Function at 0x1400c2278
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r15
sub rsp, 0x380
mov rax, qword [0x140157100]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov r13, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov dword [rsp + 0x34], edi
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14015f240], eax
jle 0x1400c2302
lea rcx, [0x14015f240]
call fcn.1400f1734
or rsi, 0xffffffffffffffff
cmp dword [0x14015f240], esi
jne 0x1400c2306
lea rcx, [0x140122514]
call fcn.1400f1a10
lea rcx, [0x14015f240]
call fcn.1400f16c8
jmp 0x1400c2306
or rsi, 0xffffffffffffffff
xorps xmm0, xmm0
cmp qword [0x14015b688], rdi
je 0x1400c234a
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], rdi
mov qword [r13 + 0x18], rdi
lea rdx, [0x14015b678]
cmp qword [0x14015b690], 0xf
cmova rdx, qword [0x14015b678]
mov r8, qword [0x14015b688]
mov rcx, r13
call fcn.140007bd8
jmp 0x1400c2c69
movups xmmword [rsp + 0x128], xmm0
mov qword [rsp + 0x138], rdi
mov qword [rsp + 0x140], 0xf
mov byte [rsp + 0x128], dil
lea rcx, [rsp + 0x80]
call fcn.1400c1cec
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.140005594
mov rdx, qword [rsp + 0x98]
mov r12d, 0x1000
cmp rdx, 0xf
jbe 0x1400c23d1
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, r12
jb 0x1400c23cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c2c9a
call fcn.1400f16c0
nop
jmp 0x1400c23e4
mov dword [rsp + 0x168], 0x200
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
mov qword [rsp + 0x158], rdi
mov qword [rsp + 0x160], rdi
mov r8d, 0x59
lea rdx, str.T0dPwcGlGVMVJtdTnNXDS1ZlnS390xf0BZTdAFiZQH5H1Z3t79VX5_Ld2JAjWXYH4f11TQ2B7uZlVz2f3d_CSQ
lea rcx, [rsp + 0x148]
call fcn.140007b18
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x60]
call fcn.1400c4b70
nop
mov ebx, 2
mov dword [rsp + 0x34], ebx
cmp qword [rax + 0x18], 0xf
jbe 0x1400c244a
mov rax, qword [rax]
mov rdx, rsi
inc rdx
cmp byte [rax + rdx], dil
jne 0x1400c244d
lea rcx, [rsp + 0x128]
cmp qword [rsp + 0x140], 0xf
cmova rcx, qword [rsp + 0x128]
mov r15, qword [rsp + 0x138]
cmp r15, rdx
jne 0x1400c2490
mov r8, r15
mov rdx, rax
call fcn.14011c3f0
test eax, eax
je 0x1400c2673
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xb8], rdi
mov r8d, 0x59
lea rdx, str.Q0NueOGVUKbzFDXdkto4SXRuMVHJxoXQxQcYlgJTbkd5uW31ZRW2J0Ge0MBaVRUtxHAAymDy0MTMi8VhAQEteew
lea rcx, [rsp + 0xa0]
call fcn.140007b18
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x80]
call fcn.1400c4b70
nop
mov ebx, 6
mov dword [rsp + 0x34], ebx
cmp qword [rax + 0x18], 0xf
jbe 0x1400c24ee
mov rax, qword [rax]
mov rdx, rsi
inc rdx
cmp byte [rax + rdx], dil
jne 0x1400c24f1
lea rcx, [rsp + 0x128]
cmp qword [rsp + 0x140], 0xf
cmova rcx, qword [rsp + 0x128]
mov r15, qword [rsp + 0x138]
cmp r15, rdx
jne 0x1400c2534
mov r8, r15
mov rdx, rax
call fcn.14011c3f0
test eax, eax
je 0x1400c2673
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xd8], rdi
mov r8d, 0x59
lea rdx, str.eXNL6YnRtDYlVypTlZzGYjVjfUElDHe1JEOXVJloX35m3Q1IYuU2BJUQ2ZSsRF1SfeEJRZkNSgBVNglSUN7lUg
lea rcx, [rsp + 0xc0]
call fcn.140007b18
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x100]
call fcn.1400c4b70
nop
mov ebx, 0xe
mov dword [rsp + 0x34], ebx
cmp qword [rax + 0x18], 0xf
jbe 0x1400c2592
mov rax, qword [rax]
mov rdx, rsi
inc rdx
cmp byte [rax + rdx], dil
jne 0x1400c2595
lea rcx, [rsp + 0x128]
cmp qword [rsp + 0x140], 0xf
cmova rcx, qword [rsp + 0x128]
mov r15, qword [rsp + 0x138]
cmp r15, rdx
jne 0x1400c25d8
mov r8, r15
mov rdx, rax
call fcn.14011c3f0
test eax, eax
je 0x1400c2673
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, 0x59
lea rdx, str.elhKfZFlUFMkMyYc3lPwOEpwsczwewDCIfSEnQFpHzU_CCX5nhNjU8MHmcitHxJ0hbnQ1KPwlWDDY1BPB4M0Ig
lea rcx, [rsp + 0x40]
call fcn.140007b18
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.1400c4b70
mov ebx, 0x1e
mov dword [rsp + 0x34], ebx
cmp qword [rax + 0x18], 0xf
jbe 0x1400c2626
mov rax, qword [rax]
mov rdx, rsi
inc rdx
cmp byte [rax + rdx], dil
jne 0x1400c2629
lea rcx, [rsp + 0x128]
cmp qword [rsp + 0x140], 0xf
cmova rcx, qword [rsp + 0x128]
mov r15, qword [rsp + 0x138]
cmp r15, rdx
jne 0x1400c2668
mov r8, r15
mov rdx, rax
call fcn.14011c3f0
test eax, eax
je 0x1400c2673
cmp r15, 0x24
mov byte [rsp + 0x30], dil
je 0x1400c2678
mov byte [rsp + 0x30], 1
test bl, 0x10
je 0x1400c26e6
and ebx, 0xffffffef
mov dword [rsp + 0x34], ebx
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0xf
jbe 0x1400c26cb
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, r12
jb 0x1400c26be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c2ca0
call fcn.1400f16c0
mov r15, qword [rsp + 0x138]
movdqa xmm0, xmmword [0x140144900]
movdqu xmmword [rsp + 0xf0], xmm0
mov byte [rsp + 0xe0], dil
jmp 0x1400c26ee
movdqa xmm0, xmmword [0x140144900]
test bl, 8
je 0x1400c275a
and ebx, 0xfffffff7
mov dword [rsp + 0x34], ebx
mov rdx, qword [rsp + 0x118]
cmp rdx, 0xf
jbe 0x1400c2749
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, r12
jb 0x1400c2734
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c2ca6
call fcn.1400f16c0
mov r15, qword [rsp + 0x138]
movdqa xmm0, xmmword [0x140144900]
movdqu xmmword [rsp + 0x110], xmm0
mov byte [rsp + 0x100], dil
test bl, 4
je 0x1400c27c6
and ebx, 0xfffffffb
mov dword [rsp + 0x34], ebx
mov rdx, qword [rsp + 0x98]
cmp rdx, 0xf
jbe 0x1400c27b5
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, r12
jb 0x1400c27a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c2cac
call fcn.1400f16c0
mov r15, qword [rsp + 0x138]
movdqa xmm0, xmmword [0x140144900]
movdqu xmmword [rsp + 0x90], xmm0
mov byte [rsp + 0x80], dil
test bl, 2
je 0x1400c280c
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1400c280c
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r12
jb 0x1400c27ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c2cb2
call fcn.1400f16c0
mov r15, qword [rsp + 0x138]
cmp byte [rsp + 0x30], dil
je 0x1400c2b68
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, 0x4f
lea rdx, str.NDBMHdXc4hbU45nUldtxOE5RWS2d_ECiEgpeT8LJZR8ODkoh6IiRSURBA2vBUEdJOlY1JJQxIQJig
lea rcx, [rsp + 0x40]
call fcn.140007814
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.1400c4eac
nop
mov rdx, qword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x158], xmm1
mov r8, rsi
inc r8
cmp word [rdx + r8*2], di
jne 0x1400c286d
lea rcx, [rsp + 0x148]
call fcn.140007814
lea rdx, [rsp + 0x148]
cmp qword [rsp + 0x160], 7
cmova rdx, qword [rsp + 0x148]
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rcx, [rsp + 0x148]
call fcn.140006708
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400c28ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, 0x2c
lea rdx, str.bFZiRUks5Pd2pFcZ0RqbR0l4ySyE3kAToiDVxItpMA4g
lea rcx, [rsp + 0x40]
call fcn.140007814
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.1400c4eac
nop
mov rdx, qword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x158], xmm1
mov r8, rsi
inc r8
cmp word [rdx + r8*2], di
jne 0x1400c2944
lea rcx, [rsp + 0x148]
call fcn.140007814
lea rdx, [rsp + 0x148]
cmp qword [rsp + 0x160], 7
cmova rdx, qword [rsp + 0x148]
lea rax, [rsp + 0x168]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x16c]
xor r8d, r8d
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
lea rcx, [rsp + 0x148]
call fcn.140006708
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x1400c29d8
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
xorps xmm0, xmm0
test ebx, ebx
je 0x1400c2ac2
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, 0x59
lea rdx, str.b3hwyRXhX5NnQxbbmpzNRkZk7eF9I8QHVIWZwZEvHF5aKQ3ZrUVEhffSF11SSGcGIWQFeHWkN2sdlRIHX0hAYdSA
lea rcx, [rsp + 0x40]
call fcn.140007b18
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1400c4b70
nop
cmp qword [rax + 0x18], 0xf
jbe 0x1400c2a23
mov rax, qword [rax]
inc rsi
cmp byte [rax + rsi], dil
jne 0x1400c2a23
cmp rsi, qword [rsp + 0x140]
ja 0x1400c2a6c
lea rbx, [rsp + 0x128]
cmp qword [rsp + 0x140], 0xf
cmova rbx, qword [rsp + 0x128]
mov qword [rsp + 0x138], rsi
mov r8, rsi
mov rdx, rax
mov rcx, rbx
call fcn.14011b910
mov byte [rbx + rsi], dil
jmp 0x1400c2a80
mov r9, rax
mov rdx, rsi
lea rcx, [rsp + 0x128]
call fcn.1400082f4
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1400c2b52
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r12
jb 0x1400c2ab8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c2cb8
call fcn.1400f16c0
jmp 0x1400c2b52
movups xmmword [rsp + 0x148], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x158], xmm1
lea rax, [rsp + 0x170]
inc rsi
cmp word [rax + rsi*2], di
jne 0x1400c2ade
mov r8, rsi
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x148]
call fcn.140007814
nop
lea rcx, [rsp + 0x148]
cmp qword [rsp + 0x160], 7
cmova rcx, qword [rsp + 0x148]
mov rax, qword [rsp + 0x158]
lea r8, [rcx + rax*2]
lea rdx, [rsp + 0x148]
cmova rdx, qword [rsp + 0x148]
lea rcx, [rsp + 0x128]
call fcn.1400c8dd4
nop
lea rcx, [rsp + 0x148]
call fcn.140006708
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15, qword [rsp + 0x138]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
lea rdx, [rsp + 0x128]
cmp qword [rsp + 0x140], 0xf
cmova rdx, qword [rsp + 0x128]
mov r8, r15
lea rcx, [rsp + 0x40]
call fcn.140007bd8
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1400c215c
mov rdx, rax
lea rbx, [0x14015b678]
mov rcx, rbx
call fcn.140005594
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1400c2bfb
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r12
jb 0x1400c2bf6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c2cbe
call fcn.1400f16c0
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], rdi
mov qword [r13 + 0x18], rdi
cmp qword [0x14015b690], 0xf
cmova rbx, qword [0x14015b678]
mov r8, qword [0x14015b688]
mov rdx, rbx
mov rcx, r13
call fcn.140007bd8
nop
mov rdx, qword [rsp + 0x140]
cmp rdx, 0xf
jbe 0x1400c2c69
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, r12
jb 0x1400c2c64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c2cc4
call fcn.1400f16c0
mov rax, r13
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.1400f16a0
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop r12
ret
call fcn.1400fa6b8
nop
call fcn.1400fa6b8
nop
call fcn.1400fa6b8
nop
call fcn.1400fa6b8
nop
call fcn.1400fa6b8
int3
call fcn.1400fa6b8
int3
call fcn.1400fa6b8
nop
call fcn.1400fa6b8
int3