Function at 0x1400268d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor r12d, r12d
mov sil, dl
mov rbx, rcx
test rcx, rcx
je 0x140026afc
test dl, dl
je 0x14002690e
cmp dword [0x1401dc004], r12d
mov eax, r12d
sete al
jmp 0x14002693c
test byte [rcx + 0x18], 0x10
jne 0x140026939
mov eax, dword [0x1401dc334]
test eax, eax
je 0x140026926
cmp eax, 2
sete al
jmp 0x140026930
cmp byte [0x1401dc380], r12b
setne al
test al, al
mov eax, 1
jne 0x14002693c
mov eax, r12d
test eax, eax
jne 0x140026afc
lea rcx, [0x1401dc868]
mov dword [rbp + 0x30], r12d
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, 1
lock xadd dword [rbp - 0x28], eax
test eax, eax
jne 0x14002697e
cmp dword [rbp - 0x24], r12d
jne 0x140026b17
call qword [sym.imp.MSVCP140.dll__Thrd_id]
mov dword [rbp - 0x24], eax
mov eax, dword [rbp + 0x30]
mov edi, r12d
cmp edi, 4
jge 0x140026aea
mov eax, dword [rbx + 0x1c]
lea rcx, [rbp - 0x20]
mov rdx, qword [rbx + 0x10]
mov r14b, r12b
movzx r15d, sil
mov r9d, r15d
mov qword [rbp + 0x40], r12
shl r9d, 5
mov dword [rsp + 0x20], eax
call fcn.140024b40
mov rcx, rax
mov eax, dword [rax]
mov dword [rbp + 0x30], eax
mov rax, qword [rcx + 8]
mov qword [rcx + 8], r12
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0x40], rax
test rcx, rcx
je 0x1400269dd
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140007d11.0]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400269f7
mov qword [rbp - 0x18], r12
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140007d11.0]
mov eax, dword [rbp + 0x30]
test eax, eax
je 0x140026a66
test sil, sil
je 0x140026a62
mov eax, dword [rbx + 0x1c]
lea r9d, [r15 + r15]
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x20], eax
call fcn.140024b40
mov rcx, rax
mov eax, dword [rax]
mov dword [rbp + 0x30], eax
mov rax, qword [rcx + 8]
mov qword [rcx + 8], r12
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0x40], rax
test rcx, rcx
je 0x140026a45
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140007d11.0]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140026a5f
mov qword [rbp - 8], r12
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140007d11.0]
mov eax, dword [rbp + 0x30]
test eax, eax
jne 0x140026ac2
mov rax, qword [rbp + 0x40]
xor r9d, r9d
mov rdx, qword [rbx]
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov rcx, qword [rax + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 0x30], eax
cmp eax, 0x3f2
je 0x140026a9d
cmp eax, 0x3fa
je 0x140026a9d
cmp eax, 6
jne 0x140026ac2
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1401d3f90]
movzx eax, word [rcx + 0xa]
and eax, 0x1f
shl rax, 5
mov qword [rax + rdx], r12
call fcn.140022418
mov eax, dword [rbp + 0x30]
mov r14b, 1
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140026adf
mov qword [rbp + 0x40], r12
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140007d11.0]
mov eax, dword [rbp + 0x30]
inc edi
test r14b, r14b
jne 0x140026984
test eax, eax
lea rcx, [rbp - 0x30]
sete bl
call fcn.1400087d8
mov al, bl
jmp 0x140026afe
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor edx, edx
mov ecx, 0x131f4c4
call fcn.140007884
int3