Function at 0x140002d70
Capabilities:
Query or enumerate registry value
Reference http user-agent string

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x468]
sub rsp, 0x568
xor edi, edi
cmp byte [0x140006010], dil
je 0x140002d9e
mov al, 1
jmp 0x140003326
lea rdx, [0x140004780]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x30]
mov qword [rbp - 0x80], rdi
xorps xmm0, xmm0
mov qword [rbp - 0x78], rax
mov esi, 0x30
mov dword [rbp - 0x70], 0x40
lea r8, [rsp + 0x78]
mov dword [rsp + 0x78], esi
mov edx, 0xf003f
lea rcx, [rbp + 0x4c0]
movdqu xmmword [rbp - 0x68], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
lea ebx, [rsi - 0x2e]
test eax, eax
jne 0x14000317b
lea rdx, [0x1400047e0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp + 0x4c0]
lea rax, [rbp + 0x4b8]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x20], edi
mov r8d, ebx
mov dword [rbp + 0x4b8], edi
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
jns 0x140002e47
cmp dword [rbp + 0x4b8], edi
je 0x14000317b
mov edx, dword [rbp + 0x4b8]
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov ecx, dword [rbp + 0x4b8]
lea rdx, [rsp + 0x30]
mov r14, rax
mov r8d, ebx
lea rax, [rbp + 0x4b8]
mov r9, r14
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, qword [rbp + 0x4c0]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov rcx, qword [rbp + 0x4c0]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
js 0x14000316b
cmp dword [r14 + 4], 1
jne 0x14000316b
lea rdx, [r14 + 0xc]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, 1
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
mov eax, 0x10
cmp ax, word [rsp + 0x40]
jne 0x140003160
mov r13, qword [rsp + 0x48]
mov qword [rbp + 0x4c8], r13
mov dword [rbp + 0x4b0], edi
movzx eax, byte [r13]
lea ebx, [rax + rax*4]
movzx eax, byte [r13 + 1]
lea ebx, [rbx - 0x108]
lea ebx, [rax + rbx*2]
mov eax, 0x2aaaaaab
imul ebx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ebx, eax
inc ebx
lea eax, [rbx - 1]
cmp eax, 0xb
ja 0x140003160
lea rcx, [rsp + 0x68]
call fcn.1400034a4
movsx eax, word [rsp + 0x6a]
cmp eax, ebx
jne 0x140003160
mov eax, ebx
lea r12, [r13 + 2]
and al, 1
lea r15, [rbp + 0x4b0]
neg al
mov r13d, 3
sbb sil, sil
and sil, 0xf0
add sil, 0x20
mov edx, 2
mov rcx, r12
call fcn.1400034f0
sub al, sil
add r12, 2
mov byte [r15], al
inc r15
sub r13, 1
jne 0x140002f64
cmp ebx, 7
jg 0x140002ff1
je 0x140002fe8
mov ecx, ebx
sub ecx, 1
je 0x140002fdf
sub ecx, 1
je 0x140002fd6
sub ecx, 1
je 0x140002fcd
sub ecx, 1
je 0x140002fc4
sub ecx, 1
je 0x140002fbb
cmp ecx, 1
jne 0x140003160
lea rdx, [0x140004850]
jmp 0x14000303b
lea rdx, [0x140004840]
jmp 0x14000303b
lea rdx, [0x140004830]
jmp 0x14000303b
lea rdx, [0x140004820]
jmp 0x14000303b
lea rdx, [0x140004810]
jmp 0x14000303b
lea rdx, [0x140004800]
jmp 0x14000303b
lea rdx, [0x140004860]
jmp 0x14000303b
mov ecx, ebx
sub ecx, 8
je 0x140003034
sub ecx, 1
je 0x14000302b
sub ecx, 1
je 0x140003022
sub ecx, 1
je 0x140003019
cmp ecx, 1
jne 0x140003160
lea rdx, [0x1400048b0]
jmp 0x14000303b
lea rdx, [0x1400048a0]
jmp 0x14000303b
lea rdx, [0x140004890]
jmp 0x14000303b
lea rdx, [0x140004880]
jmp 0x14000303b
lea rdx, [0x140004870]
lea rcx, [rbp + 0x4b0]
call sub.ntoskrnl.exe_strcmp
test eax, eax
jne 0x140003160
mov rsi, qword [rbp + 0x4c8]
lea edx, [rax + 4]
lea rcx, [rsi + 8]
call fcn.1400034f0
lea ecx, [rbx - 1]
mov r10d, eax
movzx edx, cl
bt r10w, dx
jae 0x140003160
mov r9d, 0x8000
lea ecx, [rbx - 1]
mov edx, r9d
shr dx, cl
test r10w, dx
je 0x140003160
mov r8d, 0xc
mov eax, r8d
sub eax, ebx
movzx ecx, al
bt r10w, cx
jb 0x140003160
mov eax, r8d
sub al, bl
mov cl, al
shr r9w, cl
test r10w, r9w
jne 0x140003160
xorps xmm2, xmm2
mov rax, rdi
movd xmm1, dword [rax + rsi]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
add rax, 4
punpcklwd xmm1, xmm0
paddd xmm1, xmm2
movdqa xmm2, xmm1
cmp rax, r8
jl 0x1400030c3
movdqa xmm0, xmm1
mov eax, 0x97247453
psrldq xmm0, 8
paddd xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
paddd xmm2, xmm0
movd r9d, xmm2
shl r9d, 0xa
imul r9d
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x2710
add r9d, eax
movzx ecx, byte [r8 + rsi]
lea eax, [rdi + rdi*4]
inc r8
lea edi, [rax - 0x18]
lea edi, [rcx + rdi*2]
cmp r8, 0x10
jl 0x140003122
cmp edi, r9d
jne 0x140003160
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov byte [0x140006010], 1
jmp 0x140002d97
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140003324
movups xmm0, xmmword [0x1400048c0]
lea rcx, [rbp - 0x58]
movups xmm1, xmmword [0x1400048d0]
mov r8, rsi
mov al, byte [0x140004930]
xor edx, edx
movups xmmword [rbp - 0x20], xmm0
movups xmm0, xmmword [0x1400048e0]
movups xmmword [rbp], xmm0
movups xmm0, xmmword [0x140004900]
movups xmmword [rbp - 0x10], xmm1
movups xmm1, xmmword [0x1400048f0]
movups xmmword [rbp + 0x20], xmm0
movups xmm0, xmmword [0x140004920]
movups xmmword [rbp + 0x10], xmm1
movups xmm1, xmmword [0x140004910]
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x30], xmm1
mov byte [rbp + 0x50], al
call fcn.1400044c0
lea r9, [rsp + 0x50]
mov qword [rbp - 0x58], rbx
lea r8, [rbp - 0x58]
mov dword [rbp - 0x50], 1
lea rdx, [0x140004940]
lea rcx, [0x140004950]
call fcn.1400023d8
mov edx, 1
mov ecx, ebx
lea r8d, [rdx + 5]
call fcn.140002554
mov rdx, qword [rsp + 0x50]
mov ecx, eax
mov esi, eax
mov r8d, dword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
call fcn.1400023b0
cmp eax, 0xffffffff
je 0x14000331d
xor r9d, r9d
lea rdx, [rbp - 0x20]
mov ecx, esi
lea r8d, [r9 + 0x71]
call fcn.140002520
test eax, eax
jle 0x14000331d
xor edx, edx
lea rcx, [rbp + 0x60]
mov r8d, 0x400
mov rbx, rdi
call fcn.1400044c0
mov r14d, edi
mov r13d, edi
xor r9d, r9d
lea rdx, [rbp + 0x60]
mov r8d, 0x400
mov ecx, esi
call fcn.1400024ec
movsxd r15, eax
test eax, eax
jle 0x1400032d6
add r14d, r15d
xor ecx, ecx
mov edx, r14d
mov r8d, 0x5a594e42
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r12, rax
test rbx, rbx
je 0x1400032bc
mov r8d, r13d
mov rdx, rbx
mov rcx, rax
call fcn.140004180
mov edx, 0x5a594e42
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, r13d
lea rdx, [rbp + 0x60]
add rcx, r12
mov r8, r15
mov rbx, r12
call fcn.140004180
mov r13d, r14d
jmp 0x140003269
mov edx, r14d
lea r8, [0x140004970]
mov rcx, rbx
call fcn.140003440
test eax, eax
js 0x14000330f
cdqe
cmp byte [rax + rbx + 0xa], 0x31
jne 0x14000330f
mov edx, 0x5a594e42
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, esi
call fcn.140002378
jmp 0x140003154
mov edx, 0x5a594e42
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, esi
call fcn.140002378
xor al, al
add rsp, 0x568
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret