Function at 0x14001de50
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov qword [rbp + 0x2f], 0xfffffffffffffffe
mov rbx, rcx
xor r12d, r12d
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 9], rax
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 1], rax
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 7], rax
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xf], rax
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 2
mov dword [rbp + 0x23], 2
mov byte [rbp + 0x27], r12b
mov dword [rbp + 0x2b], r12d
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x29], rax
or rsi, 0xffffffffffffffff
test rbx, rbx
je 0x14001df62
test rbx, 0xffffffffffff0000
jne 0x14001df4f
movzx edi, bx
mov ecx, edi
call fcn.140004200
test rax, rax
je 0x14001df75
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.14000b630
jmp 0x14001df75
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x14001df65
mov ecx, r12d
mov r8d, ecx
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000b480
nop
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x29]
call fcn.14001e490
movzx edi, al
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14001dfa3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test dil, dil
je 0x14001e10f
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x21], rax
mov r9, rbx
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionExtSettings
lea rdx, str._s_s
lea rcx, [rbp - 0x21]
call fcn.14000c330
mov dword [rbp + 0x6f], r12d
mov qword [rbp - 0x19], r12
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdi, qword [rbp - 0x21]
mov rdx, rdi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001e053
mov dword [rbp + 0x7f], 4
mov dword [rbp + 0x77], 4
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.Flags
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x11], rax
lea r9, [rbp - 0x11]
lea r8, str.Version
mov rdx, rdi
mov rcx, 0xffffffff80000001
call fcn.14000f7a0
mov edx, dword [rbp + 0x6f]
and dl, 1
cmp dl, 1
setne byte [rbp + 0x27]
mov rbx, qword [rbp - 0x11]
test rbx, rbx
jne 0x14001e0a1
mov ecx, r12d
jmp 0x14001e0b2
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rbp + 0x17]
call fcn.14000b480
mov rdx, qword [rbp + 7]
cmp dword [rdx - 0x10], 0
je 0x14001e0d7
movzx eax, byte [rbp + 0x27]
neg al
sbb ecx, ecx
lea r12d, [rcx + 2]
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001e0f2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x14001e10f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rbp - 9]
call fcn.140014fc0
mov eax, r12d
add rsp, 0x90
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret