Function at 0x140032350
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x1400ce038]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rsi, rcx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
mov qword [rcx + 0x48], rdx
mov qword [rbp + 0x60], 0x11c
mov qword [rbp + 0x68], r13
mov dword [rbp + 0x70], r13d
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x74]
call fcn.140059b20
mov dword [rbp + 0x174], r13d
mov dword [rbp + 0x178], 0x10000
mov r8b, 1
mov edx, 0x80
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8, rax
mov edx, 0x80
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
sete al
mov byte [rsi + 0x5c], al
xor r12b, r12b
mov r15d, r13d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [r13 + 1]
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rdi, [r13 - 1]
test eax, eax
jne 0x14003261c
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.CurrentMajorVersionNumber
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003260e
cmp dword [rsp + 0x44], 4
jne 0x14003260e
mov eax, dword [rsp + 0x48]
mov dword [rsi + 0x50], eax
mov dword [rsp + 0x48], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.CurrentMinorVersionNumber
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003260e
cmp dword [rsp + 0x44], 4
jne 0x14003260e
mov eax, dword [rsp + 0x40]
mov dword [rsi + 0x54], eax
mov dword [rsp + 0x40], 0xa
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x180]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.CurrentBuildNumber
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14003260e
cmp dword [rsp + 0x48], 1
jne 0x14003260e
mov eax, dword [rsp + 0x40]
cmp rax, 0xb
jae 0x140032b30
mov byte [rbp + rax + 0x180], r12b
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], r12b
lea rax, [rbp + 0x180]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140032551
lea rdx, [rbp + 0x180]
lea rcx, [rbp - 0x68]
call fcn.140008010
nop
lea rdx, [rsp + 0x44]
lea rcx, [rbp - 0x68]
call fcn.140049dd0
movzx r14d, al
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x1400325b9
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400325b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032b24
call fcn.140057468
test r14b, r14b
je 0x14003260e
mov eax, dword [rsp + 0x44]
mov dword [rsi + 0x58], eax
mov dword [rsp + 0x48], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, [0x1400a02a8]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003260e
cmp dword [rsp + 0x44], 4
jne 0x14003260e
mov r15d, dword [rsp + 0x40]
mov r12b, 1
test rbx, rbx
je 0x14003261c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r13w
lea rdx, str.kernel32.dll
nop dword [rax + rax]
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x140032640
mov r8, rdi
lea rcx, [rbp - 0x68]
call fcn.140031800
nop
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 8]
call fcn.14004cb00
nop
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140049f70
movzx ebx, al
lea rcx, [rbp - 8]
call fcn.140030ea0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x1400326bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400326ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032b2a
call fcn.140057468
test bl, bl
je 0x140032aee
mov edx, dword [rsp + 0x7c]
lea rcx, [rbp + 0x38]
call fcn.1400320a0
nop
mov eax, dword [rbp - 0x80]
and eax, 0x40004
mov qword [rbp - 0x30], 0xf
mov ebx, 8
mov dword [rsp + 0x40], ebx
cmp eax, 0x40004
jne 0x14003271b
mov qword [rbp - 0x38], 0xa
movsd xmm0, qword [str.Windows_NT]
movsd qword [rbp - 0x48], xmm0
movzx eax, word [0x1400a0188]
mov word [rbp - 0x40], ax
mov byte [rbp - 0x3e], 0
jmp 0x140032749
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x38], 7
mov eax, dword [str.Unknown]
mov dword [rbp - 0x48], eax
movzx eax, word [0x1400a0194]
mov word [rbp - 0x44], ax
movzx eax, byte [0x1400a0196]
mov byte [rbp - 0x42], al
mov byte [rbp - 0x41], 0
test r12b, r12b
jne 0x140032770
mov ecx, dword [rsp + 0x68]
mov eax, ecx
shr eax, 0x10
mov dword [rsi + 0x50], eax
movzx eax, cx
mov dword [rsi + 0x54], eax
mov ecx, dword [rsp + 0x6c]
mov eax, ecx
shr eax, 0x10
mov dword [rsi + 0x58], eax
movzx r15d, cx
mov r8d, r15d
lea rdx, [0x1400a02b0]
lea rcx, [rbp - 8]
call fcn.14004f190
lea rdi, [rsi + 0x28]
mov rdx, rax
mov rcx, rdi
call fcn.14000a5e0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x1400327cd
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400327c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032b36
call fcn.140057468
mov r8, qword [rbp + 0x48]
test r8, r8
jne 0x1400327e2
lea rdx, [0x1400977f3]
jmp 0x1400328ea
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x30], 0xf
mov qword [rbp + 0x28], 2
mov eax, 0x2820
mov word [rbp + 0x18], ax
mov byte [rbp + 0x1a], 0
mov dword [rsp + 0x40], 9
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rdx, qword [rbp + 0x38]
lea rcx, [rbp + 0x18]
call fcn.140007f80
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x40], 0x1b
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140032889
lea rax, [rcx + 1]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x28]
cmp rdx, 0x10
cmovae rax, qword [rbp - 0x28]
mov word [rax + rcx], 0x29
lea rax, [rbp - 0x28]
jmp 0x1400328a9
mov qword [rsp + 0x20], 1
lea r9, [0x140098da0]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x28]
call fcn.140002040
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov ebx, 0x3f
mov dword [rsp + 0x40], ebx
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rdx, qword [rbp - 0x68]
cmp qword [rdi + 0x18], 0x10
jb 0x1400328f4
mov rdi, qword [rdi]
mov eax, dword [rsi + 0x58]
mov ecx, dword [rsi + 0x54]
lea r8, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae r8, qword [rbp - 0x48]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsi + 0x50]
lea rdx, str._s__u._u._u._s_s
lea rcx, [rbp - 8]
call fcn.14004f190
lea rcx, [rsi + 8]
mov rdx, rax
call fcn.14000a5e0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x140032975
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032970
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032b3c
call fcn.140057468
mov qword [rbp + 8], r13
mov qword [rbp + 0x10], 0xf
mov byte [rbp - 8], 0
test bl, 4
je 0x1400329d8
and ebx, 0xfffffffb
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x1400329c8
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400329c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032b42
call fcn.140057468
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
test bl, 2
je 0x140032a2b
and ebx, 0xfffffffd
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140032a1b
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032a16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032b48
call fcn.140057468
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
test bl, 1
je 0x140032a6c
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x140032a6c
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032a66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032b4e
call fcn.140057468
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140032aa7
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032aa2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032b54
call fcn.140057468
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x140032aee
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032ae9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032b1e
call fcn.140057468
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140057820
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14005da04
nop
call fcn.14005da04
nop
call fcn.14005da04
nop
call fcn.14005797c
nop
call fcn.14005da04
nop
call fcn.14005da04
nop
call fcn.14005da04
nop
call fcn.14005da04
nop
call fcn.14005da04
nop
call fcn.14005da04
int3