Function at 0x140025a00
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x140076100]
xor rax, rsp
mov qword [rbp + 0x150], rax
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x114
call qword [sym.imp.ntdll.dll_RtlGetVersion]
mov eax, dword [rsp + 0x64]
add eax, 0xfffffff6
cmp eax, 1
ja 0x1400261d4
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14001de80
movabs rax, 0x1d5841104742a756
lea rdx, [rbp + 0x80]
mov qword [rbp + 0x80], rax
movabs rcx, 0x66e7456eec4a1dc
mov qword [rbp + 0xd8], rcx
movabs rax, 0x16f280c2ca0e599f
mov qword [rbp + 0x88], rax
movabs rdi, 0x5e040c551311fe05
movdqa xmm0, xmmword [rbp + 0x80]
movabs rax, 0x5415e8cb2475bd29
mov qword [rbp + 0x90], rax
movabs rbx, 0x79b1f4acaf7c2bea
movabs rax, 0xf2e4767abde86e28
mov qword [rbp + 0x138], rcx
mov qword [rbp + 0x98], rax
movabs r14, 0x2070bba74b07c947
movdqa xmm1, xmmword [rbp + 0x90]
movabs rax, 0x2e3a6468f3688c25
mov qword [rbp + 0xa0], rax
movabs r15, 0x9e8b040ed3872d74
movabs rax, 0x988ee7e484d2e4ab
mov qword [rbp + 0xe0], rdi
mov qword [rbp + 0xa8], rax
movabs r12, 0x695f0701850dc879
movabs rax, 0x66766accb618ae15
mov qword [rbp + 0xe8], rbx
xorps xmm0, xmmword [rbp + 0xe0]
movabs r13, 0xfdedb4b8e0a085de
mov qword [rbp + 0xb0], rax
movabs rsi, 0x8bc1844a19548038
movdqa xmmword [rbp + 0x80], xmm0
movabs rax, 0xe4b2ed3c6b31f041
movdqa xmm0, xmmword [rbp + 0xa0]
mov r9d, 0x20019
mov qword [rbp + 0xb8], rax
xor r8d, r8d
movabs rax, 0xc85164d2f9d1937f
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xc0], rax
mov rcx, 0xffffffff80000002
movabs rax, 0x616257d1be87a636
mov qword [rbp + 0xf8], r15
xorps xmm1, xmmword [rbp + 0xf0]
mov qword [rbp + 0xc8], rax
movabs rax, 0xacdf1a7b6dc2f9aa
mov qword [rbp + 0xd0], rax
movabs rax, 0x2e2a19a3df6acf7b
mov qword [rbp + 0x110], rax
movabs rax, 0xad3216bd9fbfd60d
movdqa xmmword [rbp + 0x90], xmm1
movdqa xmm1, xmmword [rbp + 0xb0]
mov qword [rbp + 0x120], rax
movabs rax, 0x150c1eb4dae8e552
mov qword [rbp + 0x128], rax
movabs rax, 0xacdf630f04b09ecf
mov qword [rbp + 0x130], rax
lea rax, [rsp + 0x50]
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], r13
xorps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp + 0xa0], xmm0
movdqa xmm0, xmmword [rbp + 0xc0]
xorps xmm0, xmmword [rbp + 0x120]
mov qword [rbp + 0x118], rsi
xorps xmm1, xmmword [rbp + 0x110]
movdqa xmmword [rbp + 0xb0], xmm1
movdqa xmm1, xmmword [rbp + 0xd0]
xorps xmm1, xmmword [rbp + 0x130]
movdqa xmmword [rbp + 0xd0], xmm1
mov qword [rsp + 0x20], rax
movdqa xmmword [rbp + 0xc0], xmm0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140025d28
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x58], eax
xor r9d, r9d
mov qword [rsp + 0x48], rbx
movabs rax, 0x5e60693971709040
mov qword [rsp + 0x40], rax
xor r8d, r8d
movdqa xmm0, xmmword [rsp + 0x40]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rbp + 0x140], rdi
mov qword [rbp + 0x148], rbx
xorps xmm0, xmmword [rbp + 0x140]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x5c], 4
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x140025e67
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x30], 0
je 0x1400261d4
mov qword [rbp + 0x118], rsi
lea rdx, [rbp + 0xe0]
movabs rax, 0x3c657e307d7d8b53
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0xe0], rax
lea rcx, [0x140077670]
movabs rax, 0x1cc79ddecb5c4e86
mov qword [rbp + 0x88], rbx
mov qword [rbp + 0xe8], rax
movabs rax, 0x4c1bd8c82765e935
movdqa xmm0, xmmword [rbp + 0xe0]
xorps xmm0, xmmword [rbp + 0x80]
mov qword [rbp + 0xf0], rax
movabs rax, 0xfbab7767f3f35e1d
mov qword [rbp + 0xf8], rax
movabs rax, 0x157f6364e96fa917
movdqa xmm1, xmmword [rbp + 0xf0]
mov qword [rbp + 0x100], rax
movabs rax, 0x9481d6d993c9c1fe
mov qword [rbp + 0x108], rax
movabs rax, 0x2e2a19a9f144a815
mov qword [rbp + 0x110], rax
movabs rax, 0x2e2a19a3df6acf7b
movdqa xmmword [rbp + 0xe0], xmm0
movdqa xmm0, xmmword [rbp + 0x100]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x98], r15
