Function at 0x1401915d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x340]
sub rsp, 0x440
mov rax, qword [0x140779878]
xor rax, rsp
mov qword [rbp + 0x330], rax
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rcx
xor r14d, r14d
mov esi, r14d
mov dword [rsp + 0x48], r14d
lea rax, [0x140716834]
mov qword [rbp + 0x100], rax
lea rax, [0x140716838]
mov qword [rbp + 0x108], rax
lea rax, str.AFPL
mov qword [rbp + 0x110], rax
lea rax, str.Aladdin
mov qword [rbp + 0x118], rax
lea rax, [rbp + 0x100]
mov qword [rsp + 0x60], rax
lea rdi, [r14 - 1]
lea r12, [0x14070f2d0]
lea r15, vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov rdx, qword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], 9
mov qword [rbp + 0xb8], 0xf
movsd xmm0, qword [str.SOFTWARE_]
movsd qword [rbp + 0xa0], xmm0
movzx eax, byte [0x140716870]
mov byte [rbp + 0xa8], al
mov byte [rbp + 0xa9], 0
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1401916c0
lea rcx, [rbp + 0xa0]
call fcn.140018859
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x98], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x90], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or esi, 4
mov rcx, qword [rbp + 0x90]
mov rdx, qword [rbp + 0x98]
mov rax, rdx
sub rax, rcx
cmp rax, 0xc
jb 0x140191772
lea rax, [rcx + 0xc]
mov qword [rbp + 0x90], rax
lea rbx, [rbp + 0x80]
cmp rdx, 0x10
cmovae rbx, qword [rbp + 0x80]
add rbx, rcx
mov r8d, 0xc
lea rdx, str._Ghostscript
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xc], 0
lea rax, [rbp + 0x80]
jmp 0x140191795
mov qword [rsp + 0x20], 0xc
lea r9, str._Ghostscript
xor r8d, r8d
lea edx, [r8 + 0xc]
lea rcx, [rbp + 0x80]
call fcn.140009589
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r14
mov qword [rbp + 0xd8], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd0], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or esi, 8
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140191815
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140191810
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140191c26
call fcn.14001326e
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x98], 0xf
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x14019186f
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019186a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140191c2d
call fcn.14001326e
lea rbx, [rsp + 0x70]
movdqa xmm0, xmmword [0x140716be0]
mov qword [rsp + 0x58], rbx
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rbp + 0xa0], 0
mov qword [rbp + 0xb8], 0xf
mov qword [rbp + 0xb0], r14
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rdx, qword [rbp + 0xc0]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140191b67
mov r13d, r14d
lea r9d, [rax + 0x10]
lea r8, [rbp + 0x120]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x140191b5c
lea rax, [rbp - 0x60]
mov qword [rbp - 0x80], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], r14
lea rax, [rbp + 0x120]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140191930
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0xe0]
call fcn.14000281a
nop
mov qword [rbp - 0x70], r12
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
or esi, 2
mov dword [rsp + 0x54], esi
mov dword [rsp + 0x48], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx - 0x70], r15
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx - 0x74], edx
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp - 0x60], rax
lea r14, [rbp + 0xe0]
mov r15, qword [rbp + 0xf8]
cmp r15, 0x10
setae r12b
mov rsi, qword [rbp + 0xe0]
cmovae r14, rsi
mov eax, 2
mov rbx, qword [rbp + 0xf0]
cmp rbx, 0x7fffffff
ja 0x140191d13
test rbx, rbx
je 0x140191a43
mov rcx, rbx
cmp rbx, 0x1000
jb 0x140191a04
call fcn.14000e7dc
jmp 0x140191a09
call fcn.140001ec4
mov rdi, rax
mov r8, rbx
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rbx + rdi]
mov qword [rbp + 8], r9
mov r8, rdi
mov rdx, rdi
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov eax, 3
mov rdi, 0xffffffffffffffff
xor r14d, r14d
jmp 0x140191a4a
xor r14d, r14d
mov qword [rbp + 8], r14
mov dword [rbp + 0x10], eax
test r12b, r12b
je 0x140191a83
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140191a7b
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140191c34
mov rcx, rsi
call fcn.14001326e
lea rdx, [rsp + 0x4c]
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
cmp dword [rsp + 0x4c], 7
jl 0x140191ae3
mov dword [rsp + 0x50], 0x200
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r9d, 2
lea r8, str.GS_DLL
lea rdx, [rbp + 0x120]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x140191c3b
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea r15, vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx - 0x70], r15
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx - 0x74], edx
lea rcx, [rbp - 0x60]
call fcn.14001136f
lea rcx, [rbp - 0x58]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
inc r13d
mov r9d, 0x10
lea r8, [rbp + 0x120]
mov edx, r13d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
mov esi, dword [rsp + 0x54]
lea r12, [0x14070f2d0]
je 0x140191906
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rbx, 8
mov qword [rsp + 0x58], rbx
lea rax, [rbp - 0x80]
cmp rbx, rax
jne 0x1401918a0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x140191bbe
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140191bb9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140191d0c
call fcn.14001326e
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x60], rax
lea rcx, [rbp + 0x120]
cmp rax, rcx
jne 0x140191673
xorps xmm0, xmm0
mov rax, qword [rsp + 0x68]
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp + 0x330]
xor rcx, rsp
call fcn.14000baf0
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
mov rbx, qword [rsp + 0x68]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
lea rax, [rbp + 0x130]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140191c60
mov r8, rdi
lea rdx, [rbp + 0x130]
mov rcx, rbx
call fcn.14000281a
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx - 0x70], rax
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx - 0x74], edx
lea rcx, [rbp - 0x60]
call fcn.14001136f
lea rcx, [rbp - 0x58]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x140191d04
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140191cff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140191cff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001326e
mov rax, rbx
jmp 0x140191bf6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_alloc_void_
int3