Function at 0x1400eb1b0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
mov rsi, rcx
test rcx, rcx
je 0x1400eb328
lea rbp, [0x1404cb0d8]
mov rcx, rbp
call fcn.140341618
mov rcx, qword [0x1404cb0d0]
test rcx, rcx
je 0x1400eb598
mov rdx, rsi
call fcn.1400c84f0
mov rbx, rax
test rax, rax
je 0x1400eb228
lock add dword [rax + 0x18], 1
mov rcx, rbp
call fcn.140341260
mov rax, rbx
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
lea r14, [rsp + 0x48]
lea r13, [rsp + 0x50]
call fcn.1400e4a90
mov ecx, 0x20
mov r12, rax
call fcn.1400e69e0
pxor xmm0, xmm0
xor r8d, r8d
mov rdx, r14
movups xmmword [rax], xmm0
mov rcx, rsi
mov rbx, rax
movups xmmword [rax + 0x10], xmm0
call fcn.1400e31f0
test eax, eax
jne 0x1400eb400
xor r15d, r15d
mov ecx, 0x10
mov rdi, r13
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], 0
mov rax, r15
rep stosq qword [rdi], rax
lea rdi, [rsp + 0x8c]
mov rcx, r14
mov rdx, rdi
call fcn.14029bf20
test eax, eax
jne 0x1400eb620
cmp qword [rbx + 8], 0
jne 0x1400eb468
lea r8, [rsp + 0x40]
mov rdx, r12
mov rcx, rsi
call fcn.1400e9ff0
test eax, eax
jne 0x1400eb740
mov rcx, r12
call fcn.14034efb0
cmp qword [rbx + 8], 0
je 0x1400eb8b0
mov rdx, qword [rbx]
test rdx, rdx
je 0x1400eb568
lea r12, [rbx + 0x18]
lea rbp, [0x1404cb0d8]
test rsi, rsi
jne 0x1400eb48b
nop dword [rax + rax]
lock add dword [r12], 1
mov qword [0x1404cb0c0], rbx
lock add dword [r12], 1
lea rcx, [0x1404cb0c8]
call fcn.140341260
jmp 0x1400eb20b
lea rbp, [0x1404cb0c8]
lea r13, [rsp + 0x50]
mov rcx, rbp
call fcn.140341618
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov r9d, 1
lea rdx, str.SYSTEMCurrentControlSetControlTimeZoneInformation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400eb3ae
lea r14, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
lea r12, str.TimeZoneKeyName
mov qword [rsp + 0x28], r14
mov rbx, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x48], 0
mov rdx, r12
mov qword [rsp + 0x20], 0
call rbx
test eax, eax
je 0x1400eb5c0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [0x1404cb0c0]
test rbx, rbx
je 0x1400eb4b0
mov rcx, qword [rbx]
lea rdx, [0x1403a1d2a]
xor r12d, r12d
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400eb7c3
nop dword [rax + rax]
mov qword [0x1404cb0c0], 0
mov rcx, rbx
call fcn.1400e9ea0
jmp 0x1400eb4b3
mov eax, dword [rsp + 0x48]
mov rcx, rsi
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x50], eax
call fcn.1400e4a90
mov rcx, rsi
mov qword [rsp + 0x58], rax
call fcn.1400e4a90
xor ecx, ecx
mov r9d, 1
mov r8d, 0x10
mov qword [rbx], rax
mov edx, 1
call fcn.1400bd890
mov r8d, 1
mov rdx, r13
mov qword [rbx + 8], rax
mov rcx, rax
call fcn.1402c6e80
cmp qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
je 0x1400eb26b
mov rcx, r12
call fcn.14034efb0
