Function at 0x14003c200
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [0x14037e038]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
cmp rbx, rdi
je 0x14003c267
add rbx, 0xffffffffffffffd0
jmp 0x14003c256
mov rcx, qword [rbx + 0x18]
call fcn.1401a08c8
cmp byte [rbx + 0x17], 0
jns 0x14003c24a
mov rcx, qword [rbx]
call fcn.1401a08c8
lea rax, [rbx - 0x30]
cmp rbx, rdi
mov rbx, rax
je 0x14003c267
test rbx, rbx
je 0x14003c3cb
cmp byte [rbx + 0x2f], 0
jns 0x14003c23c
jmp 0x14003c233
mov qword [rsi + 8], rdi
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x60]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1402fd120]
movaps xmmword [rdi], xmm0
lea r8, str.SYSTEMCurrentControlSetControlSession_Manager
mov rcx, rdi
mov rdx, 0xffffffff80000002
mov r9d, 1
call fcn.1400600c0
mov rdi, qword [rdi]
test rdi, rdi
je 0x14003c3fe
mov dword [rsp + 0x5c], 0
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov edx, 1
mov rcx, rbx
call fcn.140134000
mov dword [rsp + 0x3c], 0xaaaaaaaa
mov rax, qword [rbx]
cmp qword [rbx + 8], rax
je 0x14003c44a
lea r14, [rsp + 0x5c]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x3c]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x14003c3f7
cmp eax, 0xea
jne 0x14003c39c
mov ebx, 0x8000ffff
cmp dword [rsp + 0x3c], 7
jne 0x14003c3aa
mov ecx, dword [rsp + 0x5c]
test cl, 1
jne 0x14003c3aa
mov rax, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov r9, r8
sub r9, rax
mov rdx, rcx
sub rdx, r9
jbe 0x14003c482
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.140134000
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
cmp rcx, rax
je 0x14003c44a
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x3c]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14003c42c
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003c403
mov rax, qword [rsp + 0x48]
mov rdx, rax
sub rdx, rcx
dec rax
cmp rdx, rax
jbe 0x14003c476
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x44
call fcn.1401de150
mov ebx, 0x80070002
jmp 0x14003c3aa
mov ebx, 0x80070002
lea rcx, [rsp + 0x60]
call fcn.140060360
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401a2070
mov eax, ebx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
sub rdx, rcx
je 0x14003c44a
mov r8, rsi
call fcn.1401e0690
mov ebx, eax
jmp 0x14003c3aa
lea rax, str.vector___index_out_of_bounds
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_vector
lea r9, str.__n___size__
mov r8d, 0x601
call fcn.1401de150
mov qword [rsp + 0x48], rcx
call fcn.1401a08c8
jmp 0x14003c403
jb 0x14003c48c
mov rcx, r8
jmp 0x14003c369
add rcx, rax
mov rdx, r8
sub rdx, rcx
dec r8
cmp rdx, r8
ja 0x14003c3cb
mov qword [rsp + 0x48], rcx
jmp 0x14003c369