Function at 0x14000dd50
Capabilities:
Get thread local storage value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov ebx, r9d
mov dword [rsp + 0x58], ebx
mov r14, r8
mov qword [rbp - 0x60], r8
mov r15, rdx
mov qword [rbp - 0x80], rdx
mov qword [rbp - 0x58], rcx
xor esi, esi
lea ecx, [rsi + 2]
call fcn.1400e8270
mov r13, rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x50], rax
mov word [rax], si
lea ecx, [rsi + 2]
call fcn.1400e8270
mov rdi, rax
mov qword [rbp - 0x48], rax
mov word [rax], si
lea ecx, [rsi + 2]
call fcn.1400e8270
mov r12, rax
mov qword [rbp], rax
mov word [rax], si
lea ecx, [rsi + 2]
call fcn.1400e8270
mov qword [rbp - 0x28], rax
mov word [rax], si
lea rsi, [0x14011eaa0]
cmp ebx, 0xffffffff
jne 0x14000e192
mov rcx, rsi
call fcn.1400e81d8
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e81d8
mov qword [rsp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e81d8
mov qword [rsp + 0x68], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e81d8
mov qword [rsp + 0x78], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e81d8
mov qword [rbp - 0x68], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e81d8
mov qword [rbp - 0x70], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e81d8
mov r15, rax
mov qword [rsp + 0x50], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rbx, rsi
test r14, r14
cmovne rbx, r14
mov rcx, rbx
call fcn.1400e81d8
mov r13, rax
mov qword [rsp + 0x60], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x60]
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x38]
call fcn.14000b540
nop
lea rcx, [0x14011f8c0]
call fcn.1400e81d8
mov rsi, rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, rbx
call fcn.1400e81d8
mov r14, rax
xor ecx, ecx
call fcn.1400e825c
nop
mov ecx, 2
call fcn.1400e8270
mov qword [rbp - 0x40], rax
xor ecx, ecx
mov word [rax], cx
mov rax, qword [rbp - 0x80]
cmp rax, qword [0x14016aa18]
jne 0x14000df15
lea rcx, [0x14011ec08]
jmp 0x14000df2e
lea rcx, [0x14011ebf8]
lea rdx, [0x14011f8bc]
cmp rax, qword [0x14016aa20]
cmovne rcx, rdx
call fcn.1400e81d8
mov qword [rsp + 0x50], rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eb8c]
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
mov rax, qword [rsp + 0x50]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rsp + 0x58], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [rsp + 0x58]
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rsp + 0x60], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.140005790
mov rbx, qword [rsp + 0x60]
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rsp + 0x60], rax
mov rcx, qword [rbp - 0x40]
call fcn.1400e825c
mov rcx, rbx
call fcn.1400e825c
mov rcx, qword [rsp + 0x58]
call fcn.1400e825c
mov rcx, qword [rsp + 0x50]
call fcn.1400e825c
cmp word [rsi], 0
je 0x14000e06b
lea rcx, [0x14011eb8c]
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rsp + 0x50], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.140005790
mov rcx, qword [rsp + 0x50]
call fcn.1400e825c
nop
mov edx, dword [0x1401a9af0]
mov rax, qword gs:[0x58]
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
mov rax, qword [rax + rdx*8]
mov ecx, dword [rcx + rax]
cmp dword [0x140179250], ecx
jle 0x14000e0d1
lea rcx, [0x140179250]
call fcn.1400e151c
cmp dword [0x140179250], 0xffffffff
jne 0x14000e0d1
mov ecx, 2
call fcn.1400e8270
mov qword [0x140179248], rax
xor ecx, ecx
mov word [rax], cx
lea rcx, [0x14011b1f0]
call fcn.1400e137c
lea rcx, [0x140179250]
call fcn.1400e14bc
mov rbx, qword [0x140179248]
lea rcx, [0x14011eaa0]
mov rax, qword [rsp + 0x60]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [0x140179248], rax
mov rcx, rbx
call fcn.1400e825c
xor ebx, ebx
mov dword [rsp + 0x58], ebx
mov rcx, qword [rsp + 0x60]
call fcn.1400e825c
nop
mov rcx, r14
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x38]
call fcn.1400e825c
nop
mov rcx, r13
call fcn.1400e825c
nop
mov rcx, r15
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x70]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x68]
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x78]
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x68]
