Function at 0x140163ac8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rsi, rcx
mov rdi, qword [0x140fda2d8]
movabs rax, 0x4df3294a5b26c8b1
mov qword [rbp - 0x19], rax
movabs r12, 0x6fd2839683127606
mov qword [rbp - 0x11], r12
movabs rax, 0x2894483f3c48a9dd
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], r12
movdqa xmm0, xmmword [rbp - 0x19]
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x19], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x19]
or rbx, 0xffffffffffffffff
mov r8, rbx
xor r14d, r14d
inc r8
cmp byte [rax + r8], r14b
jne 0x140163b4e
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.14015a098
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rdx, qword [rbp + 7]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov r15d, 0x1000
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x140163bca
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, r15
jb 0x140163bc5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14016425f
call fcn.140cba258
test edi, edi
jne 0x140163cd3
mov rdi, qword [0x140fda2d8]
movabs rax, 0x4df3294a5b26c8b1
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], r12
movabs rax, 0x2894483f3c48a9dd
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], r12
movdqa xmm0, xmmword [rbp - 0x19]
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x19], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x19]
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x140163c21
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.14015a098
nop
lea r8, [rbp + 7]
lea rdx, [rbp + 0x27]
mov rcx, rdi
call fcn.14015ed70
lea rcx, [rsi + 0x20]
mov rdx, rax
call fcn.140156024
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0xf
jbe 0x140163c8b
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, r15
jb 0x140163c86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140164265
call fcn.140cba258
movdqa xmm0, xmmword [0x140f11610]
movdqu xmmword [rbp + 0x37], xmm0
mov byte [rbp + 0x27], r14b
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x140163cd3
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, r15
jb 0x140163cce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14016426b
call fcn.140cba258
mov rdi, qword [0x140fda2d8]
movabs rax, 0x47cb255a483bd0ae
mov qword [rbp + 7], rax
movabs rax, 0x1bb3f9ffee7b0276
mov qword [rbp + 0xf], rax
movabs rax, 0xcddada752e7ef4a6
mov qword [rbp + 0x17], rax
movabs rax, 0xc3ce8eac2a8f66f8
mov qword [rbp + 0x1f], rax
movabs rcx, 0x2894483f3c48a9dd
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x11], r12
movabs rcx, 0xcddada752e109bcf
mov qword [rbp - 9], rcx
mov qword [rbp - 1], rax
movdqa xmm0, xmmword [rbp + 7]
xorps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm1, xmmword [rbp + 0x17]
xorps xmm1, xmmword [rbp - 9]
movdqa xmmword [rbp + 0x17], xmm1
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea rax, [rbp + 7]
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x140163d68
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x19]
call fcn.14015a098
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x140163dde
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, r15
jb 0x140163dd9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140164271
call fcn.140cba258
test edi, edi
jne 0x140163edd
mov rdi, qword [0x140fda2d8]
movabs rax, 0x47cb255a483bd0ae
mov qword [rbp + 7], rax
movabs rax, 0x1bb3f9ffee7b0276
mov qword [rbp + 0xf], rax
movabs rax, 0xcddada752e7ef4a6
mov qword [rbp + 0x17], rax
movabs rax, 0xc3ce8eac2a8f66f8
mov qword [rbp + 0x1f], rax
movabs rcx, 0x2894483f3c48a9dd
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x11], r12
movabs rcx, 0xcddada752e109bcf
mov qword [rbp - 9], rcx
mov qword [rbp - 1], rax
movdqa xmm0, xmmword [rbp + 7]
xorps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm1, xmmword [rbp + 0x17]
xorps xmm1, xmmword [rbp - 9]
movdqa xmmword [rbp + 0x17], xmm1
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea rax, [rbp + 7]
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x140163e7b
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x19]
call fcn.14015a098
nop
lea rdx, [rbp - 0x19]
mov rcx, rdi
call fcn.14015f210
test eax, eax
setne al
mov byte [rsi + 0x40], al
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x140163edd
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, r15
jb 0x140163ed8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140164277
call fcn.140cba258
mov rdi, qword [0x140fda2d8]
movabs rax, 0x49e03b60533cdcbc
mov qword [rbp - 0x19], rax
movabs rax, 0x6fd2839683120274
mov qword [rbp - 0x11], rax
movabs rax, 0x2894483f3c48a9dd
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], r12
movdqa xmm0, xmmword [rbp - 0x19]
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x19], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x19]
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x140163f36
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.14015a098
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rdx, qword [rbp + 7]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x140163fac
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, r15
jb 0x140163fa7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14016427d
call fcn.140cba258
test edi, edi
jne 0x14016406f
mov rdi, qword [0x140fda2d8]
movabs rax, 0x49e03b60533cdcbc
mov qword [rbp - 0x19], rax
movabs rax, 0x6fd2839683120274
mov qword [rbp - 0x11], rax
movabs rax, 0x2894483f3c48a9dd
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], r12
movdqa xmm0, xmmword [rbp - 0x19]
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x19], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x19]
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x14016400d
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.14015a098
nop
lea rdx, [rbp + 7]
mov rcx, rdi
call fcn.14015f210
test eax, eax
setne al
mov byte [rsi + 0x41], al
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14016406f
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, r15
jb 0x14016406a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140164283
call fcn.140cba258
mov rdi, qword [0x140fda2d8]
movabs rax, 0x2894483f543cc8ad
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], r12
movabs rax, 0x2894483f3c48a9dd
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], r12
movdqa xmm0, xmmword [rbp - 0x19]
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x19], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x19]
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x1401640be
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.14015a098
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rdx, qword [rbp + 7]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x140164134
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, r15
jb 0x14016412f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140164289
call fcn.140cba258
test edi, edi
jne 0x140164238
mov rdi, qword [0x140fda2d8]
movabs rax, 0x2894483f543cc8ad
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], r12
movabs rax, 0x2894483f3c48a9dd
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], r12
movdqa xmm0, xmmword [rbp - 0x19]
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x19], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x19]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x140164188
mov r8, rbx
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.14015a098
nop
lea r8, [rbp + 7]
lea rdx, [rbp + 0x27]
mov rcx, rdi
call fcn.14015ed70
mov rdx, rax
mov rcx, rsi
call fcn.140156024
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0xf
jbe 0x1401641f4
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, r15
jb 0x1401641ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14016428f
call fcn.140cba258
movdqa xmm0, xmmword [0x140f11610]
movdqu xmmword [rbp + 0x37], xmm0
mov byte [rbp + 0x27], r14b
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x140164238
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, r15
jb 0x140164233
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140164259
call fcn.140cba258
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140cd6fcc
int3
call fcn.140cd6fcc
nop
call fcn.140cd6fcc
nop
call fcn.140cd6fcc
int3
call fcn.140cd6fcc
int3
call fcn.140cd6fcc
int3
call fcn.140cd6fcc
int3
call fcn.140cd6fcc
int3
call fcn.140cd6fcc
nop
call fcn.140cd6fcc
int3