Function at 0x140024990
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov rsi, rcx
movabs rbx, 0x8000000000000000
lea rdx, [0x14042a4e4]
lea rcx, [rsp + 0x38]
mov r8d, 0x12
call fcn.140025440
cmp qword [rsp + 0x38], rbx
jne 0x1400249ea
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 1
mov qword [rsp + 0x80], 0
jmp 0x140024a01
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rsp + 0x38]
movaps xmmword [rsp + 0x70], xmm0
lea rdx, [0x14042a4e4]
lea rcx, [rsp + 0x38]
mov r8d, 0x12
call fcn.140025440
mov rdi, qword [rsp + 0x38]
xor edx, edx
cmp rdi, rbx
mov ebx, 1
cmovne rbx, qword [rsp + 0x40]
cmove rdi, rdx
cmovne rdx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.1400f6200
mov r14, rax
test rdi, rdi
je 0x140024a58
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call fcn.140008a40
test r14b, 1
jne 0x140024a74
shr r14, 0x20
mov ebp, 0xb
cmp r14d, 0x55ef
ja 0x140024c3a
lea rax, [0x14042a497]
mov qword [rsp + 0x38], rax
lea rax, [0x14042a4c3]
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0xa8]
lea rdx, [rsp + 0x38]
call fcn.140032c50
lea rax, [0x14042a4f6]
mov qword [rsp + 0x38], rax
lea rax, [0x14042a50f]
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0x88]
lea rbx, [rsp + 0x38]
mov rdx, rbx
call fcn.140032c50
mov rdi, qword [rsp + 0xb0]
call fcn.14004c230
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rbx
mov rcx, 0xffffffff80000002
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x20019
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x140024b66
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x140024b3f
mov rcx, qword [rsp + 0x90]
add rdx, rdx
mov r8d, 2
call fcn.140008a40
mov rdx, qword [rsp + 0xa8]
test rdx, rdx
je 0x140024c38
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140008a40
jmp 0x140024c38
mov r15, qword [rsp + 0x38]
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x34], 0
mov r14, qword [rsp + 0x90]
mov dword [rsp + 0x38], 0
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov rcx, r15
mov rdx, r14
xor r8d, r8d
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
test eax, eax
je 0x140024bea
movzx ecx, bx
or ecx, 0x80070000
test ebx, ebx
cmovle ecx, ebx
call fcn.140057310
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], edx
mov byte [rsp + 0x38], 1
test rax, rax
je 0x140024bf0
lea rcx, [rsp + 0x40]
call fcn.140057db0
jmp 0x140024bf0
mov ebp, dword [rsp + 0x34]
jmp 0x140024bf0
mov rcx, r15
call sub.advapi32.dll_RegCloseKey
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x140024c16
add rdx, rdx
mov r8d, 2
mov rcx, r14
call fcn.140008a40
mov rdx, qword [rsp + 0xa8]
test rdx, rdx
je 0x140024c34
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140008a40
test ebx, ebx
je 0x140024c3a
xor ebp, ebp
mov dword [rsp + 0xa8], ebp
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x88], rax
lea rax, [fcn.1400fb5f0]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x98], rax
lea rax, [0x140022b50]
mov qword [rsp + 0xa0], rax
lea rax, [0x14042a518]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x58], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 2
lea rcx, [rsp + 0xc0]
lea rdx, [rsp + 0x38]
call fcn.1400dd760
mov rax, qword [rsp + 0xd0]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsi], xmm0
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140024cf3
mov rcx, qword [rsp + 0x78]
mov r8d, 1
call fcn.140008a40
mov rax, rsi
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret