Function at 0x1400469a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x1400fc3f8]
xor rax, rsp
mov qword [rbp + 0xf8], rax
mov r10, r9
mov rax, r8
mov rbx, rdx
mov qword [rsp + 0x30], rdx
mov r15, qword [rbp + 0x160]
xor r12d, r12d
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r10
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140046a33
mov dword [rsp + 0x40], eax
call fcn.1400039a0
mov qword [rsp + 0x48], rax
mov byte [rbx + 0x40], r12b
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
jmp 0x140046fc1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x60], r12b
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x3c], r12d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x140046a9a
call fcn.1400039a0
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x48], rax
mov byte [rbx + 0x40], 0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
jmp 0x140046fb1
mov ecx, dword [rsp + 0x38]
test ecx, ecx
jne 0x140046acb
mov dword [rsp + 0x40], 0x81
lea rax, [0x1400fd048]
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x40]
mov byte [rbx + 0x40], 0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
jmp 0x140046fb1
mov eax, dword [rsp + 0x3c]
sub eax, 1
je 0x140046dff
cmp eax, 3
jne 0x140046aa2
mov dword [rsp + 0x40], r12d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x140046b35
call fcn.1400039a0
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rsp + 0x58]
mov byte [rbx + 0x40], 0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
jmp 0x140046fb1
lea rax, [0x1400cd438]
mov qword [rbp - 0x50], rax
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x68], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x70], xmm0
mov dword [rsp + 0x50], 8
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x34], 0x78
xor r8d, r8d
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x38]
call fcn.14003de20
nop
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx - 0x50], rax
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx - 0x54], edx
lea rax, vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp - 0x48], rax
mov ecx, 0x10
call fcn.140089c64
mov rdi, rax
test rax, rax
je 0x140046bcb
mov cl, 1
call fcn.1400629bc
mov qword [rdi + 8], rax
jmp 0x140046bce
mov rdi, r12
mov qword [rbp + 0x18], rdi
lea rax, [rbp - 0x40]
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x38]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x18]
mov qword [rbp - 8], rax
lea rax, [rbp]
mov qword [rbp + 8], rax
lea rax, [rbp + 4]
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x18], r12
mov qword [rbp], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x20], r12
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x20], r12
mov dword [rbp + 0x28], 4
mov edx, dword [rsp + 0x40]
lea rcx, [rbp - 0x50]
call fcn.140045f30
nop
mov qword [rbp + 0xb8], r12
mov qword [rbp + 0xc8], r12
mov qword [rbp + 0xd0], 7
mov word [rbp + 0xb8], r12w
mov dword [rsp + 0x50], 0x48
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov ecx, dword [rbp + 0x28]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x140046c9c
mov rax, qword [rbp - 8]
mov r8, qword [rax]
test r8, r8
je 0x140046c9c
mov rax, qword [rbp - 0x28]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x20]
cmovb r8, qword [rbp + 0x20]
sub r8, rdx
sar r8, 1
jmp 0x140046cd7
test cl, 4
jne 0x140046cc9
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
test rcx, rcx
je 0x140046cc9
mov rax, qword [rbp - 0x30]
mov rdx, qword [rax]
mov rax, qword [rbp + 8]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
jmp 0x140046cd7
mov r8, qword [rbp + 0xa8]
mov rdx, qword [rbp + 0xa0]
test rdx, rdx
je 0x140046ce9
lea rcx, [rbp + 0xb8]
call fcn.140003c40
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
lea rdx, [rbp + 0xb8]
lea rcx, [rsp + 0x68]
call fcn.140005950
lea rax, fcn.14002d000
mov qword [rbp - 0x68], rax
lea rax, vtable.type_info.0
or rax, 2
mov qword [rbp - 0x60], rax
mov byte [rbx + 0x40], 1
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.140048740
nop
mov rax, qword [rbp - 0x60]
and eax, 3
sub rax, 1
je 0x140046d7f
cmp rax, 1
jne 0x140046da6
mov rax, qword [rbp - 0x68]
mov rdx, qword [rax]
lea rax, [fcn.14002d000]
lea rcx, [rsp + 0x68]
cmp rdx, rax
jne 0x140046d9d
call fcn.140002430
jmp 0x140046da6
mov rax, qword [rbp - 0x68]
mov rdx, qword [rax]
lea rax, [fcn.14002d000]
mov rcx, qword [rbp - 0x70]
cmp rdx, rax
jne 0x140046d9d
call fcn.140002430
jmp 0x140046da6
mov rax, rdx
call qword [case.0x14005f7f8.0]
mov qword [rbp - 0x60], r12
mov rdx, qword [rbp + 0xd0]
cmp rdx, 8
jb 0x140046df1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046deb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046fe5
call fcn.140089ca0
nop
lea rcx, [rbp - 0x50]
call fcn.140046220
jmp 0x140046fb1
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov r14, rax
mov rsi, 0xffffffffffffffff
cmovo r14, rsi
mov rcx, r14
call fcn.14008a6e8
mov rdi, rax
test rax, rax
je 0x140046e3a
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.14008cc50
jmp 0x140046e3d
mov rdi, r12
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, eax
test eax, eax
je 0x140046e90
call fcn.1400039a0
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x60], rax
mov byte [rbx + 0x40], 0
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
jmp 0x140046fa3
mov eax, dword [rsp + 0x38]
shr rax, 1
mov word [rdi + rax*2], r12w
mov qword [rbp + 0xc0], r12
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], r12
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xb8], r12
movdqa xmm0, xmmword [0x1400e3c30]
movdqu xmmword [rbp + 0xc8], xmm0
inc rsi
cmp word [rdi + rsi*2], 0
jne 0x140046ed3
mov r8, rsi
mov rdx, rdi
lea rcx, [rbp + 0xb8]
call fcn.140003c40
lea rax, fcn.14002d000
mov qword [rbp + 0xe8], rax
lea rax, vtable.type_info.0
or rax, 2
mov qword [rbp + 0xf0], rax
mov byte [rbx + 0x40], 1
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
lea rdx, [rbp + 0xb8]
mov rcx, rbx
call fcn.140048740
nop
mov rax, qword [rbp + 0xf0]
and eax, 3
sub rax, 1
je 0x140046f6f
cmp rax, 1
jne 0x140046f9c
mov rax, qword [rbp + 0xe8]
mov rdx, qword [rax]
lea rax, [fcn.14002d000]
lea rcx, [rbp + 0xb8]
cmp rdx, rax
jne 0x140046f93
call fcn.140002430
jmp 0x140046f9c
mov rax, qword [rbp + 0xe8]
mov rdx, qword [rax]
lea rax, [fcn.14002d000]
mov rcx, qword [rbp + 0xe0]
cmp rdx, rax
jne 0x140046f93
call fcn.140002430
jmp 0x140046f9c
mov rax, rdx
call qword [case.0x14005f7f8.0]
mov qword [rbp + 0xf0], r12
test rdi, rdi
je 0x140046fb1
mov rcx, rdi
call fcn.140089ca0
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140046fc1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rbp + 0xf8]
xor rcx, rsp
call fcn.14008a6c0
add rsp, 0x200
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400916c4
nop
int3