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x48]
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x40]
call fcn.1400e825c
lea rsi, [0x14011eaa0]
mov r13, qword [rbp - 0x78]
mov r15, qword [rbp - 0x80]
mov r14, qword [rbp - 0x60]
jmp 0x14000e194
xor ebx, ebx
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, eax
xor r8d, r8d
mov rdx, r14
mov rcx, r15
call fcn.140009290
test eax, eax
jne 0x14000e871
mov dword [rsp + 0x70], 0x320
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000e866
cmp dword [rsp + 0x70], eax
je 0x14000e866
lea ecx, [rax + 2]
call fcn.1400e8270
mov qword [rbp - 0x20], rax
mov word [rax], bx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rbx
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x10]
call fcn.14000a050
test al, al
je 0x14000e854
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
mov qword [rbp - 0x78], rax
cmp word [rax], 0x25
jne 0x14000e25a
cmp word [rax + 2], 0x31
jne 0x14000e25a
cmp word [rax + 4], 0
je 0x14000e854
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp - 0x20]
mov rdx, qword [rbp - 0x58]
lea rcx, [rsp + 0x40]
call fcn.14000a570
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14000bfb0
mov rbx, qword [rsp + 0x48]
mov rcx, rsi
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rbp - 0x50], rax
mov rcx, r13
call fcn.1400e825c
mov rcx, rbx
call fcn.1400e825c
lea rcx, [0x14011f8c0]
call fcn.1400e81d8
mov r14, rax
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rbx, rsi
mov rax, qword [rbp - 0x60]
test rax, rax
cmovne rbx, rax
mov qword [rsp + 0x50], rbx
mov rcx, rbx
call fcn.1400e81d8
mov rsi, rax
mov qword [rsp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
mov rdx, r15
lea rcx, [rbp - 0x70]
call fcn.14000b540
mov r13, rax
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov rdi, rax
mov qword [rsp + 0x68], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, rbx
call fcn.1400e81d8
mov rbx, rax
mov qword [rsp + 0x78], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x78]
mov rdx, r15
lea rcx, [rbp - 0x68]
call fcn.14000b540
mov r15, rax
lea rcx, [0x14011eaa0]
mov rax, qword [rbp - 0x78]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rbp - 0x60], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rax, [rbp + 8]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9, r13
mov r8, r15
lea rdx, [rbp - 0x60]
mov rcx, qword [rbp - 0x58]
call fcn.1400058c0
movzx r15d, al
mov rcx, qword [rbp - 0x60]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x68]
call fcn.1400e825c
nop
mov rcx, rbx
call fcn.1400e825c
nop
mov rcx, rdi
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x70]
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e825c
nop
mov rcx, r14
call fcn.1400e825c
test r15b, r15b
je 0x14000e84c
cmp dword [rsp + 0x58], 0xffffffff
jne 0x14000e647
lea rbx, [0x14011eaa0]
mov rcx, rbx
call fcn.1400e81d8
mov r15, rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, rbx
call fcn.1400e81d8
mov r13, rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, rbx
call fcn.1400e81d8
mov qword [rbp - 0x40], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, rbx
call fcn.1400e81d8
mov qword [rbp - 0x38], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, rbx
call fcn.1400e81d8
mov qword [rbp - 0x70], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, rbx
call fcn.1400e81d8
mov qword [rbp - 0x68], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, rbx
call fcn.1400e81d8
mov rbx, rax
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x50]
call fcn.1400e81d8
mov rdi, rax
mov qword [rsp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
mov rdx, qword [rbp - 0x80]
lea rcx, [rsp + 0x78]
call fcn.14000b540
nop
lea rcx, [0x14011f8c0]
call fcn.1400e81d8
mov rsi, rax
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x50]
call fcn.1400e81d8
mov r14, rax
mov qword [rsp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
mov rdx, qword [rbp - 0x80]
lea rcx, [rsp + 0x68]
call fcn.14000b540
mov qword [rsp + 0x40], rax
mov eax, reloc.OLEAUT32.dll_SafeArrayLock
mov qword [rsp + 0x48], rax
