Function at 0x1400c8614
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r15
sub rsp, 0x380
mov rax, qword [0x140162100]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov r13, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov dword [rsp + 0x34], edi
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14016a240], eax
jle 0x1400c869e
lea rcx, [0x14016a240]
call fcn.1400f7c54
or rsi, 0xffffffffffffffff
cmp dword [0x14016a240], esi
jne 0x1400c86a2
lea rcx, [0x140129b74]
call fcn.1400f7f30
lea rcx, [0x14016a240]
call fcn.1400f7be8
jmp 0x1400c86a2
or rsi, 0xffffffffffffffff
xorps xmm0, xmm0
cmp qword [0x140166688], rdi
je 0x1400c86e6
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], rdi
mov qword [r13 + 0x18], rdi
lea rdx, [0x140166678]
cmp qword [0x140166690], 0xf
cmova rdx, qword [0x140166678]
mov r8, qword [0x140166688]
mov rcx, r13
call fcn.140007c64
jmp 0x1400c9005
movups xmmword [rsp + 0x128], xmm0
mov qword [rsp + 0x138], rdi
mov qword [rsp + 0x140], 0xf
mov byte [rsp + 0x128], dil
lea rcx, [rsp + 0x80]
call fcn.1400c8088
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.140005620
mov rdx, qword [rsp + 0x98]
mov r12d, 0x1000
cmp rdx, 0xf
jbe 0x1400c876d
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, r12
jb 0x1400c8767
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c9036
call fcn.1400f7be0
nop
jmp 0x1400c8780
mov dword [rsp + 0x168], 0x200
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
mov qword [rsp + 0x158], rdi
mov qword [rsp + 0x160], rdi
mov r8d, 0x59
lea rdx, str.NEpGZeGNqEWkJTWc29zicGduGcQR5qdkhTRWGpysfkNbkQ0BKaXkQEsemtIwU1psEb2NDqX0RAAV15J8BHp2YQQ
lea rcx, [rsp + 0x148]
call fcn.140007ba4
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x60]
call fcn.1400cb254
nop
mov ebx, 2
mov dword [rsp + 0x34], ebx
cmp qword [rax + 0x18], 0xf
jbe 0x1400c87e6
mov rax, qword [rax]
mov rdx, rsi
inc rdx
cmp byte [rax + rdx], dil
jne 0x1400c87e9
lea rcx, [rsp + 0x128]
cmp qword [rsp + 0x140], 0xf
cmova rcx, qword [rsp + 0x128]
mov r15, qword [rsp + 0x138]
cmp r15, rdx
jne 0x1400c882c
mov r8, r15
mov rdx, rax
call fcn.140122910
test eax, eax
je 0x1400c8a0f
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xb8], rdi
mov r8d, 0x59
lea rdx, str.enpDmM2FVMd0RXMVkJzoSUtZnT0tI5cAdUeY0B8hemdwkQH1mCbHlNKQm4K8URQ1ZaRQSwBjYMeDRgOTODgAncA
lea rcx, [rsp + 0xa0]
call fcn.140007ba4
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x80]
call fcn.1400cb254
nop
mov ebx, 6
mov dword [rsp + 0x34], ebx
cmp qword [rax + 0x18], 0xf
jbe 0x1400c888a
mov rax, qword [rax]
mov rdx, rsi
inc rdx
cmp byte [rax + rdx], dil
jne 0x1400c888d
lea rcx, [rsp + 0x128]
cmp qword [rsp + 0x140], 0xf
cmova rcx, qword [rsp + 0x128]
mov r15, qword [rsp + 0x138]
cmp r15, rdx
jne 0x1400c88d0
mov r8, r15
mov rdx, rax
call fcn.140122910
test eax, eax
je 0x1400c8a0f
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xd8], rdi
mov r8d, 0x59
lea rdx, str.U1RifZ3BpQS0hHld1Zl8cUQ2ZZ2NkCUldADWXt4Eakdm9VUFpRBldjsZE9X1QFl7mZXdHhZlVB0dAZXLY2RSrVw
lea rcx, [rsp + 0xc0]
call fcn.140007ba4
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x100]
call fcn.1400cb254
nop
mov ebx, 0xe
mov dword [rsp + 0x34], ebx
cmp qword [rax + 0x18], 0xf
jbe 0x1400c892e
mov rax, qword [rax]
mov rdx, rsi
inc rdx
cmp byte [rax + rdx], dil
jne 0x1400c8931
lea rcx, [rsp + 0x128]
cmp qword [rsp + 0x140], 0xf
cmova rcx, qword [rsp + 0x128]
mov r15, qword [rsp + 0x138]
