Function at 0x140040ef0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0xa00]
sub rsp, 0xb00
mov rax, qword [0x140089040]
xor rax, rsp
mov qword [rbp + 0x9f0], rax
mov rsi, rdx
mov rdi, rcx
lea rdx, [0x1400749b8]
mov ecx, 0xb0
mov r15, r9
mov r12d, r8d
call fcn.140049920
mov rbx, rax
test rax, rax
je 0x1400412c7
xor edx, edx
mov r8d, 0xb0
mov rcx, rax
call fcn.14006f200
mov byte [rbx], 1
lea rcx, [rbx + 0x58]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
mov dword [rbx + 0x50], 0xffffffff
movups xmmword [rbx + 0x10], xmm1
mov dword [rbx + 8], 2
mov dword [rbx + 0x54], 0
call fcn.14006de3c
mov qword [0x1400bfe60], rbx
xorps xmm0, xmm0
movups xmmword [rbx + 0xa0], xmm0
test r12d, r12d
je 0x140041137
test r15, r15
je 0x140041105
cmp byte [r15], 0
je 0x140041105
lea rax, [rbp - 0x60]
mov dword [rsp + 0x28], 0x20
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 0x20
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, r15
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareValveSteam
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140041051
mov ecx, 2
call fcn.140055b94
mov rcx, rax
lea rdx, str.Error_opening_Steam_key_n
call fcn.140045280
jmp 0x140041137
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.SteamExe
lea rax, [rbp - 0x20]
mov dword [rsp + 0x50], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400410ea
mov ecx, dword [rsp + 0x50]
cmp ecx, 1
jb 0x1400410ea
shr ecx, 1
je 0x1400410bb
lea rax, [rbp - 0x20]
cmp word [rax], 0x2f
jne 0x1400410b1
mov word [rax], 0x5c
add rax, 2
sub rcx, 1
jne 0x1400410a6
lea rax, [rsp + 0x60]
mov edx, 0x800
lea r9, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r8, str.__s__steam:__rungameid__s
lea rcx, [rbp + 0x1f0]
call fcn.1400452d0
lea rdx, [rbp + 0x1f0]
jmp 0x14004112e
mov ecx, 2
call fcn.140055b94
mov rcx, rax
lea rdx, str.Error_reading_SteamExe_key_n
call fcn.140045280
jmp 0x140041137
lea rax, [rbp - 0x60]
mov dword [rsp + 0x28], 0x20
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
lea rcx, [rbp - 0x60]
call fcn.1400453a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.14006e274
test eax, eax
jne 0x14004130b
mov eax, dword [0x14008ab7c]
cmp eax, 0x7fffffff
je 0x140041316
test rsi, rsi
je 0x140041182
movups xmm0, xmmword [rsi]
movups xmmword [0x1400bfd30], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [0x1400bfd40], xmm1
movups xmm0, xmmword [rsi + 0x20]
jmp 0x1400411a1
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [0x1400bfd30], xmm0
movups xmmword [0x1400bfd40], xmm0
movups xmmword [0x1400bfd50], xmm0
lea rcx, reloc.OLEAUT32.dll_SysReAllocString
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [0x1400bff70], xmm0
movups xmmword [0x1400bff80], xmm0
movups xmmword [0x1400bff90], xmm0
call fcn.14006e27c
cmp qword [0x1400c40b0], 0
jne 0x1400412d2
lea rax, [0x14008bf90]
mov r8d, 1
mov qword [0x1400af9c0], rax
test rdi, rdi
je 0x140041230
cmp byte [rdi], 0
lea rcx, [0x1400af9e0]
je 0x14004122d
mov edx, r8d
sub rdx, rdi
lea rax, [rdx + rdi]
cmp rax, 0x40
jae 0x14004122d
movzx eax, byte [rdi]
inc rdi
mov byte [rcx], al
inc rcx
cmp byte [rdi], 0
jne 0x140041213
mov byte [rcx], 0
mov rdi, qword [0x1400bfe60]
lea rax, [0x1400af9c0]
mov qword [0x1400c40b0], rax
mov ecx, 8
lea rax, [0x140041710]
mov qword [0x1400af9d0], rax
lea rax, [0x140041720]
mov qword [0x1400af9d8], rax
xchg byte [rdi], r8b
call fcn.1400493d8
movzx edx, byte [rsp + 0x30]
mov rcx, rax
mov rbx, rax
call fcn.14003f150
lea rax, [rsp + 0x48]
mov qword [rbx], rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1400421d0]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call fcn.140059d34
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400412f8
cmp dword [rdi + 0xa8], 0
jne 0x140041329
movaps xmm1, xmmword [rsp + 0x40]
movups xmmword [rdi + 0xa0], xmm1
jmp 0x1400412d2
mov qword [0x1400bfe60], 0
mov rcx, qword [rbp + 0x9f0]
xor rcx, rsp
call fcn.140049290
mov rbx, qword [rsp + 0xb38]
add rsp, 0xb00
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 6
mov dword [rsp + 0x48], 0
call fcn.14006e1d8
int3
mov ecx, 5
call fcn.14006e1d8
int3
dec eax
mov ecx, 6
mov dword [0x14008ab7c], eax
call fcn.14006e1d8
int3
call fcn.140059e1c
int3