Function at 0x1400233d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x420
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x140108020]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
mov r15, rcx
mov qword [rsp + 0x38], rcx
xor esi, esi
mov dword [rsp + 0x30], esi
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14010c2d0], eax
jle 0x140023480
lea rcx, [0x14010c2d0]
call fcn.1400555cc
cmp dword [0x14010c2d0], 0xffffffff
jne 0x140023480
xorps xmm0, xmm0
movups xmmword [0x14010c2e0], xmm0
mov qword [0x14010c2f0], rsi
mov qword [0x14010c2f8], 0xf
mov byte [0x14010c2e0], sil
lea rcx, [0x14007fdd0]
call fcn.14005587c
lea rcx, [0x14010c2d0]
call fcn.140055560
cmp qword [0x14010c2f0], rsi
je 0x14002349d
lea rdx, [0x14010c2e0]
mov rcx, r15
call fcn.14000c920
jmp 0x140023f32
xorps xmm0, xmm0
movups xmmword [rsp + 0x1a8], xmm0
mov qword [rsp + 0x1b8], rsi
mov qword [rsp + 0x1c0], SafeArrayUnaccessData
mov byte [rsp + 0x1a8], sil
lea rcx, [rsp + 0x180]
call fcn.140022e70
mov rbx, rax
lea rax, [rsp + 0x1a8]
cmp rax, rbx
je 0x14002356a
mov rdx, qword [rsp + 0x1c0]
cmp rdx, 0x10
jb 0x140023528
inc rdx
mov rcx, qword [rsp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023523
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023f6d
call fcn.140055894
mov qword [rsp + 0x1b8], rsi
mov qword [rsp + 0x1c0], SafeArrayUnaccessData
mov byte [rsp + 0x1a8], 0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x1a8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x1b8], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rsp + 0x198]
cmp rdx, 0x10
jb 0x1400235ae
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400235a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023f6d
call fcn.140055894
nop
jmp 0x1400235b7
mov dword [rsp + 0x1e8], 0x200
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rsi
mov r8d, 0x59
lea rdx, str.QU1RoaE9XzOHFG5QjJjcY1pFVNnFIYVh_OZQhBza3IG8U1N3ZdQNx4fXxY4f2cOcXHZywAlRTvanUOAcX1hKUQ
lea rcx, [rsp + 0x80]
call fcn.140010020
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x100]
call fcn.140028b40
mov rdx, rax
mov edi, 2
mov dword [rsp + 0x30], edi
cmp qword [rax + 0x18], 0x10
jb 0x140023622
mov rdx, qword [rax]
mov r12, 0xffffffffffffffff
mov rax, r12
nop dword [rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x140023630
lea rcx, [rsp + 0x1a8]
cmp qword [rsp + 0x1c0], 0x10
cmovae rcx, qword [rsp + 0x1a8]
mov rbx, qword [rsp + 0x1b8]
cmp rbx, rax
jne 0x140023670
mov r8, rbx
call fcn.140058520
test eax, eax
je 0x140023867
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], rsi
mov r8d, 0x59
lea rdx, str.RkRolMUxv7TkJ26eGUw6aHg1aNnd2fWwV5MWXl6lW0lX4A1xViAABxJfEUIFfC4MabzU8nIXUtXPnR3iBAYrycg
lea rcx, [rsp + 0xa0]
call fcn.140010020
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x160]
call fcn.140028b40
mov rdx, rax
mov edi, 6
mov dword [rsp + 0x30], edi
cmp qword [rax + 0x18], 0x10
jb 0x1400236d0
mov rdx, qword [rax]
mov rax, r12
inc rax
cmp byte [rdx + rax], 0
jne 0x1400236d3
lea rcx, [rsp + 0x1a8]
cmp qword [rsp + 0x1c0], 0x10
cmovae rcx, qword [rsp + 0x1a8]
mov rbx, qword [rsp + 0x1b8]
cmp rbx, rax
jne 0x140023713
mov r8, rbx
call fcn.140058520
test eax, eax
je 0x140023867
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xd8], rsi
mov r8d, 0x59
lea rdx, str.bEZLCY1BrucnNzvNE1YQcWJLyT1x2ne1NgSW0JDUXgR9kaEFPPe39cidmZTTYFtCHXkMEVfWhBLUnt_XXHZ73Uw
lea rcx, [rsp + 0xc0]
call fcn.140010020
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x140]
call fcn.140028b40
mov rdx, rax
mov edi, 0xe
mov dword [rsp + 0x30], edi
cmp qword [rax + 0x18], 0x10
jb 0x140023773
mov rdx, qword [rax]
mov rax, r12
inc rax
cmp byte [rdx + rax], 0
jne 0x140023776
lea rcx, [rsp + 0x1a8]
cmp qword [rsp + 0x1c0], 0x10
cmovae rcx, qword [rsp + 0x1a8]
mov rbx, qword [rsp + 0x1b8]
cmp rbx, rax
jne 0x1400237b6
mov r8, rbx
call fcn.140058520
test eax, eax
je 0x140023867
xorps xmm0, xmm0
movups xmmword [rsp + 0xe0], xmm0
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xf8], rsi
mov r8d, 0x59
lea rdx, str.ZGJMAQzcxBYkZi0ak1CJRVk0ucCIkmCgVx4dyQA0TywLYBAN0ncjYiYJGEFNcXckCayQsZCwQDAH3I2jIiQKzBQ
lea rcx, [rsp + 0xe0]
call fcn.140010020
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x120]
call fcn.140028b40
mov rdx, rax
mov edi, 0x1e
mov dword [rsp + 0x30], edi
cmp qword [rax + 0x18], 0x10
jb 0x140023816
mov rdx, qword [rax]
mov rax, r12
nop dword [rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x140023820
lea rcx, [rsp + 0x1a8]
cmp qword [rsp + 0x1c0], 0x10
cmovae rcx, qword [rsp + 0x1a8]
mov rbx, qword [rsp + 0x1b8]
cmp rbx, rax
jne 0x14002385c
mov r8, rbx
call fcn.140058520
test eax, eax
je 0x140023867
cmp rbx, 0x24
jne 0x140023867
xor r14b, r14b
jmp 0x14002386a
mov r14b, 1
test dil, 0x10
je 0x1400238db
and edi, 0xffffffef
mov dword [rsp + 0x30], edi
mov rdx, qword [rsp + 0x138]
cmp rdx, 0x10
jb 0x1400238c2
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400238b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023f73
call fcn.140055894
mov rbx, qword [rsp + 0x1b8]
movdqa xmm0, xmmword [0x1400fa040]
movdqu xmmword [rsp + 0x130], xmm0
mov byte [rsp + 0x120], 0
test dil, 8
je 0x14002394c
and edi, 0xfffffff7
mov dword [rsp + 0x30], edi
mov rdx, qword [rsp + 0x158]
cmp rdx, 0x10
jb 0x140023933
inc rdx
mov rcx, qword [rsp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023926
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023f79
call fcn.140055894
mov rbx, qword [rsp + 0x1b8]
movdqa xmm0, xmmword [0x1400fa040]
movdqu xmmword [rsp + 0x150], xmm0
mov byte [rsp + 0x140], 0
test dil, 4
je 0x1400239bd
and edi, 0xfffffffb
mov dword [rsp + 0x30], edi
mov rdx, qword [rsp + 0x178]
cmp rdx, 0x10
jb 0x1400239a4
inc rdx
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023997
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023f7f
call fcn.140055894
mov rbx, qword [rsp + 0x1b8]
movdqa xmm0, xmmword [0x1400fa040]
movdqu xmmword [rsp + 0x170], xmm0
mov byte [rsp + 0x160], 0
test dil, 2
je 0x140023a0e
mov rdx, qword [rsp + 0x118]
cmp rdx, 0x10
jb 0x140023a0e
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023a01
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023f85
call fcn.140055894
mov rbx, qword [rsp + 0x1b8]
test r14b, r14b
je 0x140023d19
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov r8d, 0x4f
lea rdx, str.M1V6pbG82jWE9vrdnNxSaFVHicWAapPDg43dwoK5MzsafEho66NB5V9ISYvGHU8ovOwARmARAYYPT4
lea rcx, [rsp + 0x60]
call fcn.14000fb50
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140028fb0
nop
mov rdx, qword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x1c8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1d8], xmm1
mov r8, r12
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140023a70
lea rcx, [rsp + 0x1c8]
call fcn.14000fb50
lea rdx, [rsp + 0x1c8]
cmp qword [rsp + 0x1e0], 8
cmovae rdx, qword [rsp + 0x1c8]
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdx, qword [rsp + 0x1e0]
cmp rdx, 8
jb 0x140023b0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023b08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023f8b
call fcn.140055894
movdqa xmm0, xmmword [0x1400fa030]
movdqu xmmword [rsp + 0x1d8], xmm0
mov word [rsp + 0x1c8], si
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140023b45
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsp + 0x1e8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ec]
xor r8d, r8d
lea rdx, str.MachineGuid
mov rcx, qword [rsp + 0x1a0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xorps xmm0, xmm0
test eax, eax
je 0x140023c36
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov r8d, 0x59
lea rdx, str.ZDZaTRmhTSVTFBRT2l6oWE9TOMVQGQanZYSY2UB5bH9ZYSmhiGYwFUYBnd2TWGNlUHHF_aWUpoof2MBOVAZqTdjA
lea rcx, [rsp + 0x60]
call fcn.140010020
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x100]
call fcn.140028b40
nop
cmp qword [rax + 0x18], 0x10
jb 0x140023bcd
mov rax, qword [rax]
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x140023bd0
mov rdx, rax
lea rcx, [rsp + 0x1a8]
call fcn.14000f110
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 0x10
jb 0x140023d03
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023cfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023f91
jmp 0x140023cfe
movups xmmword [rsp + 0x1c8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1d8], xmm1
lea rax, [rsp + 0x1f0]
mov r8, r12
inc r8
cmp word [rax + r8*2], 0
jne 0x140023c55
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x1c8]
call fcn.14000fb50
nop
lea rdx, [rsp + 0x1c8]
cmp qword [rsp + 0x1e0], 8
cmovae rdx, qword [rsp + 0x1c8]
mov rax, qword [rsp + 0x1d8]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x1c8]
cmovae rdx, qword [rsp + 0x1c8]
lea rcx, [rsp + 0x1a8]
call fcn.14002cfe0
nop
mov rdx, qword [rsp + 0x1e0]
cmp rdx, 8
jb 0x140023d03
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023cfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023f97
call fcn.140055894
mov rcx, qword [rsp + 0x1a0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x1b8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea r14, [rsp + 0x1a8]
cmp qword [rsp + 0x1c0], 0x10
cmovae r14, qword [rsp + 0x1a8]
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x140023f9d
cmp rbx, 0x10
jae 0x140023d7b
mov qword [rsp + 0x50], rbx
mov edx, 0xf
mov qword [rsp + 0x58], rdx
movups xmm6, xmmword [r14]
movups xmmword [rsp + 0x40], xmm6
jmp 0x140023e1e
mov qword [rsp + 0x58], SafeArrayUnaccessData
mov rax, rbx
or rax, 0xf
cmp rax, rdi
ja 0x140023d9f
mov rdi, rax
mov ecx, SafeArrayUnaccessData
cmp rax, rcx
cmovb rdi, rcx
mov rcx, rdi
add rcx, 1
cmovb rcx, r12
cmp rcx, 0x1000
jb 0x140023de2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140023fa3
mov rcx, rax
call fcn.1400558c8
mov rcx, rax
test rax, rax
je 0x140023fa9
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140023df1
test rcx, rcx
je 0x140023dee
call fcn.1400558c8
jmp 0x140023df1
mov rax, rsi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
lea r8, [rbx + 1]
mov rdx, r14
mov rcx, rax
call fcn.140057a20
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
movups xmm6, xmmword [rsp + 0x40]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rdi, [rsp + 0x40]
movq rcx, xmm6
cmp rdx, 0x10
cmovae rdi, rcx
lea r14, [rsp + 0x40]
cmovae r14, rcx
add r14, rbx
lea rbx, [rsp + 0x40]
cmp rdx, 0x10
cmovae rbx, rcx
cmp rbx, r14
je 0x140023e78
sub rdi, rbx
nop dword [rax + rax]
movsx ecx, byte [rbx]
call fcn.14005fdf8
mov byte [rbx + rdi], al
inc rbx
cmp rbx, r14
jne 0x140023e60
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], SafeArrayUnaccessData
mov byte [rsp + 0x40], 0
mov rdx, qword [0x14010c2f8]
cmp rdx, 0x10
jb 0x140023ed1
inc rdx
mov rcx, qword [0x14010c2e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023ecc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023fa9
call fcn.140055894
movups xmmword [0x14010c2e0], xmm6
movups xmmword [0x14010c2f0], xmm7
lea rdx, [0x14010c2e0]
mov rcx, r15
call fcn.14000c920
nop
mov rdx, qword [rsp + 0x1c0]
cmp rdx, 0x10
jb 0x140023f32
inc rdx
mov rcx, qword [rsp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023f2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023faf
call fcn.140055894
mov rax, r15
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.140055540
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r12
ret
call fcn.14005c3e8
nop
call fcn.14005c3e8
nop
call fcn.14005c3e8
nop
call fcn.14005c3e8
nop
call fcn.14005c3e8
nop
call fcn.14005c3e8
nop
call fcn.14005c3e8
int3
call fcn.14005c3e8
int3
call fcn.1400025b0
int3
call fcn.140002510
int3
call fcn.14005c3e8
nop
call fcn.14005c3e8
int3