rsi
inc r8
cmp byte [rbx + r8], 0
jne 0x140040276
mov rdx, rbx
mov rcx, rdi
call fcn.14000ede0
mov rax, qword [0x1400f1be0]
mov rcx, qword [rax + 0x1a88]
cmp byte [rcx + 0x8b], 0
jne 0x1400402b4
mov eax, dword [rcx + 0x1b0]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.14007ddb0
lea rcx, str.Font:
call fcn.14007b1c0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400629f0
lea rcx, str.This_is_the_programs_font__not_Leagues
call fcn.140023590
mov r15, qword [0x1400f1be0]
mov r13, qword [r15 + 0x1920]
mov rdx, qword [r13 + 0x48]
test rdx, rdx
je 0x1400402f4
add rdx, 0x56
jmp 0x1400402fb
lea rdx, str._unknown_
xor r8d, r8d
lea rcx, str.fontSelector
call fcn.14007e530
test al, al
je 0x1400403eb
mov edi, r14d
mov rax, qword [r15 + 0xa8]
cmp dword [rax + 0x40], r14d
jle 0x1400403a7
mov qword [rsp + 0x70], rdi
nop dword [rax + rax]
mov rax, qword [rax + 0x48]
mov rbx, qword [r14 + rax]
mov rcx, rbx
call fcn.140062560
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x14004034f
add rcx, 0x56
jmp 0x140040356
lea rcx, str._unknown_
cmp rbx, r13
sete dl
lea r9, [rsp + 0x70]
call fcn.1400866b0
test al, al
je 0x14004037c
mov qword [r15 + 0xb8], rbx
mov dword [0x1400f1c50], edi
call fcn.14001dc20
mov rbx, qword [0x1400f1be0]
mov rax, qword [rbx + 0x1a88]
dec dword [rax + 0xc8]
inc edi
add r14, 8
mov rax, qword [r15 + 0xa8]
cmp edi, dword [rax + 0x40]
jl 0x140040330
xor r14d, r14d
jmp 0x1400403ae
mov rbx, qword [0x1400f1be0]
mov rax, qword [rbx + 0x1a88]
cmp qword [rbx + 0x1c08], rax
jne 0x1400403cf
mov qword [rbx + 0x1d28], rax
mov dword [rbx + 0x1d30], 2
test dword [rax + 0xc], 0x1000000
je 0x1400403df
mov byte [rbx + 0x1a1e], 1
call fcn.140061c90
mov byte [rbx + 0x1a1e], 0
mov qword [rbp - 0x58], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov r8d, 0x11
lea rdx, str.C:_Windows_Fonts_
lea rcx, [rbp - 0x58]
call fcn.140003660
nop
lea rcx, [rbp - 0x58]
mov r8, qword [rbp - 0x48]
cmp qword [rbp - 0x40], 0x10
jb 0x140040426
mov rdx, qword [rbp - 0x58]
add r8, rdx
jmp 0x14004042d
add r8, rcx
lea rdx, [rbp - 0x58]
sub r8, rdx
lea rbx, [0x1401069e0]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rcx, str.Font_path:
call fcn.14007b1c0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
mov r8, rbx
xor edx, edx
lea rcx, str.inputFont
call fcn.140081f80
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400629f0
mov qword [rsp + 0x70], 0
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, str.Add_font
call fcn.14007bdb0
test al, al
je 0x140040798
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r14
inc rsi
cmp byte [rbx + rsi], 0
jne 0x1400404c0
mov r8, rsi
mov rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.140003660
nop
mov rdi, qword [rbp - 0x68]
lea rbx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rbx, qword [rbp - 0x78]
call fcn.1400a3bfc
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.14001a8f0
nop
mov dword [rbp - 0x80], 0xd
lea rcx, [rsp + 0x40]
call fcn.14001bc90
mov r14, qword [rbp - 0x60]
mov rsi, qword [rbp - 0x68]
mov r15, qword [rbp - 0x78]
test al, al
je 0x140040585
lea rbx, [rbp - 0x78]
cmp r14, 0x10
cmovae rbx, r15
cmp rsi, 1
jb 0x140040585
lea rdi, [rbx + rsi]
mov r8, rsi
mov edx, 0x2e
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140040585
cmp byte [rax], 0x2e
jne 0x140040561
xor ecx, ecx
jmp 0x140040566
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x1400405c7
inc rax
mov r8, rdi
sub r8, rax
mov edx, 0x2e
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140040558
xor bl, bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400405e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400405d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400405d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x140040585
mov bl, 1
jmp 0x140040587
call fcn.1400a4c6c
mov r14, qword [rbp - 0x60]
mov rsi, qword [rbp - 0x68]
mov r15, qword [rbp - 0x78]
test bl, bl
je 0x140040744
mov rdi, qword [0x1400f1c40]
mov rbx, qword [0x1400f1c38]
cmp rbx, rdi
je 0x14004064c
cmp r14, 0x10
setae r14b
nop dword [rax + rax]
lea rdx, [rbp - 0x78]
test r14b, r14b
cmovne rdx, r15
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14004062c
mov rcx, qword [rbx]
cmp r8, rsi
jne 0x14004063a
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140040643
add rbx, 0x20
cmp rbx, rdi
jne 0x140040610
cmp rbx, rdi
jne 0x140040735
cmp rdi, qword [0x1400f1c48]
je 0x14004066b
lea rdx, [rbp - 0x78]
mov rcx, rdi
call fcn.140027980
add qword [0x1400f1c40], 0x20
jmp 0x14004067e
lea r8, [rbp - 0x78]
mov rdx, rdi
lea rcx, [0x1400f1c38]
call fcn.140047ce0
mov byte [0x1400f1c54], 1
call fcn.14001dc20
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rbp - 0x68]
sub rax, rcx
cmp rax, 0x29
jb 0x1400409d2
lea r9, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae r9, qword [rbp - 0x78]
mov qword [rsp + 0x30], 0x29
lea rax, str._font_added__restart_program_to_select_it
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x40]
call fcn.140047720
mov rdx, qword [0x1400f6448]
cmp rdx, 0x10
jb 0x140040714
mov rcx, qword [0x1400f6430]
inc rdx
cmp rdx, 0x1000
jb 0x14004070f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004072e
mov rcx, r8
call fcn.1400a4c6c
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [0x1400f6430], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [0x1400f6440], xmm1
jmp 0x14004075a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8d, 0x12
lea rdx, str.Font_already_added
jmp 0x140040751
mov r8d, 0xe
lea rdx, str.Font_not_found
mov rcx, r12
call fcn.14000ede0
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140040798
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040793
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040793
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a4c6c
mov qword [rsp + 0x70], 0
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, str.Reset_window_size
call fcn.14007bdb0
test al, al
je 0x1400407d9
mov dword [0x1400f1c90], 0x2da
mov dword [0x1400f1c94], 0x212
mov byte [0x1400f1c98], 1
call fcn.14001dc20
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400629f0
mov r8d, dword [0x1400f1c90]
mov dword [rbp - 0x68], r8d
movabs rax, 0x1000000000000000
mov qword [rbp - 0x78], rax
mov eax, dword [0x1400f1c94]
mov dword [rbp - 0x64], eax
movabs rax, 0x1000000000000004
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x70], 2
lea rax, [rbp - 0x78]
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x60], xmm0
lea rax, str.0x1
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 7
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.14000a600
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
call fcn.14007b1c0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1400408b2
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400408ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400408ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a4c6c
movdqa xmm0, xmmword [0x1400da350]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rax, qword [0x1400f1be0]
mov rcx, qword [rax + 0x1a88]
cmp byte [rcx + 0x8b], 0
jne 0x1400408ee
mov eax, dword [rcx + 0x1b0]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.14007ddb0
lea rcx, str.GitHub_repository:
call fcn.14007b1c0
call fcn.1400237b0
cmp qword [0x1400f6448], 0x10
cmovae r12, qword [0x1400f6430]
mov rcx, r12
call fcn.14007b460
mov rdx, qword [0x1400f1be0]
mov r8, qword [rdx + 0x1a88]
cmp byte [r8 + 0x8b], 0
jne 0x140040956
mov rdx, qword [rdx + 0x2050]
test rdx, rdx
je 0x140040956
movsx rax, word [rdx + 0x70]
lea rcx, [rax + rax*8]
mov rax, qword [rdx + 8]
test byte [rax + rcx*4 + 4], 8
jne 0x140040956
dec dword [r8 + 0xc8]
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14004099d
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004098f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004098f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a4c6c
jmp 0x14004099d
mov byte [0x1400f0058], 1
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.1400a4570
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001380
nop
int3