Function at 0x14001606e
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
jmp 0x14002aab0
push rbp
push rdi
sub rsp, 0x818
lea rbp, [rsp + 0x60]
mov rdi, rsp
mov ecx, 0x206
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x7a8], rax
lea rcx, [0x14006d19a]
call fcn.140016276
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0xa8], 0
mov dword [rbp + 0xe4], 0
mov dword [rbp + 0x104], 0
call fcn.1400166fe
movzx eax, al
test eax, eax
je 0x14002ab49
lea rcx, str.dismcore.dll
call fcn.14001679e
jmp 0x14002ad74
mov rax, qword [0x140065a08]
cmp dword [rax + 0x5c], 0x2580
jae 0x14002ab69
lea rax, str.ole32.dll
mov qword [rbp + 0xa8], rax
jmp 0x14002ab77
lea rax, str.MSCOREE.DLL
mov qword [rbp + 0xa8], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0x2000000
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionKnownFunctionTableDlls
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cdqe
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x14002abaf
jmp 0x14002ad71
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
lea rax, [rbp + 0x104]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xe4]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cdqe
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x14002ac21
jmp 0x14002ad71
cmp dword [rbp + 0xe4], 0
je 0x14002ac33
cmp dword [rbp + 0x104], 0
jne 0x14002ac38
jmp 0x14002ad71
cmp dword [rbp + 0x104], 0x104
jbe 0x14002ac49
jmp 0x14002ad71
mov dword [rbp + 0xc4], 0
jmp 0x14002ac63
mov eax, dword [rbp + 0xc4]
inc eax
mov dword [rbp + 0xc4], eax
mov eax, dword [rbp + 0xe4]
cmp dword [rbp + 0xc4], eax
jae 0x14002ad60
mov edx, 0x410
lea rcx, [rbp + 0x150]
call fcn.140016c2b
mov dword [rbp + 0x124], 0x104
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x124]
lea r8, [rbp + 0x150]
mov edx, dword [rbp + 0xc4]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cdqe
mov qword [rbp + 0x48], rax
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x150]
call fcn.140016933
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x14002acf8
jmp 0x14002ad60
mov rcx, qword [rbp + 0x68]
call fcn.14001638e
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
movzx eax, word [rax - 2]
cmp eax, 0x5c
je 0x14002ad2b
lea rdx, [0x140048324]
mov rcx, qword [rbp + 0x88]
call fcn.1400165e1
mov rdx, qword [rbp + 0xa8]
lea rcx, [rbp + 0x150]
call fcn.1400165e1
lea rcx, [rbp + 0x150]
call fcn.140016596
test eax, eax
je 0x14002ad5b
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14002ac55
mov dword [rbp + 4], 1
xor eax, eax
test eax, eax
jne 0x14002ab49
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x14004d660]
call fcn.140016b90
mov rax, rdi
mov rcx, qword [rbp + 0x7a8]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x7b8]
pop rdi
pop rbp
ret