Function at 0x14001c800
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8b0]
sub rsp, 0x9b0
mov rax, qword [0x1401198e8]
xor rax, rsp
mov qword [rbp + 0x8a0], rax
mov r13, r9
mov r12, r8
mov qword [rbp - 0x38], r8
mov r15, rdx
mov qword [rbp - 0x40], rdx
movzx r14d, byte [rbp + 0x910]
xor ebx, ebx
mov edi, ebx
mov dword [rsp + 0x30], ebx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rax
test r14b, r14b
je 0x14001c871
mov r8, rdx
jmp 0x14001c8f8
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x14001d2a5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.1400062d0
test al, al
jne 0x14001c8ce
test r15, r15
jne 0x14001c8ab
mov eax, ebx
jmp 0x14001c8bd
mov rax, 0xffffffffffffffff
inc rax
cmp word [r15 + rax*2], 0
jne 0x14001c8b2
mov r8d, eax
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.1400068f0
nop
mov dword [rsp + 0x30], 1
lea r8, str.AutorunsDisabled
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x48]
call fcn.140006020
nop
mov edi, 3
mov dword [rsp + 0x30], edi
mov r8, qword [rax]
mov rdx, 0xffffffff80000002
mov r9d, 0x20019
lea rcx, [rbp + 0x80]
call fcn.140027410
nop
test dil, 2
je 0x14001c943
and edi, 0xfffffffd
mov dword [rsp + 0x30], edi
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001c93f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov edi, dword [rsp + 0x30]
test dil, 1
je 0x14001c975
and edi, 0xfffffffe
mov dword [rsp + 0x30], edi
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001c971
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov edi, dword [rsp + 0x30]
lea rsi, vtable.std::_Ref_count_obj2_struct_AutorunsEntry_.0
test r14b, r14b
je 0x14001cdc9
mov ecx, 0x148
call fcn.14009bfa8
mov r14, rax
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
mov qword [rax], rsi
lea rsi, [rax + 0x10]
xor edx, edx
mov r8d, 0x138
mov rcx, rsi
call fcn.14009e880
mov rcx, rsi
call fcn.140007090
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
or edi, 0x10
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x58], r14
mov dword [rsi + 0x118], 0x1080
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 1
mov qword [rbp - 0x18], 7
mov eax, dword [0x1400eff20]
mov word [rbp - 0x30], ax
mov word [rbp - 0x2e], bx
mov r9d, 4
lea r8, str.HKLM
lea rcx, [rbp - 0x30]
call fcn.140006ee0
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
or edi, 0x20
mov r8, 0xffffffffffffffff
inc r8
cmp word [r15 + r8*2], 0
jne 0x14001ca55
mov rdx, r15
lea rcx, [rbp - 0x68]
call fcn.140006fe0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
or edi, 0x40
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rax, r8
sub rax, rdx
lea rcx, [rsp + 0x48]
cmp rax, 1
jb 0x14001cae5
lea rax, [rdx + 1]
mov qword [rsp + 0x58], rax
cmp r8, 8
cmovae rcx, qword [rsp + 0x48]
mov eax, dword [0x1400eff20]
mov word [rcx + rdx*2], ax
mov word [rcx + rdx*2 + 2], bx
lea rax, [rsp + 0x48]
jmp 0x14001cb05
mov qword [rsp + 0x20], 1
lea r9, [0x1400eff20]
movzx r8d, byte [rsp + 0x38]
mov edx, 1
call fcn.140007950
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
bts edi, 7
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [r12 + r8*2], 0
jne 0x14001cb40
mov rdx, r12
lea rcx, [rsp + 0x78]
call fcn.140006fe0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
bts edi, 8
mov dword [rsp + 0x30], edi
lea rdx, [rbp - 0x10]
mov rcx, rsi
call fcn.140005f80
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x14001cbcb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cbc5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d2b0
call fcn.14009bfe4
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x14001cc0c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cc07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d2b6
call fcn.14009bfe4
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], bx
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14001cc5f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cc5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d2bc
call fcn.14009bfe4
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bx
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x14001ccb2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ccad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d2c2
call fcn.14009bfe4
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], bx
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001cd02
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ccfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d2c8
call fcn.14009bfe4
mov rbx, qword [rbp + 0x80]
test rbx, rbx
je 0x14001cd1d
mov rcx, rbx
call fcn.14002d4a0
mov qword [rsi + 0xa0], rax
mov rdx, qword [r13 + 8]
cmp rdx, qword [r13 + 0x10]
je 0x14001cd3e
mov qword [rdx], rsi
mov qword [rdx + 8], r14
xor eax, eax
mov r9d, eax
mov qword [rbp + 0x58], rax
add qword [r13 + 8], 0x10
jmp 0x14001cd4e
lea r8, [rbp + 0x50]
mov rcx, r13
call fcn.1400071a0
mov r9, qword [rbp + 0x58]
mov r8, qword [r13 + 8]
sub r8, qword [r13]
sar r8, 4
mov edx, 0x78
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov qword [rdx + rcx], r8
test r9, r9
je 0x14001cdb4
mov eax, 0xffffffff
lock xadd dword [r9 + 8], eax
cmp eax, 1
jne 0x14001cda9
mov rbx, qword [rbp + 0x58]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14001cda9