cmp qword [rbx + 8], 0
je 0x1400eb818
mov rdx, qword [rbx]
lea r12, [rbx + 0x18]
test rdx, rdx
je 0x1400eb568
mov rcx, qword [0x1404cb0d0]
mov r8, rbx
call fcn.1400c89e0
lock add dword [r12], 1
mov rcx, rbp
call fcn.140341260
jmp 0x1400eb20b
xor r12d, r12d
mov ecx, 0x20
call fcn.1400e69e0
pxor xmm0, xmm0
xor ecx, ecx
lea r8, [rsp + 0x40]
movups xmmword [rax], xmm0
mov rdx, r12
mov rbx, rax
movups xmmword [rax + 0x10], xmm0
mov qword [rsp + 0x40], 0
call fcn.1400e9ff0
test eax, eax
jne 0x1400eb740
mov rax, rsi
or rax, qword [rbx + 8]
jne 0x1400eb2c8
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 0xffffffff
je 0x1400eb541
mov edx, 0x100
mov ecx, 1
call sub.msvcrt.dll_calloc
mov rsi, rax
test rax, rax
je 0x1400eb956
mov rdx, r13
mov rcx, rax
mov qword [rsp + 0x40], rax
call fcn.1400e2ef0
test eax, eax
jne 0x1400eb8d9
mov rcx, rsi
call fcn.14034efb0
mov rcx, r12
call fcn.14034efb0
cmp qword [rbx + 8], 0
je 0x1400eb921
cmp qword [rbx], 0
lea r12, [rbx + 0x18]
jne 0x1400eb300
nop word [rax + rax]
lea rax, str.tz__name___NULL
lea r9, str.g_time_zone_new_identifier
mov r8d, 0x7af
mov qword [rsp + 0x20], rax
lea rdx, str..._glib_gtimezone.c
lea rcx, [0x1403a1bda]
call fcn.1400e7f70
nop dword [rax]
mov rcx, qword [str._m_f_]
mov rdx, qword [0x14048daf0]
xor r9d, r9d
xor r8d, r8d
call fcn.1400cdb90
mov qword [0x1404cb0d0], rax
mov rcx, rax
jmp 0x1400eb1ee
movsxd rdx, dword [rsp + 0x48]
test rdx, rdx
je 0x1400eb738
mov rcx, rdx
mov qword [rsp + 0x30], rdx
call sub.msvcrt.dll_malloc
mov rdx, qword [rsp + 0x30]
test rax, rax
mov rdi, rax
mov r15, rax
je 0x1400eb930
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], r14
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rdx, r12
call rbx
test eax, eax
je 0x1400eb770
mov rcx, r15
call fcn.14034efb0
jmp 0x1400eb3a3
lea rdx, [rsp + 0x54]
mov rcx, r14
call fcn.1400e32c0
test eax, eax
je 0x1400eb2a5
mov rax, qword [rsp + 0x48]
cmp byte [rax], 0
je 0x1400eb887
lea rax, [rsp + 0xad]
mov rcx, r14
mov rdx, rax
mov qword [rsp + 0x30], rax
call fcn.14029bf20
test eax, eax
je 0x1400eb2a5
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.1400e32c0
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x1400eb685
mov eax, dword [rsp + 0x54]
sub eax, 0xe10
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x48]
cmp byte [rax], 0
jne 0x1400eb834
lea r8, [rsp + 0x40]
xor edx, edx
lea rcx, str.Pacific_Standard_Time
call fcn.1400e9ff0
mov r8d, eax
test eax, eax
je 0x1400eb2a5
mov r15, qword [rsp + 0x40]
cmp eax, 1
je 0x1400eb715
lea edx, [rax - 2]
lea r14, [r15 + 0x3c]
shl rdx, 7
lea r15, [r15 + rdx + 0xbc]
nop
mov eax, dword [rsp + 0x54]
mov rcx, r14
mov rdx, rdi
mov dword [rsp + 0x3c], r8d
neg eax
mov dword [r14 - 0x38], eax
mov eax, dword [rsp + 0x58]
neg eax
mov dword [r14 - 0x34], eax
call sub.msvcrt.dll_strcpy
mov rdx, qword [rsp + 0x30]
lea rcx, [r14 + 0x21]
sub r14, 0xffffffffffffff80
call sub.msvcrt.dll_strcpy
cmp r14, r15
mov r8d, dword [rsp + 0x3c]
jne 0x1400eb6d0
mov r15, qword [rsp + 0x40]
mov r9, r12
mov rdx, r15
mov rcx, rbx
xor r12d, r12d
call fcn.1400eab20
mov rcx, r15
call fcn.14034efb0
jmp 0x1400eb2a5
xor r15d, r15d
jmp 0x1400eb611
mov rdi, qword [rsp + 0x40]
mov r9, r12
mov r8d, eax
mov rcx, rbx
xor r12d, r12d
mov rdx, rdi
call fcn.1400eab20
mov rcx, rdi
call fcn.14034efb0
jmp 0x1400eb4eb
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, rdi
call fcn.1402b36b0
mov rcx, qword [rsp + 0x50]
mov r12, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [0x1404cb0c0]
test rbx, rbx
je 0x1400eb4b3
mov rcx, qword [rbx]
test r12, r12
je 0x1400eb3be
test rcx, rcx
je 0x1400eb3e0
mov rdx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400eb3e0
mov edx, dword [rbx + 0x18]
test edx, edx
jle 0x1400eb7e8
lock add dword [rbx + 0x18], 1
mov rcx, rbp
call fcn.140341260
mov rcx, r12
call fcn.14034efb0
jmp 0x1400eb20b
lea rax, str.tz__ref_count___0
mov r9, qword [str.g_time_zone_ref]
mov r8d, 0x122
lea rdx, str..._glib_gtimezone.c
mov qword [rsp + 0x20], rax
lea rcx, [0x1403a1bda]
call fcn.1400e7f70
nop dword [rax]
mov rdx, rbx
mov ecx, 0x20
call fcn.1400e6130
mov rcx, rbp
xor ebx, ebx
call fcn.140341260
jmp 0x1400eb20b
lea rdx, [rax + 1]
mov qword [rsp + 0x48], rdx
cmp byte [rax], 0x2c
jne 0x1400eb2a5
lea rdx, [rsp + 0x5c]
mov rcx, r14
call fcn.1400e4c20
test eax, eax
je 0x1400eb2a5
mov rax, qword [rsp + 0x48]
lea rdx, [rax + 1]
mov qword [rsp + 0x48], rdx
cmp byte [rax], 0x2c
jne 0x1400eb2a5
lea rdx, [rsp + 0x74]
mov rcx, r14
call fcn.1400e4c20
test eax, eax
je 0x1400eb2a5
lea rcx, [rsp + 0x40]
mov rdx, r13
call fcn.1400e33a0
mov r15, qword [rsp + 0x40]
mov r8d, eax
test eax, eax
jne 0x1400eb715
jmp 0x1400eb2a5
mov rdx, rbx
mov ecx, 0x20
call fcn.1400e6130
test rsi, rsi
jne 0x1400eb980
lea rcx, [0x1404cb0c8]
xor ebx, ebx
call fcn.140341260
jmp 0x1400eb20b
mov byte [rsi + 0x5c], 0
pxor xmm0, xmm0
mov r9, r12
mov rdx, rsi
mov byte [rsi + 0x7d], 0
mov r8d, 2
mov rcx, rbx
xor r12d, r12d
mov dword [rsi], 0x77c
mov dword [rsi + 0x80], 0xbb7
movups xmmword [rsi + 0x3c], xmm0
movups xmmword [rsi + 0x4c], xmm0
movups xmmword [rsi + 0x5d], xmm0
movups xmmword [rsi + 0x6d], xmm0
call fcn.1400eab20
jmp 0x1400eb539
mov rdx, rbx
mov ecx, 0x20
call fcn.1400e6130
jmp 0x1400eb8c6
mov qword [rsp + 0x20], rdx
lea r9, [0x1403a1cf1]
lea r8, [0x1403a1d08]
mov edx, 4
lea rcx, [0x1403a1bda]
call fcn.1400d2190
jmp 0x1400eb954
mov qword [rsp + 0x20], 0x100
lea r9, [0x1403a1d2e]
lea r8, [0x1403a1d08]
mov edx, 4
lea rcx, [0x1403a1bda]
call fcn.1400d2190
jmp 0x1400eb97e
lea rbp, [0x1404cb0d8]
jmp 0x1400eb825