Function at 0x14003f980
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [0x140381038]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
cmp rbx, rdi
je 0x14003f9e7
add rbx, 0xffffffffffffffd0
jmp 0x14003f9c7
mov rcx, qword [rbx]
call fcn.14019a0bc
lea rax, [rbx - 0x30]
cmp rbx, rdi
mov rbx, rax
je 0x14003f9e7
test rbx, rbx
je 0x14003fb47
cmp byte [rbx + 0x2f], 0
jns 0x14003f9df
mov rcx, qword [rbx + 0x18]
call fcn.14019a0bc
cmp byte [rbx + 0x17], 0
jns 0x14003f9bb
jmp 0x14003f9b3
mov qword [rsi + 8], rdi
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x60]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x14030e560]
movaps xmmword [rdi], xmm0
lea r8, str.SYSTEMCurrentControlSetControlSession_Manager
mov rcx, rdi
mov rdx, 0xffffffff80000002
mov r9d, 1
call fcn.1400696d0
mov rdi, qword [rdi]
test rdi, rdi
je 0x14003fb7a
mov dword [rsp + 0x5c], 0
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov edx, 1
mov rcx, rbx
call fcn.140131e80
mov dword [rsp + 0x3c], 0xaaaaaaaa
mov rax, qword [rbx]
cmp qword [rbx + 8], rax
je 0x14003fbd2
lea r14, [rsp + 0x5c]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x3c]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x14003fb73
cmp eax, 0xea
jne 0x14003fb1c
mov ebx, 0x8000ffff
cmp dword [rsp + 0x3c], 7
jne 0x14003fb2a
mov ecx, dword [rsp + 0x5c]
test cl, 1
jne 0x14003fb2a
mov rax, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov r9, r8
sub r9, rax
mov rdx, rcx
sub rdx, r9
jbe 0x14003fbfe
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.140131e80
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
cmp rcx, rax
je 0x14003fbd2
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x3c]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14003fba8
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003fb7f
mov rax, qword [rsp + 0x48]
mov rdx, rax
sub rdx, rcx
dec rax
cmp rdx, rax
jbe 0x14003fbc6
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x41
call fcn.1401dac90
mov ebx, 0x80070002
jmp 0x14003fb2a
mov ebx, 0x80070002
lea rcx, [rsp + 0x60]
call fcn.140069970
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14019b960
mov eax, ebx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
sub rdx, rcx
je 0x14003fbd2
mov r8, rsi
call fcn.1401e6ac0
mov ebx, eax
jmp 0x14003fb2a
mov qword [rsp + 0x48], rcx
call fcn.14019a0bc
jmp 0x14003fb7f
lea rax, str.vector___index_out_of_bounds
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_vector
lea r9, [0x140310631]
mov r8d, 0x622
call fcn.1401dac90
jb 0x14003fc08
mov rcx, r8
jmp 0x14003fae9
add rcx, rax
mov rdx, r8
sub rdx, rcx
dec r8
cmp rdx, r8
ja 0x14003fb47
mov qword [rsp + 0x48], rcx
jmp 0x14003fae9