Function at 0x14003e230
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [0x14037a038]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
cmp rbx, rdi
je 0x14003e297
add rbx, 0xffffffffffffffd0
jmp 0x14003e277
mov rcx, qword [rbx]
call fcn.1401973c4
lea rax, [rbx - 0x30]
cmp rbx, rdi
mov rbx, rax
je 0x14003e297
test rbx, rbx
je 0x14003e3f7
cmp byte [rbx + 0x2f], 0
jns 0x14003e28f
mov rcx, qword [rbx + 0x18]
call fcn.1401973c4
cmp byte [rbx + 0x17], 0
jns 0x14003e26b
jmp 0x14003e263
mov qword [rsi + 8], rdi
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x60]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x140307280]
movaps xmmword [rdi], xmm0
lea r8, str.SYSTEMCurrentControlSetControlSession_Manager
mov rcx, rdi
mov rdx, 0xffffffff80000002
mov r9d, 1
call fcn.140064a40
mov rdi, qword [rdi]
test rdi, rdi
je 0x14003e42a
mov dword [rsp + 0x5c], 0
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov edx, 1
mov rcx, rbx
call fcn.14012d7d0
mov dword [rsp + 0x3c], 0xaaaaaaaa
mov rax, qword [rbx]
cmp qword [rbx + 8], rax
je 0x14003e482
lea r14, [rsp + 0x5c]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x3c]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x14003e423
cmp eax, 0xea
jne 0x14003e3cc
mov ebx, 0x8000ffff
cmp dword [rsp + 0x3c], 7
jne 0x14003e3da
mov ecx, dword [rsp + 0x5c]
test cl, 1
jne 0x14003e3da
mov rax, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov r9, r8
sub r9, rax
mov rdx, rcx
sub rdx, r9
jbe 0x14003e4ae
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.14012d7d0
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
cmp rcx, rax
je 0x14003e482
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x3c]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14003e458
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003e42f
mov rax, qword [rsp + 0x48]
mov rdx, rax
sub rdx, rcx
dec rax
cmp rdx, rax
jbe 0x14003e476
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x44
call fcn.1401df1c0
mov ebx, 0x80070002
jmp 0x14003e3da
mov ebx, 0x80070002
lea rcx, [rsp + 0x60]
call fcn.140064ce0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140198b70
mov eax, ebx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
sub rdx, rcx
je 0x14003e482
mov r8, rsi
call fcn.1401e0c70
mov ebx, eax
jmp 0x14003e3da
mov qword [rsp + 0x48], rcx
call fcn.1401973c4
jmp 0x14003e42f
lea rax, str.vector___index_out_of_bounds
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_vector
lea r9, str.__n___size__
mov r8d, 0x601
call fcn.1401df1c0
jb 0x14003e4b8
mov rcx, r8
jmp 0x14003e399
add rcx, rax
mov rdx, r8
sub rdx, rcx
dec r8
cmp rdx, r8
ja 0x14003e3f7
mov qword [rsp + 0x48], rcx
jmp 0x14003e399