cmp r15, rdx
jne 0x1400c8974
mov r8, r15
mov rdx, rax
call fcn.140122910
test eax, eax
je 0x1400c8a0f
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, 0x59
lea rdx, str.WVRmmOXNJPTzBQBd0xGYT2w1sZx8SYIH81CDwl2dfTEKtAAlBYcyEfvEkt_NNQ8JLHRYxACgAJ7KnMhiHxIgNfw
lea rcx, [rsp + 0x40]
call fcn.140007ba4
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.1400cb254
mov ebx, 0x1e
mov dword [rsp + 0x34], ebx
cmp qword [rax + 0x18], 0xf
jbe 0x1400c89c2
mov rax, qword [rax]
mov rdx, rsi
inc rdx
cmp byte [rax + rdx], dil
jne 0x1400c89c5
lea rcx, [rsp + 0x128]
cmp qword [rsp + 0x140], 0xf
cmova rcx, qword [rsp + 0x128]
mov r15, qword [rsp + 0x138]
cmp r15, rdx
jne 0x1400c8a04
mov r8, r15
mov rdx, rax
call fcn.140122910
test eax, eax
je 0x1400c8a0f
cmp r15, 0x24
mov byte [rsp + 0x30], dil
je 0x1400c8a14
mov byte [rsp + 0x30], 1
test bl, 0x10
je 0x1400c8a82
and ebx, 0xffffffef
mov dword [rsp + 0x34], ebx
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0xf
jbe 0x1400c8a67
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, r12
jb 0x1400c8a5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c903c
call fcn.1400f7be0
mov r15, qword [rsp + 0x138]
movdqa xmm0, xmmword [0x14014e390]
movdqu xmmword [rsp + 0xf0], xmm0
mov byte [rsp + 0xe0], dil
jmp 0x1400c8a8a
movdqa xmm0, xmmword [0x14014e390]
test bl, 8
je 0x1400c8af6
and ebx, 0xfffffff7
mov dword [rsp + 0x34], ebx
mov rdx, qword [rsp + 0x118]
cmp rdx, 0xf
jbe 0x1400c8ae5
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, r12
jb 0x1400c8ad0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c9042
call fcn.1400f7be0
mov r15, qword [rsp + 0x138]
movdqa xmm0, xmmword [0x14014e390]
movdqu xmmword [rsp + 0x110], xmm0
mov byte [rsp + 0x100], dil
test bl, 4
je 0x1400c8b62
and ebx, 0xfffffffb
mov dword [rsp + 0x34], ebx
mov rdx, qword [rsp + 0x98]
cmp rdx, 0xf
jbe 0x1400c8b51
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, r12
jb 0x1400c8b3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c9048
call fcn.1400f7be0
mov r15, qword [rsp + 0x138]
movdqa xmm0, xmmword [0x14014e390]
movdqu xmmword [rsp + 0x90], xmm0
mov byte [rsp + 0x80], dil
test bl, 2
je 0x1400c8ba8
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1400c8ba8
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r12
jb 0x1400c8b9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c904e
call fcn.1400f7be0
mov r15, qword [rsp + 0x138]
cmp byte [rsp + 0x30], dil
je 0x1400c8f04
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, 0x4f
lea rdx, str.UWlqSRzk5eb0FsqTWNaKM2t0SWAImXLBNuIeD0E2MAAKTOUEESBzc31HTYEhS0AfqNQMqwETtDFAw0
lea rcx, [rsp + 0x40]
call fcn.1400078a0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.1400cb590
nop
mov rdx, qword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x158], xmm1
mov r8, rsi
inc r8
cmp word [rdx + r8*2], di
jne 0x1400c8c09
lea rcx, [rsp + 0x148]
call fcn.1400078a0
lea rdx, [rsp + 0x148]
cmp qword [rsp + 0x160], 7
cmova rdx, qword [rsp + 0x148]
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rcx, [rsp + 0x148]
call fcn.140006794
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400c8c8a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, 0x2c
lea rdx, str.THk1IdGpiTUkNhrSmc3FU21k8ZgEYyVhwDIDDcEKFCMD
lea rcx, [rsp + 0x40]
call fcn.1400078a0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.1400cb590
nop
mov rdx, qword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x158], xmm1
mov r8, rsi
inc r8
cmp word [rdx + r8*2], di
jne 0x1400c8ce0
lea rcx, [rsp + 0x148]
call fcn.1400078a0
lea rdx, [rsp + 0x148]
cmp qword [rsp + 0x160], 7
cmova rdx, qword [rsp + 0x148]
lea rax, [rsp + 0x168]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x16c]
xor r8d, r8d
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
lea rcx, [rsp + 0x148]
call fcn.140006794
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x1400c8d74
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
xorps xmm0, xmm0
test ebx, ebx
je 0x1400c8e5e
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, 0x59
lea rdx, str.VmhiSOHp0pVDNheTmhJ5THpPfQmZYuUghKiRGQD7TH5YDeXxX7f3JmEWE8IYSkRkoHlFkWHl89Sn9y4ZlhSSCCI
lea rcx, [rsp + 0x40]
call fcn.140007ba4
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1400cb254
nop
cmp qword [rax + 0x18], 0xf
jbe 0x1400c8dbf
mov rax, qword [rax]
inc rsi
cmp byte [rax + rsi], dil
jne 0x1400c8dbf
cmp rsi, qword [rsp + 0x140]
ja 0x1400c8e08
lea rbx, [rsp + 0x128]
cmp qword [rsp + 0x140], 0xf
cmova rbx, qword [rsp + 0x128]
mov qword [rsp + 0x138], rsi
mov r8, rsi
mov rdx, rax
mov rcx, rbx
call fcn.140121e30
mov byte [rbx + rsi], dil
jmp 0x1400c8e1c
mov r9, rax
mov rdx, rsi
lea rcx, [rsp + 0x128]
call fcn.140008380
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1400c8eee
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r12
jb 0x1400c8e54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c9054
call fcn.1400f7be0
jmp 0x1400c8eee
movups xmmword [rsp + 0x148], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x158], xmm1
lea rax, [rsp + 0x170]
inc rsi
cmp word [rax + rsi*2], di
jne 0x1400c8e7a
mov r8, rsi
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x148]
call fcn.1400078a0
nop
lea rcx, [rsp + 0x148]
cmp qword [rsp + 0x160], 7
cmova rcx, qword [rsp + 0x148]
mov rax, qword [rsp + 0x158]
lea r8, [rcx + rax*2]
lea rdx, [rsp + 0x148]
cmova rdx, qword [rsp + 0x148]
lea rcx, [rsp + 0x128]
call fcn.1400cf2f8
nop
lea rcx, [rsp + 0x148]
call fcn.140006794
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15, qword [rsp + 0x138]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
lea rdx, [rsp + 0x128]
cmp qword [rsp + 0x140], 0xf
cmova rdx, qword [rsp + 0x128]
mov r8, r15
lea rcx, [rsp + 0x40]
call fcn.140007c64
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1400c84f8
mov rdx, rax
lea rbx, [0x140166678]
mov rcx, rbx
call fcn.140005620
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1400c8f97
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r12
jb 0x1400c8f92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c905a
call fcn.1400f7be0
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], rdi
mov qword [r13 + 0x18], rdi
cmp qword [0x140166690], 0xf
cmova rbx, qword [0x140166678]
mov r8, qword [0x140166688]
mov rdx, rbx
mov rcx, r13
call fcn.140007c64
nop
mov rdx, qword [rsp + 0x140]
cmp rdx, 0xf
jbe 0x1400c9005
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, r12
jb 0x1400c9000
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c9060
call fcn.1400f7be0
mov rax, r13
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.1400f7bc0
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop r12
ret
call fcn.140100bd8
nop
call fcn.140100bd8
nop
call fcn.140100bd8
nop
call fcn.140100bd8
nop
call fcn.140100bd8
int3
call fcn.140100bd8
int3
call fcn.140100bd8
nop
call fcn.140100bd8
int3