Function at 0x14021eb00
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x1403ceac0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r15, rdx
mov r12, rcx
mov qword [rsp + 0x60], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [r11 - 0x78], xmm0
movups xmmword [r11 - 0x68], xmm0
movups xmmword [r11 - 0x58], xmm0
movss dword [rsp + 0xe0], xmm0
xor esi, esi
mov qword [r11 - 0x80], rsi
mov qword [r11 - 0x78], rsi
lea ecx, [rsi + 0x50]
call fcn.140296fc8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf8], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x118], 8
movss xmm0, dword [0x140378060]
movss dword [rsp + 0xe0], xmm0
mov r8, rax
lea edx, [rsi + 0x10]
lea rcx, [rsp + 0xf8]
call fcn.14007ea10
nop
mov dword [rsp + 0xd0], esi
mov dword [rsp + 0xc8], esi
mov dword [rsp + 0xcc], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0xcc]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14021ecdf
lea rdx, [rsp + 0xe0]
mov rcx, r15
call fcn.1400839b0
nop
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf8]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov r8, rcx
cmp rdx, 0x1000
jb 0x14021ec89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x14021efcc
call fcn.140296f94
xorps xmm0, xmm0
mov qword [rsp + 0xf8], rsi
movdqa xmmword [rsp + 0x100], xmm0
lea rcx, [rsp + 0xe8]
call fcn.14007e040
mov rax, r15
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140296f70
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
inc dword [rsp + 0xcc]
inc dword [rsp + 0xc8]
mov ecx, dword [rsp + 0xcc]
mov eax, 2
mul rcx
mov rbx, rax
mov r13, 0xffffffffffffffff
cmovo rbx, r13
mov rcx, rbx
call fcn.1402974ec
mov rdi, rax
test rax, rax
je 0x14021ed29
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.1402b60e0
jmp 0x14021ed2c
mov rdi, rsi
mov qword [rsp + 0x120], rdi
mov ecx, dword [rsp + 0xc8]
mov eax, 2
mul rcx
mov r14, rax
cmovo r14, r13
mov rcx, r14
call fcn.1402974ec
mov rbx, rax
test rax, rax
je 0x14021ed69
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.1402b60e0
jmp 0x14021ed6c
mov rbx, rsi
mov qword [rsp + 0x128], rbx
mov r14d, esi
nop word [rax + rax]
cmp r14d, dword [rsp + 0xd0]
jae 0x14021ef56
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0xdc], eax
mov eax, dword [rsp + 0xcc]
mov dword [rsp + 0xd8], eax
mov dword [rsp + 0xd4], esi
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0xd4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xdc]
mov r8, rbx
mov edx, r14d
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x14021ee8c
mov rcx, r15
call fcn.140083b50
nop
test rbx, rbx
je 0x14021ee0c
mov rcx, rbx
call fcn.140296f94
nop
test rdi, rdi
je 0x14021ee1a
mov rcx, rdi
call fcn.140296f94
nop
mov rax, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf8]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14021ee5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14021efd2
call fcn.140296f94
mov qword [rsp + 0xf8], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x100], xmm0
lea rcx, [rsp + 0xe8]
call fcn.14007e040
mov rax, r15
jmp 0x14021ecb2
mov eax, dword [rsp + 0xd4]
dec eax
cmp eax, 1
ja 0x14021ef4e
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], si
mov r8, r13
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x14021eec0
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.14002b640
nop
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], si
mov r8, r13
nop dword [rax + rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x14021ef00
mov rdx, rdi
lea rcx, [rsp + 0x90]
call fcn.14002b640
nop
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xe0]
call fcn.14021d2d0
nop
lea rcx, [rsp + 0x90]
call fcn.14002ce60
lea rcx, [rsp + 0x70]
call fcn.14002ce60
inc r14d
jmp 0x14021ed80
test rbx, rbx
je 0x14021ef64
mov rcx, rbx
call fcn.140296f94
nop
test rdi, rdi
je 0x14021ef72
mov rcx, rdi
call fcn.140296f94
nop
jmp 0x14021ef7b
lea rdx, [rsp + 0xe0]
mov rcx, r15
call fcn.1400839b0
nop
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf8]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14021ec89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14021ec89
call fcn.1402ba3ec
int3
call fcn.1402ba3ec
int3