xorps xmm1, xmmword [rbp + 0x90]
movdqa xmmword [rbp + 0xf0], xmm1
movdqa xmm1, xmmword [rbp + 0x110]
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], r13
xorps xmm0, xmmword [rbp + 0xa0]
mov qword [rbp + 0xb8], rsi
xorps xmm1, xmmword [rbp + 0xb0]
movdqa xmmword [rbp + 0x110], xmm1
movdqa xmmword [rbp + 0x100], xmm0
call fcn.14001c000
jmp 0x14002607c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x58], 0
setne al
test al, al
je 0x140025d28
cmp dword [rsp + 0x30], 0
je 0x140026092
movabs rax, 0x3c657e307d7d8b53
mov qword [rbp + 0xe0], rdi
mov qword [rbp + 0x80], rax
lea rdx, [rbp + 0x80]
movabs rax, 0x1cc79ddecb5c4e86
mov qword [rbp + 0xe8], rbx
mov qword [rbp + 0x88], rax
lea rcx, [0x140077670]
movdqa xmm0, xmmword [rbp + 0x80]
movabs rax, 0x4c1bd8c82765e935
xorps xmm0, xmmword [rbp + 0xe0]
mov qword [rbp + 0x90], rax
movabs rax, 0xbeef6a6ff3f35e1d
mov qword [rbp + 0x98], rax
movabs rax, 0x1a367173e07db131
movdqa xmm1, xmmword [rbp + 0x90]
mov qword [rbp + 0xa0], rax
movabs rax, 0x8f82d2d68580f7b1
mov qword [rbp + 0xa8], rax
movabs rax, 0x4b4e76c0ff0eaa18
mov qword [rbp + 0xb0], rax
movabs rax, 0xe2b3e32f6d3ae918
mov qword [rbp + 0xb8], rax
movabs rax, 0xc35736cef69faf79
mov qword [rbp + 0xc0], rax
movabs rax, 0x692c30d0bf848733
mov qword [rbp + 0xc8], rax
movabs rax, 0xc5b3016e77d9daef
mov qword [rbp + 0xd0], rax
movabs rax, 0x66e745cc0eac6b2
mov qword [rbp + 0xd8], rax
movabs rax, 0x2e2a19a3df6acf7b
mov qword [rbp + 0x110], rax
movabs rax, 0xad3216bd9fbfd60d
mov qword [rbp + 0x120], rax
movabs rax, 0x150c1eb4dae8e552
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm0, xmmword [rbp + 0xa0]
mov qword [rbp + 0x128], rax
movabs rax, 0xacdf630f04b09ecf
mov qword [rbp + 0x130], rax
movabs rax, 0x66e7456eec4a1dc
mov qword [rbp + 0x138], rax
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], r15
xorps xmm1, xmmword [rbp + 0xf0]
movdqa xmmword [rbp + 0x90], xmm1
movdqa xmm1, xmmword [rbp + 0xb0]
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], r13
xorps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp + 0xa0], xmm0
movdqa xmm0, xmmword [rbp + 0xc0]
xorps xmm0, xmmword [rbp + 0x120]
mov qword [rbp + 0x118], rsi
xorps xmm1, xmmword [rbp + 0x110]
movdqa xmmword [rbp + 0xb0], xmm1
movdqa xmm1, xmmword [rbp + 0xd0]
xorps xmm1, xmmword [rbp + 0x130]
movdqa xmmword [rbp + 0xd0], xmm1
movdqa xmmword [rbp + 0xc0], xmm0
call fcn.14001c000
call fcn.14001e0f0
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.14001de80
mov al, 1
jmp 0x1400261d6
movabs rax, 0x2d6d7a277661874d
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0xe0], rax
lea rdx, [rbp + 0xe0]
movabs rax, 0xbde92c2ca5c5985
mov qword [rbp + 0x88], rbx
mov qword [rbp + 0xe8], rax
lea rcx, [0x140077670]
movdqa xmm0, xmmword [rbp + 0xe0]
movabs rax, 0x4514d4c46b63ac24
xorps xmm0, xmmword [rbp + 0x80]
mov qword [rbp + 0xf0], rax
movabs rax, 0xf7f9636ba7e94454
mov qword [rbp + 0xf8], rax
movabs rax, 0x73a2772ec2db10d
movdqa xmm1, xmmword [rbp + 0xf0]
mov qword [rbp + 0x100], rax
movabs rax, 0x81cd9adc85cce7bf
mov qword [rbp + 0x108], rax
movabs rax, 0x47467bc2ac038b5b
mov qword [rbp + 0x110], rax
movabs rax, 0x8bc18440377ae756
mov qword [rbp + 0x118], rax
movabs rax, 0x2e2a19a3df6acf7b
movdqa xmmword [rbp + 0xe0], xmm0
movdqa xmm0, xmmword [rbp + 0x100]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x98], r15
xorps xmm1, xmmword [rbp + 0x90]
movdqa xmmword [rbp + 0xf0], xmm1
movdqa xmm1, xmmword [rbp + 0x110]
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], r13
xorps xmm0, xmmword [rbp + 0xa0]
mov qword [rbp + 0xb8], rsi
xorps xmm1, xmmword [rbp + 0xb0]
movdqa xmmword [rbp + 0x110], xmm1
movdqa xmmword [rbp + 0x100], xmm0
call fcn.14001c000
call fcn.14001e0f0
mov al, 1
jmp 0x1400261d6
xor al, al
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140035550
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret