Function at 0x140046d60
Capabilities:
Get thread local storage value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x400
mov rax, qword [0x1400a3758]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov r12, rdx
mov qword [rbp + 0x40], rdx
mov r13, rcx
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0xb0], rdx
xor ebx, ebx
mov r15d, ebx
mov dword [rbp - 0x14], ebx
lea ecx, [rbx + 2]
call fcn.140059d40
mov qword [rbp - 0x58], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.140059d40
mov rdi, rax
mov qword [rbp + 0x80], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.140059d40
mov rsi, rax
mov qword [rbp + 0x88], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.140059d40
mov qword [rbp], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.140059d40
mov qword [rbp + 0x20], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.140059d40
mov qword [rbp + 0x18], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.140059d40
mov r14, rax
mov qword [rbp + 0xb8], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.140059d40
mov qword [rbp - 8], rax
mov word [rax], bx
mov qword [rbp - 0x20], rbx
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x20], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x28], rbx
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x28], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x30], rbx
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x30], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x38], rbx
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x38], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x40], rbx
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x48], rbx
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x48], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x50], rbx
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x50], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, [rbp - 0x50]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x78]
call fcn.14001f610
mov rbx, rax
xor ecx, ecx
mov qword [rbp - 0x80], rcx
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x80], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, [rbp - 0x80]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 8]
call fcn.14001f610
nop
mov dword [rsp + 0x80], 0xffffffff
xor edx, edx
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x70], rdx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x58], rdx
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rdx - 1]
mov rcx, r13
call fcn.140014980
mov dword [rbp - 0x60], eax
mov rcx, qword [rbp + 8]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x80]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x78]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x50]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x48]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x40]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x38]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x30]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x28]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x20]
call fcn.140059d2c
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, qword [0x1400a36f8]
call fcn.14001d250
test eax, eax
jne 0x14004772a
lea ecx, [rax + 2]
call fcn.140059d40
mov qword [rbp - 0x68], rax
xor ecx, ecx
mov word [rax], cx
lea r8, [rbp - 0x68]
xor edx, edx
mov rcx, qword [rbp + 0x10]
call fcn.14002d2c0
test eax, eax
jne 0x140047715
mov edi, dword [rbp - 0x60]
xor esi, esi
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rcx
mov r9d, eax
xor r8d, r8d
mov rdx, qword [rbp - 0x68]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400476e8
mov dword [rbp - 0x70], esi
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.LibraryPath
mov rcx, qword [rbp - 0x10]
call fcn.14002d4d0
test eax, eax
jne 0x1400476de
mov qword [rbp + 8], rsi
mov rax, qword [rbp - 8]
lea rcx, [0x14007a7c4]
test rax, rax
cmovne rcx, rax
call fcn.140059d48
mov qword [rbp + 8], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov ecx, 2
call fcn.140059d40
mov qword [rbp + 0x90], rax
mov word [rax], si
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], rsi
lea rdx, [rbp + 0x90]
mov rcx, qword [rbp - 8]
call fcn.14001e420
xor r9d, r9d
lea r8, [rbp + 0x90]
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.140018960
mov rdx, qword [rax]
mov rbx, qword [rbp - 0x58]
lea rcx, [0x14007a7c4]
test rdx, rdx
cmovne rcx, rdx
call fcn.140059d48
mov qword [rbp - 0x58], rax
mov rcx, rbx
call fcn.140059d2c
mov rcx, qword [rbp + 0x30]
call fcn.140059d2c
lea r9, [rbp + 0x20]
lea r8, [rbp]
mov rdx, qword [rbp - 0x58]
mov rcx, r13
call fcn.1400185f0
mov dword [rbp - 0x60], eax
mov qword [rbp - 0x80], rsi
mov rdx, qword [rbp - 0x68]
lea rcx, [0x14007a7c4]
test rdx, rdx
cmovne rcx, rdx
call fcn.140059d48
mov qword [rbp - 0x80], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DisplayString
mov rcx, qword [rbp - 0x10]
call fcn.14002d4d0
test eax, eax
jne 0x1400472e2
mov rcx, qword [rbp - 0x80]
cmp word [rcx], 0x40
jne 0x1400472e2
call fcn.140059d48
mov r13, rax
mov qword [rbp - 0x78], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r15d, esi
mov edx, 0x2c
mov rcx, r13
call fcn.14004eb30
test rax, rax
je 0x140047241
mov edx, 0x2c
mov rcx, r13
call fcn.14004eb30
mov word [rax], si
lea rcx, [rax + 2]
call fcn.140063f38
cdq
mov r15d, eax
xor r15d, edx
sub r15d, edx
lea rdx, [r13 + 2]
lea rcx, [rbp + 0x38]
call fcn.14002cd00
mov rdx, qword [rax]
lea rcx, [0x14007a7c4]
test rdx, rdx
cmovne rcx, rdx
call fcn.140059d48
mov rbx, rax
mov rcx, r13
call fcn.140059d2c
mov rcx, qword [rbp + 0x38]
call fcn.140059d2c
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r12, rax
test rax, rax
je 0x1400472d2
mov r9d, 0x104
lea r8, [rbp + 0xd0]
mov edx, r15d
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1400472c8
mov r15, qword [rbp - 0x80]
lea rcx, [rbp + 0xd0]
call fcn.140059d48
mov qword [rbp - 0x80], rax
mov rcx, r15
call fcn.140059d2c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rcx, rbx
call fcn.140059d2c
mov r12, qword [rbp + 0x40]
mov r13, qword [rbp + 0x48]
mov dword [rbp - 0x70], 4
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Enabled
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp - 0x70], 0x10
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProviderId
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400476ae
lea r9, [rbp - 0x68]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x58]
call fcn.14001f610
mov rbx, rax
mov qword [rbp - 0x20], rsi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x20], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, [rbp - 0x20]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x50]
call fcn.14001f610
nop
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x20], rcx
mov r9, rbx
mov r8, rax
lea rdx, [rbp - 0x68]
mov rcx, r13
call fcn.140014330
movzx ebx, al
mov rcx, qword [rbp + 0x50]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x20]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x58]
call fcn.140059d2c
test bl, bl
je 0x1400476ae
cmp edi, 0xffffffff
jne 0x1400475e8
mov qword [rbp - 0x78], rsi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x78], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r15d, dword [rbp - 0x18]
mov qword [rbp + 0x28], rsi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp + 0x28], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x50], rsi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x50], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x48], rsi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x48], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x40], rsi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x38], rsi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x38], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x30], rsi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x30], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, [rbp - 0x30]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x68]
call fcn.14001f610
mov rbx, rax
mov qword [rbp - 0x28], rsi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x28], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, [rbp - 0x28]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x60]
call fcn.14001f610
nop
mov dword [rsp + 0x80], edi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rsi
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x58], rsi
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
mov r8d, edi
mov rcx, r13
call fcn.140014980
mov edi, eax
mov rcx, qword [rbp + 0x60]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x28]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x68]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x30]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x38]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x40]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x48]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x50]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x28]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x78]
call fcn.140059d2c
mov qword [rbp - 0x78], rsi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x78], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov ebx, dword [rbp - 0x18]
mov r15, qword [rbp + 0x70]
lea r9, [rbp - 0x68]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x78]
call fcn.14001f610
nop
mov dword [rsp + 0x80], 0xffffffff
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rsi
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x58], r15
lea rcx, [rbp + 8]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
mov r8d, edi
mov edx, dword [rbp - 0x60]
mov rcx, r13
call fcn.140014980
nop
mov rcx, qword [rbp + 0x78]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x78]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x80]
call fcn.140059d2c
nop
lea rcx, [rbp + 0x98]
call fcn.1400118f0
mov rcx, qword [rbp + 0x90]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 8]
call fcn.140059d2c
mov r15d, dword [rbp - 0x14]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r15d
mov dword [rbp - 0x14], r15d
lea r8, [rbp - 0x68]
mov edx, r15d
mov rcx, qword [rbp + 0x10]
call fcn.14002d2c0
test eax, eax
je 0x140047080
mov rdi, qword [rbp + 0x80]
mov rsi, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp - 0x68]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 8]
call fcn.140059d2c
nop
mov rcx, r14
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x18]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x20]
call fcn.140059d2c
nop
mov rcx, qword [rbp]
call fcn.140059d2c
nop
mov rcx, rsi
call fcn.140059d2c
nop
mov rcx, rdi
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x58]
call fcn.140059d2c
nop
mov rcx, qword [r12]
call fcn.140059d2c
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.14004bd30
mov rbx, qword [rsp + 0x450]
add rsp, 0x400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret