Function at 0x1400049b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rbp + 0x30], rax
xor esi, esi
mov qword [rsp + 0x68], rcx
and qword [rsp + 0x50], rsi
xor r14d, r14d
and qword [rsp + 0x38], rsi
mov rdi, rdx
mov qword [rsp + 0x48], r14
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
xor edx, edx
mov r8d, 0x90
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140004a8a
xorps xmm0, xmm0
mov byte [rax + 0x82], 0x41
lea rcx, [rbp - 0x70]
movups xmmword [rbp - 0x70], xmm0
call qword [sym.imp.RPCRT4.dll_UuidCreate]
nop dword [rax + rax]
movaps xmm0, xmmword [rbp - 0x70]
movabs rax, 0x1300000000
movdqa xmmword [rbp - 0x80], xmm0
xor edx, edx
mov byte [rbx + 0x81], FDICopy
mov r8d, 0x81
mov rcx, rbx
mov qword [rbx + 0x88], rax
call sub.msvcrt.dll_memset
mov r8, rbx
lea edx, [rsi + 0xc]
lea rcx, [rbp - 0x80]
call fcn.14002a44c
mov word [rbx + 0x10], 0x2e
jmp 0x140004a8c
xor ebx, ebx
xor eax, eax
test rbx, rbx
cmovne rax, rbx
test rax, rax
jne 0x140004aac
mov ecx, 0x8007000e
mov r12d, ecx
call fcn.140025d30
jmp 0x140004e6a
and dword [rsp + 0x58], esi
and dword [rsp + 0x44], esi
test rdi, rdi
je 0x140004b09
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140029fcc
mov r12d, eax
test eax, eax
js 0x140004ae5
mov edx, dword [rsp + 0x40]
lea r8, [rsp + 0x38]
mov rcx, rdi
call fcn.140028308
mov r12d, eax
test eax, eax
jns 0x140004aec
mov ecx, eax
call fcn.140025d30
mov ecx, r12d
call fcn.140025d50
test r12d, r12d
jns 0x140004afe
mov ecx, r12d
jmp 0x140004aa2
mov r13d, 1
jmp 0x140004c18
call fcn.140023b74
mov r12d, eax
test eax, eax
jns 0x140004b19
mov ecx, eax
jmp 0x140004aa2
and qword [rsp + 0x70], rsi
lea r9, [rsp + 0x70]
mov r13d, 1
lea rdx, str.SYSTEMSetupMoSetup
mov r8d, r13d
mov rcx, 0xffffffff80000002
call fcn.14002a384
mov rdi, qword [rsp + 0x70]
mov r12d, eax
test eax, eax
jns 0x140004b5c
mov ecx, eax
call fcn.140025d30
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x30], eax
jmp 0x140004bbc
lea rax, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x7c]
and qword [rsp + 0x20], rsi
lea rdx, str.CorrelationVector
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
and dword [rsp + 0x30], esi
test eax, eax
je 0x140004bb7
cmp eax, 2
je 0x140004bb1
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
test r12d, r12d
je 0x140004bbc
mov ecx, r12d
jmp 0x140004b4d
and dword [rsp + 0x30], esi
jmp 0x140004bbc
mov dword [rsp + 0x30], r13d
mov ecx, r12d
call fcn.140025d50
test rdi, rdi
je 0x140004bd8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test r12d, r12d
js 0x140004af9
cmp dword [rsp + 0x30], esi
je 0x140004c92
lea r9, [rsp + 0x38]
lea r8, str.CorrelationVector
lea rdx, str.SYSTEMSetupMoSetup
call fcn.140023a00
mov r12d, eax
test eax, eax
js 0x140004b15
mov dword [rsp + 0x44], r13d
mov r13d, dword [rsp + 0x58]
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x140004c92
mov r12d, dword [rdi - 4]
xor ecx, ecx
call fcn.140025d50
lea r8, [rsp + 0x50]
mov edx, r12d
mov rcx, rdi
call fcn.1400257f4
mov r12d, eax
test eax, eax
js 0x140004b15
mov rcx, qword [rsp + 0x50]
test r13d, r13d
je 0x140004c59
call fcn.140003390
jmp 0x140004c5e
call fcn.14000356c
mov rsi, rax
test rax, rax
je 0x140004a9a
test rbx, rbx
je 0x140004c8f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rbx, rsi
cmp dword [rsp + 0x44], r14d
je 0x140004cb6
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x81
call sub.msvcrt.dll_memset
lea rdx, [rbp - 0x60]
mov rcx, rbx
call fcn.1400037d8
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x81
call sub.msvcrt.dll_memset
xor edx, edx
lock xadd qword [rbx + 0x88], rdx
lea r8, [rbp - 0x60]
mov rcx, rbx
call fcn.1400038e8
test al, al
jne 0x140004cfb
mov ecx, 0x8000ffff
mov r12d, ecx
call fcn.140025d30
xor esi, esi
mov r14, qword [rsp + 0x48]
jmp 0x140004e6a
lea rcx, [rbp - 0x60]
call fcn.14000356c
mov rsi, rax
mov r13, rax
test rax, rax
jne 0x140004d1e
mov ecx, 0x8000ffff
mov r12d, ecx
call fcn.140025d30
jmp 0x140004cf1
lea r8, [rsp + 0x48]
xor esi, esi
lea rcx, [rbp - 0x60]
call fcn.1400255d0
mov r12d, eax
test eax, eax
jns 0x140004d41
mov ecx, eax
call fcn.140025d30
mov r15, r13
jmp 0x140004cf1
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x140004d78
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
and qword [rsp + 0x38], rsi
mov r14, qword [rsp + 0x48]
test r14, r14
jne 0x140004d88
xor edi, edi
xor edx, edx
jmp 0x140004da3
lea rdx, [rsp + 0x60]
mov rcx, r14
mov rdi, r14
call fcn.140029fcc
mov r12d, eax
test eax, eax
js 0x140004db7
mov edx, dword [rsp + 0x60]
lea r8, [rsp + 0x38]
mov rcx, rdi
call fcn.140028308
mov r12d, eax
test eax, eax
jns 0x140004dbe
mov ecx, eax
call fcn.140025d30
mov ecx, r12d
call fcn.140025d50
test r12d, r12d
jns 0x140004ddb
mov ecx, r12d
call fcn.140025d30
mov r15, r13
jmp 0x140004e6a
mov r9, qword [rsp + 0x38]
call fcn.140023830
mov r12d, eax
test eax, eax
jns 0x140004df0
mov ecx, eax
jmp 0x140004dce
mov rcx, qword [rsp + 0x68]
mov r15, rbx
xor ebx, ebx
mov rdi, qword [rcx + 0x20]
test rdi, rdi
je 0x140004e28
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
xor eax, eax
test r15, r15
cmovne rax, r15
xor r15d, r15d
mov qword [rcx + 0x20], rax
mov rdi, qword [rcx + 0x28]
test rdi, rdi
je 0x140004e66
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
mov qword [rcx + 0x28], r13
mov ecx, r12d
call fcn.140025d50
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x140004ea4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
test r14, r14
je 0x140004ec9
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x140004ef3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test rsi, rsi
je 0x140004f18
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test r15, r15
je 0x140004f3d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test rbx, rbx
je 0x140004f62
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov eax, r12d
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140094220
mov rbx, qword [rsp + 0x190]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret