Function at 0x1401146b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x1405f98c0]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x80], rdx
mov r15, rcx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x98], rdx
xor esi, esi
mov edi, esi
mov dword [rsp + 0x44], esi
mov rax, rcx
cmp qword [rcx + 0x18], 7
jbe 0x140114709
mov rax, qword [rcx]
mov qword [rcx + 0x10], rsi
mov word [rax], si
mov dword [rdx], esi
xor r14b, r14b
mov byte [rsp + 0x40], r14b
mov qword [rsp + 0x70], 0xffffffff80000003
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.140107890
nop
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov qword [rsp + 0x90], r12
mov r13d, 0xffffffff
mov qword [rsp + 0x88], rbx
cmp rbx, r12
je 0x140114c01
cmp qword [rbx + 0x10], 0xa
jbe 0x140114834
xorps xmm0, xmm0
movups xmmword [rsp + 0xc8], xmm0
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe0], rsi
mov r8d, 7
lea rdx, str.Classes
lea rcx, [rsp + 0xc8]
call fcn.1400c71d0
nop
or edi, 1
mov dword [rsp + 0x44], edi
mov rax, qword [rbx + 0x10]
mov rdx, qword [rsp + 0xd8]
cmp rax, rdx
jb 0x140114827
mov r8, rax
sub r8, rdx
cmp rax, r8
jb 0x140114cd4
lea rcx, [rsp + 0xc8]
mov r10, qword [rsp + 0xe0]
cmp r10, 7
cmova rcx, qword [rsp + 0xc8]
mov r9, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1401147ee
mov r9, qword [rbx]
test rdx, rdx
je 0x140114814
lea rax, [r8 + r8]
sub rax, rcx
add r9, rax
nop dword [rax]
movzx eax, word [r9 + rcx]
cmp ax, word [rcx]
jne 0x14011481c
add rcx, 2
sub rdx, 1
jne 0x140114800
mov ecx, esi
test ecx, ecx
jne 0x14011482f
jmp 0x14011483c
mov ecx, 1
cmovb ecx, r13d
jmp 0x140114816
mov r10, qword [rsp + 0xe0]
xor r14b, r14b
jmp 0x14011483f
mov r10, qword [rsp + 0xe0]
mov r14b, 1
test dil, 1
je 0x14011488c
and edi, 0xfffffffe
mov dword [rsp + 0x44], edi
cmp r10, 7
jbe 0x14011488c
lea rdx, [r10*2 + 2]
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140114887
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140114cda
call fcn.1403e3650
test r14b, r14b
jne 0x140114bf2
mov byte [rsp + 0x40], 1
mov rcx, qword [rbx + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 0x23
jb 0x140114ce0
mov r9, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1401148c2
mov r9, qword [rbx]
mov qword [rsp + 0x30], 0x23
lea rax, str.SOFTWAREValveSteamActiveProcess
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x108]
call fcn.1400d6400
or edi, 2
mov dword [rsp + 0x44], edi
lea r8, [rsp + 0x108]
mov rdx, 0xffffffff80000003
lea rcx, [rsp + 0x68]
call fcn.1401075c0
nop
mov rdx, qword [rsp + 0x120]
cmp rdx, 7
jbe 0x140114952
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011494d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140114ce6
call fcn.1403e3650
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x120], 7
mov word [rsp + 0x108], si
xorps xmm0, xmm0
movups xmmword [rsp + 0xe8], xmm0
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0x100], rsi
mov r8d, 3
lea rdx, [0x140571bd8]
lea rcx, [rsp + 0xe8]
call fcn.1400c71d0
nop
mov dword [rsp + 0x4c], esi
mov dword [rsp + 0x48], 4
lea r8, [rsp + 0xe8]
cmp qword [rsp + 0x100], 7
cmova r8, qword [rsp + 0xe8]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor edx, edx
lea r9d, [rdx + 0x10]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140114cec
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x80]
mov dword [rcx], eax
mov rdx, qword [rsp + 0x100]
cmp rdx, 7
jbe 0x140114a52
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140114a4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140114d18
call fcn.1403e3650
cmp r15, rbx
je 0x140114a71
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x140114a65
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, r15
call fcn.140102060
nop
mov rcx, qword [rsp + 0x68]
mov edi, 0x80000000
test rcx, rcx
je 0x140114ab0
lea rax, [rcx + rdi]
cmp rax, 5
jbe 0x140114aab
cmp rcx, 0xffffffff80000007
je 0x140114aab
cmp rcx, 0xffffffff80000060
je 0x140114aab
cmp rcx, 0xffffffff80000050
je 0x140114aab
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rsi
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x140114b73
mov r14, qword [rsp + 0x58]
cmp rbx, r14
je 0x140114b2c
nop dword [rax + rax]
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x140114b0f
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140114b0a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140114d1e
mov rcx, r8
call fcn.1403e3650
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
add rbx, 0x20
cmp rbx, r14
jne 0x140114ad0
mov rbx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x60]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x140114b5d
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140114d1e
mov rcx, rbx
call fcn.1403e3650
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140114ba8
lea rax, [rcx + rdi]
cmp rax, 5
jbe 0x140114ba8
cmp rcx, 0xffffffff80000007
je 0x140114ba8
cmp rcx, 0xffffffff80000060
je 0x140114ba8
cmp rcx, 0xffffffff80000050
je 0x140114ba8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140114ca7
movzx r14d, byte [rsp + 0x40]
add rbx, 0x20
jmp 0x14011474b
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x140114c65
mov rdi, qword [rsp + 0x58]
cmp rbx, rdi
je 0x140114c26
mov rcx, rbx
call fcn.1400c63d0
add rbx, 0x20
cmp rbx, rdi
jne 0x140114c15
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x140114c5c
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140114d24
mov rcx, rbx
call fcn.1403e3650
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140114c9f
mov eax, 0x80000000
add rax, rcx
cmp rax, 5
jbe 0x140114c9f
cmp rcx, 0xffffffff80000007
je 0x140114c9f
cmp rcx, 0xffffffff80000060
je 0x140114c9f
cmp rcx, 0xffffffff80000050
je 0x140114c9f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
movzx eax, r14b
jmp 0x140114ca7
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.1403e3630
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1400d10f0
nop
call fcn.1403fd768
nop
call fcn.1400c4f10
nop
call fcn.1403fd768
nop
mov r8d, eax
lea rdx, str.Cannot_get_DWORD_value:_RegGetValue_failed.
lea rcx, [rsp + 0xa8]
call fcn.1400d5280
lea rdx, [0x1405e62d8]
lea rcx, [rsp + 0xa8]
call fcn.1403e644c
nop
call fcn.1403fd768
nop
call fcn.1403fd768
int3
call fcn.1403fd768
int3