mov rcx, qword [rbp + 0x58]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rbp + 0x80]
mov edi, dword [rsp + 0x30]
movzx r14d, byte [rbp + 0x910]
test rbx, rbx
jne 0x14001cdd2
xor dil, dil
jmp 0x14001d263
mov rbx, qword [rbp + 0x80]
jmp 0x14001cdbc
mov dword [rbp + 0x30], 0x800
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x48]
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d205
cmp dword [rbp + 0x48], 7
jne 0x14001d205
mov ecx, dword [rbp + 0x30]
test cl, 1
jne 0x14001d205
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x14001d205
shr rcx, 1
cmp word [rbp + rcx*2 + 0x9e], 0
jne 0x14001d205
cmp eax, 1
jbe 0x14001ce52
cmp word [rbp + rcx*2 + 0x9c], 0
jne 0x14001d205
lea rsi, [rbp + 0xa0]
cmp word [rbp + 0xa0], 0
je 0x14001d205
movzx ebx, byte [rsp + 0x38]
xor r15d, r15d
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], r15
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rsi + r8*2], 0
jne 0x14001ce90
mov rdx, rsi
lea rcx, [rbp + 0x60]
call fcn.140003860
nop
cmp qword [rbp + 0x70], 2
jbe 0x14001d184
mov ecx, 0x148
call fcn.14009bfa8
mov r12, rax
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_struct_AutorunsEntry_.0
mov qword [r12], rax
lea r15, [r12 + 0x10]
xor edx, edx
mov r8d, 0x138
mov rcx, r15
call fcn.14009e880
mov rcx, r15
call fcn.140007090
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
or edi, 4
mov dword [rsp + 0x30], edi
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x40], r12
movzx eax, r14b
xor eax, 1
add eax, eax
bts eax, 0xd
mov dword [r15 + 0x118], eax
mov r8, 0xffffffffffffffff
inc r8
cmp word [rsi + r8*2], 0
jne 0x14001cf32
mov rdx, rsi
mov rcx, r15
call fcn.140003510
lea rcx, [r15 + 0x80]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rsi + r8*2], 0
jne 0x14001cf60
mov rdx, rsi
call fcn.140003510
lea rdx, [rbp + 0x60]
mov r9, qword [rbp + 0x78]
cmp r9, 8
setae r11b
mov r10, qword [rbp + 0x60]
cmovae rdx, r10
mov r8, qword [rbp + 0x70]
test r8, r8
je 0x14001cfcb
lea rcx, [r8 - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x2e
je 0x14001cfbf
cmp rcx, rdx
je 0x14001cfcb
sub rcx, 2
cmp word [rcx], 0x2e
jne 0x14001cfb0
sub rcx, rdx
sar rcx, 1
cmp rcx, 0xffffffffffffffff
jne 0x14001d01a
sub r9, r8
lea rcx, [rbp + 0x60]
cmp r9, 4
jb 0x14001cffc
lea rax, [r8 + 4]
mov qword [rbp + 0x70], rax
test r11b, r11b
cmovne rcx, r10
mov rax, qword [str..dll]
mov qword [rcx + r8*2], rax
xor eax, eax
mov word [rcx + r8*2 + 8], ax
jmp 0x14001d01a
mov qword [rsp + 0x20], 4
lea r9, str..dll
movzx r8d, bl
mov edx, 4
call fcn.140007950
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x10]
call fcn.14002c0f0
mov r14, rax
lea rdi, [r15 + 0x60]
cmp rdi, rax
je 0x14001d0a7
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14001d072
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001d06d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001d2ce
mov rcx, r8
call fcn.14009bfe4
xor r15d, r15d
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
movups xmm0, xmmword [r14]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 7
mov word [r14], r15w
jmp 0x14001d0aa
xor r15d, r15d
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x14001d0ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d0e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d2ce
call fcn.14009bfe4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
lock inc dword [r12 + 8]
mov rdi, qword [rbp + 0x38]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], r12
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.1400263f0
mov rdx, qword [r13 + 8]
cmp rdx, qword [r13 + 0x10]
je 0x14001d136
mov qword [rdx], rdi
mov qword [rdx + 8], r12
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x38], xmm0
add qword [r13 + 8], 0x10
jmp 0x14001d143
lea r8, [rbp + 0x38]
mov rcx, r13
call fcn.1400071a0
nop
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14001d180
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001d180
mov rdi, qword [rbp + 0x40]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rdi + 0xc], eax
cmp eax, 1
jne 0x14001d180
mov rcx, qword [rbp + 0x40]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov edi, dword [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rsi + rax*2], 0
jne 0x14001d190
lea rsi, [rsi + rax*2]
add rsi, 2
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x14001d1e3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d1de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d29f
call fcn.14009bfe4
cmp word [rsi], 0
je 0x14001d1f6
movzx r14d, byte [rbp + 0x910]
jmp 0x14001ce70
mov rbx, qword [rbp + 0x80]
mov r15, qword [rbp - 0x40]
mov r12, qword [rbp - 0x38]
cmp byte [rbp + 0x910], 0
je 0x14001d260
mov byte [rsp + 0x20], 0
mov r9, r13
mov r8, r12
mov rdx, r15
mov rcx, 0xffffffff80000002
call fcn.14001c800
mov rdx, qword [r13 + 8]
mov r8d, 0x78
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov rcx, qword [r8 + rcx]
shl rcx, 4
add rcx, qword [r13]
mov r8, rdx
sub r8, rcx
sar r8, 4
lea r9, [0x140023240]
call fcn.14000a910
mov dil, 1
test rbx, rbx
je 0x14001d271
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, dil
mov rcx, qword [rbp + 0x8a0]
xor rcx, rsp
call fcn.14009c570
mov rbx, qword [rsp + 0x9f0]
add rsp, 0x9b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400a3080
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
int3