Function at 0x140001e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push r12
push r14
lea rbp, [r11 - 0x47]
sub rsp, 0xd8
mov rax, qword [0x1400155d8]
xor rax, rsp
mov qword [rbp + 7], rax
mov rcx, qword [rbp + 0x6f]
xor r12d, r12d
mov dword [rbp - 0x51], r9d
mov rax, r8
mov r8, qword [rbp + 0x7f]
mov r14d, r12d
mov qword [rbp - 0x29], r8
mov esi, r12d
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x39], rdx
mov qword [rbp - 0x31], rcx
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x61], r12
test rdx, rdx
je 0x1400046e0
test rax, rax
je 0x1400046e0
test rcx, rcx
je 0x1400046e0
test r8, r8
je 0x1400046e0
mov qword [r11 + 8], rbx
mov rbx, qword [rdx]
mov qword [r11 - 0x28], rdi
mov qword [r11 - 0x30], r13
mov r13d, 0xfffa0000
mov qword [r11 - 0x38], r15
mov r15d, r12d
mov dword [rbp - 0x71], r12d
test rbx, rbx
jne 0x140002284
mov r9, rdx
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x59]
lea r8, [rbp - 0x61]
call fcn.140002520
mov r14, qword [rbp - 0x61]
test al, al
je 0x1400043ac
or r13, 0xffffffffffffffff
test r15d, r15d
jne 0x1400043bb
mov rbx, qword [rbp - 0x59]
mov dword [rbp - 0x61], r12d
mov dword [rbp - 0x21], r12d
test rbx, rbx
je 0x140004606
mov rdx, r14
call fcn.140002a50
test al, al
jne 0x140004606
lea rax, [rbp - 0x21]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r15, str.PowerShellVersion
mov rdx, r15
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x61]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400043c2
cmp dword [rbp - 0x61], 1
jne 0x14000447f
mov edi, dword [rbp - 0x21]
test edi, edi
je 0x1400045e2
shr edi, 1
mov eax, 2
lea ecx, [rdi + 1]
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.140002ef0
mov rsi, rax
test rax, rax
je 0x14000448a
mov word [rax + rdi*2], r12w
xor r9d, r9d
lea rax, [rbp - 0x21]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r15
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004492
cmp r12w, word [rsi]
je 0x1400045e2
mov rdx, rsi
call fcn.140002a50
test al, al
jne 0x1400045da
lea edx, [r13 + 0x2f]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcschr]
mov rdi, rax
test rax, rax
je 0x1400045da
movzx ecx, word [rax]
mov r9, rsi
sub cx, 0x30
cmp cx, 9
jbe 0x1400045da
cmp r12w, word [rsi]
je 0x1400045da
cmp rsi, rax
jae 0x1400045da
cmp word [r9], 0x30
je 0x140004560
sub rax, r9
and rax, 0xfffffffffffffffe
cmp rax, 0x14
jg 0x1400045da
mov r8d, 0xa
mov qword [rbp - 0x49], r12
lea rdx, [rbp - 0x49]
mov rcx, r9
call qword [sym.imp.msvcrt.dll_wcstoul]
mov r13d, eax
cmp rdi, qword [rbp - 0x49]
jne 0x1400045da
cmp eax, 0x7fffffff
ja 0x1400045da
xor r15d, r15d
lea rbx, [rdi + 2]
mov edx, 0x2e
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcschr]
mov rdi, rax
test rax, rax
je 0x140002111
movzx eax, word [rax]
sub ax, 0x30
cmp ax, 9
jbe 0x1400045d3
test rbx, rbx
je 0x1400045d3
xor ecx, ecx
cmp cx, word [rbx]
je 0x1400045d3
cmp rbx, rdi
jae 0x1400045d3
cmp word [rbx], 0x30
je 0x140004572
mov rax, rdi
sub rax, rbx
and rax, 0xfffffffffffffffe
cmp rax, 0x14
jg 0x1400045d3
mov qword [rbp - 0x69], rcx
lea rdx, [rbp - 0x69]
mov rcx, rbx
mov r8d, 0xa
call qword [sym.imp.msvcrt.dll_wcstoul]
cmp rdi, qword [rbp - 0x69]
jne 0x1400045d3
cmp eax, 0x7fffffff
ja 0x1400045d3
mov dword [rbp + r15*4 - 0x21], eax
inc r12d
inc r15
cmp r15, 2
jle 0x140002061
jmp 0x1400045d3
xor edx, edx
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcschr]
mov rdi, rax
test rax, rax
je 0x1400045d3
movzx ecx, word [rax]
sub cx, 0x30
cmp cx, 9
jbe 0x1400045d3
test rbx, rbx
je 0x1400045d3
xor ecx, ecx
cmp cx, word [rbx]
je 0x1400045d3
cmp rbx, rax
jae 0x1400045d3
cmp word [rbx], 0x30
je 0x140004584
sub rax, rbx
and rax, 0xfffffffffffffffe
cmp rax, 0x14
jg 0x1400045d3
mov qword [rbp - 0x61], rcx
lea rdx, [rbp - 0x61]
mov rcx, rbx
mov r8d, 0xa
call qword [sym.imp.msvcrt.dll_wcstoul]
cmp rdi, qword [rbp - 0x61]
jne 0x1400045d3
cmp eax, 0x7fffffff
ja 0x1400045d3
movsxd rcx, r12d
mov dword [rbp + rcx*4 - 0x21], eax
mov rax, qword [rbp - 0x41]
mov dword [rax], r13d
mov eax, dword [rbp - 0x51]
cmp eax, 0xffffffff
jne 0x140004596
mov rax, qword [rbp - 0x31]
lea r8, str.RuntimeVersion
mov rdx, qword [rbp - 0x59]
mov r9, r14
mov qword [rsp + 0x20], rax
call fcn.1400023e0
test al, al
je 0x140004606
mov rax, qword [rbp - 0x29]
lea r8, str.ConsoleHostAssemblyName
mov rdx, qword [rbp - 0x59]
mov r9, r14
mov qword [rsp + 0x20], rax
call fcn.1400023e0
mov bl, 1
test al, al
je 0x1400045c8
mov r15d, dword [rbp - 0x71]
mov r13, qword [rsp + 0xc8]
test r14, r14
je 0x140004613
mov rcx, r14
call sub.msvcrt.dll_free
xor r12d, r12d
mov r14d, r12d
test rsi, rsi
je 0x140002231
mov rcx, rsi
call sub.msvcrt.dll_free
test bl, bl
je 0x14000224f
mov rbx, qword [rbp - 0x59]
test rbx, rbx
je 0x14000224f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x14000461b
mov rdi, qword [rsp + 0xd0]
mov eax, r15d
mov r15, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.140003250
add rsp, 0xd8
pop r14
pop r12
pop rsi
pop rbp
ret
mov ecx, dword [rax]
mov rdx, rbx
mov qword [rbp - 0x49], r12
call fcn.140002a50
test al, al
jne 0x1400043ac
lea eax, [rcx - 4]
cmp eax, 1
jbe 0x14000430a
mov r9d, 0xa
lea rdx, [rbp - 0x11]
lea r8d, [r9 + 1]
call qword [sym.imp.msvcrt.dll__itow_s]
mov rdx, rbx
mov dword [rbp - 0x71], r12d
mov qword [rbp - 0x69], r12
mov qword [rbp - 0x21], r12
call fcn.140002a50
test al, al
jne 0x140004357
lea rdx, [rbp - 0x11]
call fcn.140002a50
test al, al
jne 0x140004357
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x61]
lea r8, [rbp - 0x69]
mov dword [rsp + 0x20], AtlComPtrAssign
lea rdx, str.SOFTWAREMicrosoftPowerShell_1_ls_
lea rcx, [0x140015be8]
call fcn.140002910
mov rdi, qword [rbp - 0x69]
test al, al
je 0x140004314
lea rax, [rbp - 0x21]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004323
test rdi, rdi
je 0x140002356
mov rcx, rdi
call sub.msvcrt.dll_free
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140002369
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x21], r12
test r15d, r15d
jne 0x140001ef0
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x61]
lea r8, [rbp - 0x49]
mov dword [rsp + 0x20], AtlComPtrAssign
lea rdx, str.SOFTWAREMicrosoftPowerShell_1_ls_PowerShellEngine
lea rcx, [0x140015be8]
call fcn.140002910
test al, al
je 0x1400043ac
mov rdi, qword [rbp - 0x49]
lea rax, [rbp - 0x59]
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, eax
test eax, eax
jne 0x140004366
mov r14, rdi
jmp 0x140001ef0
mov ecx, 3
jmp 0x1400022a6
mov r15d, 0xfffb0000
mov dword [rbp - 0x71], r15d
jmp 0x140002349
mov rcx, qword [0x140015bf0]
cmp eax, 2
mov r15d, 0xfffb0000
mov r9, rbx
cmove r15d, r13d
xor edx, edx
mov dword [rbp - 0x71], r15d
mov rax, qword [rcx]
lea r8d, [rdx + 0x19]
mov rax, qword [rax + 8]
call qword [0x14000d338]
nop
jmp 0x140002349
mov r15d, 0xfffb0000
mov dword [rbp - 0x71], r15d
jmp 0x140002369
mov rcx, qword [0x140015bf0]
mov r9, rdi
mov rax, qword [rcx]
cmp edx, 2
jne 0x14000439c
mov rax, qword [rax + 8]
xor edx, edx
test rbx, rbx
jne 0x140004389
lea r8d, [rdx + 0x1e]
jmp 0x1400043a6
mov r8d, 0x27
mov qword [rsp + 0x20], rbx
call qword [0x14000d338]
jmp 0x1400043ac
mov rax, qword [rax + 0x10]
mov r8d, 0x14
call qword [0x14000d338]
mov r15d, 0xfffb0000
mov dword [rbp - 0x71], r15d
jmp 0x140001ef0
xor bl, bl
jmp 0x140002205
lea rcx, [rbp - 0x69]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov r8d, eax
mov ecx, 0x1100
mov qword [rbp - 0x69], r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov edi, eax
test eax, eax
je 0x140004477
lea esi, [rax + 1]
mov eax, 2
mul rsi
cmovo rax, r13
mov rcx, rax
call fcn.140002ef0
mov rbx, rax
test rax, rax
je 0x140004435
mov r8, qword [rbp - 0x69]
mov edx, esi
mov rcx, rax
call fcn.140006c78
test eax, eax
jns 0x140004435
mov rcx, rbx
mov edi, r12d
call sub.msvcrt.dll_free
mov rbx, r12
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x140004477
mov rcx, qword [0x140015bf0]
xor edx, edx
mov qword [rsp + 0x28], rbx
mov r9, r14
mov qword [rsp + 0x20], r15
mov rax, qword [rcx]
lea r8d, [rdx + 0x16]
mov rax, qword [rax + 8]
call qword [0x14000d338]
test rbx, rbx
je 0x140004477
mov rcx, rbx
call sub.msvcrt.dll_free
mov rsi, r12
jmp 0x140004606
mov r8d, SafeArrayCopy
jmp 0x1400045e8
mov rsi, r12
jmp 0x140004606
lea rcx, [rbp - 0x51]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov r8d, eax
mov ecx, 0x1100
mov qword [rbp - 0x51], r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov edi, eax
test eax, eax
je 0x140004550
lea r15d, [rax + 1]
mov eax, 2
mul r15
cmovo rax, r13
mov rcx, rax
call fcn.140002ef0
mov rbx, rax
test rax, rax
je 0x140004507
mov r8, qword [rbp - 0x51]
mov edx, r15d
mov rcx, rax
call fcn.140006c78
test eax, eax
jns 0x140004507
mov rcx, rbx
mov edi, r12d
call sub.msvcrt.dll_free
mov rbx, r12
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x140004550
mov rcx, qword [0x140015bf0]
lea rdx, str.PowerShellVersion
mov qword [rsp + 0x28], rbx
mov r9, r14
mov qword [rsp + 0x20], rdx
xor edx, edx
mov rax, qword [rcx]
lea r8d, [rdx + 0x16]
mov rax, qword [rax + 8]
call qword [0x14000d338]
test rbx, rbx
je 0x140004550
mov rcx, rbx
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
mov rsi, r12
jmp 0x140004606
add r9, 2
cmp r9, rdi
jb 0x140002013
jmp 0x14000201e
add rbx, 2
cmp rbx, rdi
jb 0x1400020ad
jmp 0x1400020b7
add rbx, 2
cmp rbx, rdi
jb 0x140002156
jmp 0x140002160
cmp dword [rbp - 0x21], eax
jge 0x1400021b7
mov rcx, qword [0x140015bf0]
xor edx, edx
mov r9, qword [rbp - 0x39]
mov rax, qword [rcx]
lea r8d, [rdx + 0x1c]
mov r9, qword [r9]
mov rax, qword [rax + 8]
call qword [0x14000d338]
mov r15d, 0xfffa0000
jmp 0x14000460c
mov r15d, 0xfffb0000
jmp 0x140002205
lea r15, str.PowerShellVersion
mov r8d, AtlComPtrAssign
jmp 0x1400045e8
mov r8d, SafeArrayDestroy
mov rcx, qword [0x140015bf0]
mov r9, r14
xor edx, edx
mov qword [rsp + 0x20], r15
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x14000d338]
mov r15d, 0xfffb0000
mov bl, 1
jmp 0x140002205
xor r12d, r12d
jmp 0x140002224
mov qword [rsp + 0x30], r12
lea rdx, [rbp - 0x69]
mov dword [rsp + 0x28], r12d
xor r9d, r9d
mov qword [rsp + 0x20], rdx
mov r8d, eax
xor edx, edx
mov qword [rbp - 0x69], r12
mov ecx, 0x1100
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov edi, eax
test eax, eax
je 0x14000224f
lea esi, [rax + 1]
mov rcx, 0xffffffffffffffff
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.140002ef0
mov rbx, rax
test rax, rax
je 0x140004695
mov r8, qword [rbp - 0x69]
mov edx, esi
mov rcx, rax
call fcn.140006c78
test eax, eax
jns 0x140004695
mov rcx, rbx
mov edi, r12d
call sub.msvcrt.dll_free
mov rbx, r12
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x14000224f
mov rcx, qword [0x140015bf0]
mov r9, r14
mov qword [rsp + 0x20], rbx
mov rdx, qword [rcx]
mov rax, qword [rdx + 8]
xor edx, edx
lea r8d, [rdx + 0x15]
call qword [0x14000d338]
test rbx, rbx
je 0x14000224f
mov rcx, rbx
call sub.msvcrt.dll_free
nop
jmp 0x14000224f
mov eax, 0xfffb0000
jmp 0x14000226a