Function at 0x14002fd20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x1400c9040]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rsi, rcx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
mov qword [rcx + 0x48], rdx
mov qword [rbp + 0x60], 0x11c
mov qword [rbp + 0x68], r13
mov dword [rbp + 0x70], r13d
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x74]
call fcn.14008e560
mov dword [rbp + 0x174], r13d
mov dword [rbp + 0x178], 0x10000
mov r8b, 1
mov edx, 0x80
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8, rax
mov edx, 0x80
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
sete al
mov byte [rsi + 0x5c], al
xor r12b, r12b
mov r15d, r13d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [r13 + 1]
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rdi, [r13 - 1]
test eax, eax
jne 0x14002ffeb
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.CurrentMajorVersionNumber
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002ffdd
cmp dword [rsp + 0x44], 4
jne 0x14002ffdd
mov eax, dword [rsp + 0x48]
mov dword [rsi + 0x50], eax
mov dword [rsp + 0x48], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.CurrentMinorVersionNumber
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002ffdd
cmp dword [rsp + 0x44], 4
jne 0x14002ffdd
mov eax, dword [rsp + 0x40]
mov dword [rsi + 0x54], eax
mov dword [rsp + 0x40], 0xa
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x180]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.CurrentBuildNumber
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14002ffdd
cmp dword [rsp + 0x48], 1
jne 0x14002ffdd
mov eax, dword [rsp + 0x40]
cmp rax, 0xb
jae 0x140030501
mov byte [rbp + rax + 0x180], r12b
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
lea rax, [rbp + 0x180]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14002ff20
lea rdx, [rbp + 0x180]
lea rcx, [rbp - 0x48]
call fcn.140001730
nop
lea rdx, [rsp + 0x44]
lea rcx, [rbp - 0x48]
call fcn.1400476c0
movzx r14d, al
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x14002ff88
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ff83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400304f5
call fcn.1400551e8
test r14b, r14b
je 0x14002ffdd
mov eax, dword [rsp + 0x44]
mov dword [rsi + 0x58], eax
mov dword [rsp + 0x48], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, [0x14009ec68]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002ffdd
cmp dword [rsp + 0x44], 4
jne 0x14002ffdd
mov r15d, dword [rsp + 0x40]
mov r12b, 1
test rbx, rbx
je 0x14002ffeb
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
lea rdx, str.kernel32.dll
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x140030001
mov r8, rdi
lea rcx, [rbp - 0x48]
call fcn.14002f200
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.14004a3d0
nop
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140047850
movzx ebx, al
lea rcx, [rbp + 0x18]
call fcn.14002e8c0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x140030080
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003007b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400304fb
call fcn.1400551e8
test bl, bl
je 0x1400304bf
mov edx, dword [rsp + 0x7c]
lea rcx, [rbp - 0x48]
call fcn.14002fa70
nop
mov eax, dword [rbp - 0x80]
and eax, 0x40004
xorps xmm0, xmm0
mov qword [rbp - 0x50], 0xf
mov ebx, 8
movups xmmword [rbp - 0x68], xmm0
mov dword [rsp + 0x40], ebx
cmp eax, 0x40004
jne 0x1400300e3
mov qword [rbp - 0x58], 0xa
movsd xmm0, qword [str.Windows_NT]
movsd qword [rbp - 0x68], xmm0
movzx eax, word [0x14009eb50]
mov word [rbp - 0x60], ax
mov byte [rbp - 0x5e], 0
jmp 0x14003010e
mov qword [rbp - 0x58], 7
mov rax, qword [str.Unknown]
mov dword [rbp - 0x68], eax
movzx eax, word [0x14009eb5c]
mov word [rbp - 0x64], ax
movzx eax, byte [0x14009eb5e]
mov byte [rbp - 0x62], al
mov byte [rbp - 0x61], 0
test r12b, r12b
jne 0x140030135
mov ecx, dword [rsp + 0x68]
mov eax, ecx
shr eax, 0x10
mov dword [rsi + 0x50], eax
movzx eax, cx
mov dword [rsi + 0x54], eax
mov ecx, dword [rsp + 0x6c]
mov eax, ecx
shr eax, 0x10
mov dword [rsi + 0x58], eax
movzx r15d, cx
mov r8d, r15d
lea rdx, [0x14009ec70]
lea rcx, [rbp + 0x18]
call fcn.14004c920
lea rdi, [rsi + 0x28]
mov rdx, rax
mov rcx, rdi
call fcn.140020bf0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x140030192
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003018d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140030507
call fcn.1400551e8
mov r8, qword [rbp - 0x38]
test r8, r8
jne 0x1400301a7
lea rdx, [0x1400968bd]
jmp 0x1400302b8
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], 2
mov qword [rbp + 0x50], 0xf
mov eax, 0x2820
mov word [rbp + 0x38], ax
mov byte [rbp + 0x3a], 0
mov dword [rsp + 0x40], 9
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova rdx, qword [rbp - 0x48]
lea rcx, [rbp + 0x38]
call fcn.140007ce0
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x40], 0x1b
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140030254
lea rax, [rcx + 1]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x28]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x28]
mov word [rax + rcx], 0x29
lea rax, [rbp - 0x28]
jmp 0x140030274
mov qword [rsp + 0x20], 1
lea r9, [0x140097d10]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x28]
call fcn.140002890
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov ebx, 0x3f
mov dword [rsp + 0x40], ebx
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova rdx, qword [rbp - 8]
cmp qword [rdi + 0x18], 0xf
jbe 0x1400302c2
mov rdi, qword [rdi]
mov eax, dword [rsi + 0x58]
mov ecx, dword [rsi + 0x54]
lea r8, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova r8, qword [rbp - 0x68]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsi + 0x50]
lea rdx, str._s__u._u._u._s_s
lea rcx, [rbp + 0x18]
call fcn.14004c920
lea rcx, [rsi + 8]
mov rdx, rax
call fcn.140020bf0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x140030343
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003033e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003050d
call fcn.1400551e8
movdqa xmm0, xmmword [0x140097e20]
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x18], 0
test bl, 4
je 0x1400303a8
and ebx, 0xfffffffb
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x140030397
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030392
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140030513
call fcn.1400551e8
movdqa xmm0, xmmword [0x140097e20]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], 0
test bl, 2
je 0x1400303fc
and ebx, 0xfffffffd
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400303eb
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400303e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140030519
call fcn.1400551e8
movdqa xmm0, xmmword [0x140097e20]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
test bl, 1
je 0x14003043d
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x14003043d
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030437
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003051f
call fcn.1400551e8
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140030478
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030473
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140030525
call fcn.1400551e8
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x1400304bf
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400304ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400304ef
call fcn.1400551e8
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140055420
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14005bf54
nop
call fcn.14005bf54
nop
call fcn.14005bf54
nop
call fcn.14005557c
nop
call fcn.14005bf54
nop
call fcn.14005bf54
nop
call fcn.14005bf54
nop
call fcn.14005bf54
nop
call fcn.14005bf54
nop
call fcn.14005bf54
int3