mov edx, dword [0x1401a9af0]
mov rcx, qword gs:[0x58]
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [rax + rdx]
cmp dword [0x140179250], ecx
jle 0x14000e58f
lea rcx, [0x140179250]
call fcn.1400e151c
cmp dword [0x140179250], 0xffffffff
jne 0x14000e58f
mov ecx, 2
call fcn.1400e8270
mov qword [0x140179248], rax
xor ecx, ecx
mov word [rax], cx
lea rcx, [0x14011b1f0]
call fcn.1400e137c
lea rcx, [0x140179250]
call fcn.1400e14bc
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [0x140179248]
mov qword [rsp + 0x40], rcx
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [0x140179248], rax
mov rcx, qword [rsp + 0x40]
call fcn.1400e825c
xor eax, eax
mov dword [rsp + 0x58], eax
mov rcx, qword [rsp + 0x68]
call fcn.1400e825c
nop
mov rcx, r14
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x78]
call fcn.1400e825c
nop
mov rcx, rdi
call fcn.1400e825c
nop
mov rcx, rbx
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x68]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x70]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x38]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x40]
call fcn.1400e825c
nop
mov rcx, r13
call fcn.1400e825c
nop
mov rcx, r15
call fcn.1400e825c
mov r13, qword [rsp + 0x48]
jmp 0x14000e64d
mov r13d, reloc.OLEAUT32.dll_SafeArrayLock
lea rbx, [0x14011eaa0]
mov rcx, rbx
call fcn.1400e81d8
mov rdi, rax
mov qword [rbp - 0x68], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, rbx
call fcn.1400e81d8
mov rsi, rax
mov qword [rbp - 0x70], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011f8c0]
call fcn.1400e81d8
mov r14, rax
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x50]
call fcn.1400e81d8
mov r15, rax
mov qword [rsp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
mov rdx, qword [rbp - 0x80]
lea rcx, [rsp + 0x78]
call fcn.14000b540
mov qword [rsp + 0x68], rax
mov rcx, rbx
mov rax, qword [rbp - 0x78]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rbp - 0x58], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov edx, dword [0x1401a9af0]
mov rcx, qword gs:[0x58]
mov rdx, qword [rcx + rdx*8]
mov r8d, dword [rdx + r13]
cmp dword [0x140179250], r8d
jle 0x14000e757
lea rcx, [0x140179250]
call fcn.1400e151c
cmp dword [0x140179250], 0xffffffff
jne 0x14000e757
mov ecx, 2
call fcn.1400e8270
mov qword [0x140179248], rax
xor ecx, ecx
mov word [rax], cx
lea rcx, [0x14011b1f0]
call fcn.1400e137c
lea rcx, [0x140179250]
call fcn.1400e14bc
mov r13, qword [rbp - 0x50]
mov qword [rbp - 0x78], r13
cmp dword [rsp + 0x58], 0xffffffff
je 0x14000e7e1
mov ecx, 2
call fcn.1400e8270
mov r13, rax
xor eax, eax
mov word [r13], ax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
test rax, rax
cmovne rbx, rax
mov rcx, rbx
call fcn.1400e81d8
mov rbx, rax
mov qword [rsp + 0x68], rax
mov rcx, r13
call fcn.1400e825c
cmp dword [0x140178168], 1
jne 0x14000e7b3
lea rcx, str.System
jmp 0x14000e7cf
mov rcx, qword [0x140178378]
test rcx, rcx
je 0x14000e7c8
add rcx, 0x210
jmp 0x14000e7cf
lea rcx, str.Local_System
mov r8, rbx
mov r13, qword [rbp - 0x78]
mov rdx, r13
call fcn.140060db0
nop
jmp 0x14000e809
mov rbx, qword [0x140179248]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
lea rax, [0x14011eaa0]
cmovne rax, rcx
mov rcx, rax
call fcn.1400e81d8
mov qword [0x140179248], rax
mov rcx, rbx
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x58]
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x78]
call fcn.1400e825c
nop
mov rcx, r15
call fcn.1400e825c
nop
mov rcx, r14
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e825c
nop
mov rcx, rdi
call fcn.1400e825c
jmp 0x14000e850
mov r13, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x48]
lea rcx, [rbp - 0x18]
call fcn.140002c80
mov rcx, qword [rbp - 0x20]
call fcn.1400e825c
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp - 0x28]
call fcn.1400e825c
nop
mov rcx, r12
call fcn.1400e825c
nop
mov rcx, rdi
call fcn.1400e825c
nop
mov rcx, r13
call fcn.1400e825c
mov eax, dword [rsp + 0x58]
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1400e17a0
mov rbx, qword [rsp + 0x508]
add rsp, 0x4b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret