Function at 0x1400c9490
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
cmp rbx, rdi
je 0x1400c94f7
add rbx, 0xffffffffffffffd0
jmp 0x1400c94d7
mov rcx, qword [rbx]
call fcn.1401abf3c
lea rax, [rbx - 0x30]
cmp rbx, rdi
mov rbx, rax
je 0x1400c94f7
test rbx, rbx
je 0x1400c9657
cmp byte [rbx + 0x2f], 0
jns 0x1400c94ef
mov rcx, qword [rbx + 0x18]
call fcn.1401abf3c
cmp byte [rbx + 0x17], 0
jns 0x1400c94cb
jmp 0x1400c94c3
mov qword [rsi + 8], rdi
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x60]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1402af0f0]
movaps xmmword [rdi], xmm0
lea r8, str.SYSTEMCurrentControlSetControlSession_Manager
mov rcx, rdi
mov rdx, 0xffffffff80000002
mov r9d, 1
call fcn.1400ef890
mov rdi, qword [rdi]
test rdi, rdi
je 0x1400c968a
mov dword [rsp + 0x5c], 0
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov edx, 1
mov rcx, rbx
call fcn.140177160
mov dword [rsp + 0x3c], 0xaaaaaaaa
mov rax, qword [rbx]
cmp qword [rbx + 8], rax
je 0x1400c96e2
lea r14, [rsp + 0x5c]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x3c]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x1400c9683
cmp eax, 0xea
jne 0x1400c962c
mov ebx, 0x8000ffff
cmp dword [rsp + 0x3c], 7
jne 0x1400c963a
mov ecx, dword [rsp + 0x5c]
test cl, 1
jne 0x1400c963a
mov rax, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov r9, r8
sub r9, rax
mov rdx, rcx
sub rdx, r9
jbe 0x1400c970e
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.140177160
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
cmp rcx, rax
je 0x1400c96e2
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x3c]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400c96b8
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400c968f
mov rax, qword [rsp + 0x48]
mov rdx, rax
sub rdx, rcx
dec rax
cmp rdx, rax
jbe 0x1400c96d6
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x44
call fcn.1401f6bb0
mov ebx, 0x80070002
jmp 0x1400c963a
mov ebx, 0x80070002
lea rcx, [rsp + 0x60]
call fcn.1400efb30
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401ad700
mov eax, ebx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
sub rdx, rcx
je 0x1400c96e2
mov r8, rsi
call fcn.1401f81d0
mov ebx, eax
jmp 0x1400c963a
mov qword [rsp + 0x48], rcx
call fcn.1401abf3c
jmp 0x1400c968f
lea rax, str.vector___index_out_of_bounds
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_vector
lea r9, str.__n___size__
mov r8d, 0x601
call fcn.1401f6bb0
jb 0x1400c9718
mov rcx, r8
jmp 0x1400c95f9
add rcx, rax
mov rdx, r8
sub rdx, rcx
dec r8
cmp rdx, r8
ja 0x1400c9657
mov qword [rsp + 0x48], rcx
jmp 0x1400c95f9