Function at 0x14006ac70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x238
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1b0], 0xfffffffffffffffe
mov rsi, rcx
mov qword [rcx + 0x38], rdx
lea rcx, [rbp - 0x3c]
xor r15d, r15d
mov r8d, 0x118
xor edx, edx
call fcn.1400990c0
mov dword [rbp - 0x40], 0x11c
mov byte [rbp + 0xda], 1
xor ecx, ecx
mov edx, 0x80
mov r8b, 1
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea rcx, [rbp - 0x40]
mov edx, 0x80
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
sete byte [rsi + 0x4c]
lea rax, [rbp + 0x118]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, 0
mov qword [rbp + 0x188], rcx
test eax, eax
jne 0x14006af69
mov r12, qword [rbp + 0x118]
mov dword [rbp + 0x160], 4
lea rbx, [rbp + 0x160]
mov qword [rsp + 0x28], rbx
lea rdi, [rbp + 0x190]
mov qword [rsp + 0x20], rdi
lea rdx, str.CurrentMajorVersionNumber
xor r15d, r15d
lea r9, [rbp - 0x40]
mov rcx, r12
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006af50
cmp dword [rbp - 0x40], 4
jne 0x14006af50
mov eax, dword [rbp + 0x190]
mov dword [rsi + 0x40], eax
mov rcx, qword [rbp + 0x118]
mov dword [rbp + 0x160], 4
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea rdx, str.CurrentMinorVersionNumber
xor r15d, r15d
lea r14, [rbp - 0x40]
xor r8d, r8d
mov r9, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006af50
cmp dword [rbp - 0x40], 4
jne 0x14006af50
mov eax, dword [rbp + 0x190]
mov dword [rsi + 0x44], eax
mov rcx, qword [rbp + 0x118]
mov dword [rbp + 0xe0], 0xa
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea rdx, str.CurrentBuildNumber
xor r15d, r15d
xor r8d, r8d
mov r9, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14006af50
cmp dword [rbp + 0x160], 1
jne 0x14006af50
mov eax, dword [rbp + 0xe0]
mov byte [rbp + rax + 0x190], 0
mov rcx, rdi
call fcn.1400ae930
mov r15, rax
movabs rax, 0x7ffffffffffffff8
cmp r15, rax
mov qword [rbp + 0x180], r12
jae 0x14006ba72
cmp r15, 0x17
jae 0x14006ae63
mov byte [rbp - 0x29], r15b
test r15, r15
jne 0x14006aea0
jmp 0x14006aeb2
mov rax, r15
or rax, 7
lea rcx, [rax + 1]
cmp rax, 0x17
mov r12d, 0x19
cmovne r12, rcx
mov rcx, r12
call fcn.140096664
mov r14, rax
mov qword [rbp - 0x40], rax
movabs rax, 0x8000000000000000
or r12, rax
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x38], r15
lea rdx, [rbp + 0x190]
mov rcx, r14
mov r8, r15
call fcn.140098a10
mov byte [r14 + r15], 0
lea rcx, [rbp - 0x40]
lea rdx, [rbp + 0x100]
call fcn.140045cd0
cmp byte [rbp - 0x29], 0
jns 0x14006aeea
movabs rdx, 0x7fffffffffffffff
and rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x40]
mov r14d, eax
call fcn.14009665c
mov eax, r14d
test al, al
mov r12, qword [rbp + 0x180]
je 0x14006af4d
mov eax, dword [rbp + 0x100]
mov dword [rsi + 0x48], eax
mov rcx, qword [rbp + 0x118]
mov dword [rbp + 0x160], 4
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea rdx, [0x1400d0d36]
xor r15d, r15d
lea r9, [rbp - 0x40]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp - 0x40]
xor ecx, 4
or ecx, eax
sete al
mov qword [rbp + 0x188], rax
jne 0x14006af5b
mov r15d, dword [rbp + 0x190]
jmp 0x14006af5b
xor r15d, r15d
mov qword [rbp + 0x188], 0
test r12, r12
je 0x14006af69
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x20
call fcn.140096664
mov qword [rbp + 0x160], rax
movabs rcx, 0x8000000000000010
mov qword [rbp + 0x170], rcx
mov qword [rbp + 0x168], 0xc
movabs rcx, 0x6c006c0064002e
mov qword [rax + 0x10], rcx
movaps xmm0, xmmword [str.kernel32.dll]
movups xmmword [rax], xmm0
mov word [rax + 0x18], 0
lea rcx, [rbp + 0x190]
lea rdx, [rbp + 0x160]
call fcn.140007280
lea rcx, [rbp + 0x190]
lea rdx, [rbp - 0x40]
call fcn.14006a4c0
mov edi, eax
lea r14, [rbp + 0x190]
mov rcx, r14
call fcn.140007390
cmp byte [rbp + 0x177], 0
js 0x14006affb
test dil, dil
jne 0x14006b01a
jmp 0x14006b7b7
mov rcx, qword [rbp + 0x160]
mov rdx, qword [rbp + 0x170]
add rdx, rdx
call fcn.14009665c
test dil, dil
je 0x14006b7b7
mov ebx, dword [rbp - 0x24]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x190], xmm0
mov qword [rbp + 0x1a0], 0
test bl, 1
jne 0x14006b049
lea rax, [rbp + 0x198]
mov dl, 8
xor ecx, ecx
test bl, 4
jne 0x14006b07a
jmp 0x14006b092
lea r14, [rbp + 0x196]
lea rax, [rbp + 0x19e]
mov word [rbp + 0x194], 0x2c67
mov dword [rbp + 0x190], 0x75626544
mov byte [rbp + 0x1a7], 6
mov dl, 0xe
mov cl, 6
test bl, 4
je 0x14006b092
movabs rcx, 0x2c64656863746150
mov qword [r14], rcx
mov byte [rbp + 0x1a7], dl
mov byte [rax], 0
mov ecx, edx
test bl, 2
mov qword [rbp + 0x180], r15
je 0x14006b154
movzx r14d, cl
cmp r14b, 0xb
jbe 0x14006b10f
mov ecx, 0x30
call fcn.140096664
mov rdi, rax
lea r15, [r14 + 0xb]
lea rdx, [rbp + 0x190]
mov rcx, rax
mov r8, r14
call fcn.140098a10
movabs rax, 0x61656c6572657250
mov qword [rdi + r14], rax
mov dword [rdi + r14 + 7], 0x2c657361
mov qword [rbp + 0x190], rdi
movabs rax, 0x8000000000000030
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x198], r15
lea rax, [rdi + r14]
add rax, 0xb
jmp 0x14006b151
movabs rax, 0x61656c6572657250
mov qword [rbp + r14 + 0x190], rax
mov dword [rbp + r14 + 0x197], 0x2c657361
lea rcx, [r14 + 0xb]
cmp byte [rbp + 0x1a7], 0
lea rax, [rbp + rcx + 0x190]
js 0x14006b14a
mov byte [rbp + 0x1a7], cl
jmp 0x14006b151
mov qword [rbp + 0x198], rcx
mov byte [rax], 0
mov r15, qword [rbp + 0x198]
test bl, 8
jne 0x14006b168
mov r14, r15
jmp 0x14006b2f0
movabs rcx, 0x7fffffffffffffff
and rcx, qword [rbp + 0x1a0]
movsx rax, byte [rbp + 0x1a7]
dec rcx
test rax, rax
mov r12d, 0x16
cmovs r12, rcx
cmovns r15, rax
mov rcx, r12
sub rcx, r15
cmp rcx, 8
jae 0x14006b1ce
lea r14, [r15 + 8]
mov rcx, r14
sub rcx, r12
movabs rdx, 0x7ffffffffffffff6
sub rdx, r12
cmp rcx, rdx
ja 0x14006ba5a
test al, al
jns 0x14006b212
mov rax, qword [rbp + 0x190]
jmp 0x14006b219
test al, al
jns 0x14006b1db
mov rax, qword [rbp + 0x190]
jmp 0x14006b1e2
lea rax, [rbp + 0x190]
movabs rcx, 0x2c65746176697250
mov qword [rax + r15], rcx
add r15, 8
cmp byte [rbp + 0x1a7], 0
js 0x14006b2dd
mov ecx, r15d
and cl, 0x7f
mov byte [rbp + 0x1a7], cl
jmp 0x14006b2e4
lea rax, [rbp + 0x190]
mov qword [rbp + 0xf8], rax
movabs rax, 0x3ffffffffffffff2
cmp r12, rax
ja 0x14006b262
lea rax, [r12 + r12]
cmp r14, rax
cmova rax, r14
mov rcx, rax
or rcx, 7
lea rdx, [rcx + 1]
cmp rcx, 0x17
mov ecx, 0x19
cmovne rcx, rdx
cmp rax, 0x17
mov r13d, 0x17
cmovae r13, rcx
jmp 0x14006b26c
movabs r13, 0x7ffffffffffffff7
mov rcx, r13
call fcn.140096664
mov rdi, rax
test r15, r15
je 0x14006b28e
mov rcx, rdi
mov rdx, qword [rbp + 0xf8]
mov r8, r15
call fcn.140098a10
movabs rax, 0x2c65746176697250
mov qword [rdi + r15], rax
inc r12
cmp r12, 0x17
je 0x14006b2b4
mov rcx, qword [rbp + 0xf8]
mov rdx, r12
call fcn.14009665c
mov qword [rbp + 0x190], rdi
movabs rax, 0x8000000000000000
or r13, rax
mov qword [rbp + 0x1a0], r13
mov qword [rbp + 0x198], r14
mov byte [rdi + r14], 0
jmp 0x14006b2f0
mov qword [rbp + 0x198], r15
mov byte [rax + r15], 0
mov r14, qword [rbp + 0x198]
mov rdi, qword [rbp + 0x180]
test bl, 0x20
jne 0x14006b304
mov rbx, r14
jmp 0x14006b48a
movabs rcx, 0x7fffffffffffffff
and rcx, qword [rbp + 0x1a0]
movsx rax, byte [rbp + 0x1a7]
dec rcx
test rax, rax
mov r15d, 0x16
cmovs r15, rcx
cmovns r14, rax
mov rcx, r15
sub rcx, r14
cmp rcx, 8
jae 0x14006b36a
lea rbx, [r14 + 8]
mov rcx, rbx
sub rcx, r15
movabs rdx, 0x7ffffffffffffff6
sub rdx, r15
cmp rcx, rdx
ja 0x14006ba66
test al, al
jns 0x14006b3b5
mov r12, qword [rbp + 0x190]
jmp 0x14006b3bc
test al, al
jns 0x14006b377
mov rax, qword [rbp + 0x190]
jmp 0x14006b37e
lea rax, [rbp + 0x190]
mov rdi, qword [rbp + 0x180]
movabs rcx, 0x2c6c616963657053
mov qword [rax + r14], rcx
add r14, 8
cmp byte [rbp + 0x1a7], 0
js 0x14006b477
mov ecx, r14d
and cl, 0x7f
mov byte [rbp + 0x1a7], cl
jmp 0x14006b47e
lea r12, [rbp + 0x190]
movabs rax, 0x3ffffffffffffff2
cmp r15, rax
ja 0x14006b3fe
lea rax, [r15 + r15]
cmp rbx, rax
cmova rax, rbx
mov rcx, rax
or rcx, 7
lea rdx, [rcx + 1]
cmp rcx, 0x17
mov ecx, 0x19
cmovne rcx, rdx
cmp rax, 0x17
mov r13d, 0x17
cmovae r13, rcx
jmp 0x14006b408
movabs r13, 0x7ffffffffffffff7
mov rcx, r13
call fcn.140096664
mov rdi, rax
test r14, r14
je 0x14006b426
mov rcx, rdi
mov rdx, r12
mov r8, r14
call fcn.140098a10
movabs rax, 0x2c6c616963657053
mov qword [rdi + r14], rax
inc r15
cmp r15, 0x17
je 0x14006b448
mov rcx, r12
mov rdx, r15
call fcn.14009665c
mov qword [rbp + 0x190], rdi
movabs rax, 0x8000000000000000
or r13, rax
mov qword [rbp + 0x1a0], r13
mov qword [rbp + 0x198], rbx
mov byte [rdi + rbx], 0
mov rdi, qword [rbp + 0x180]
jmp 0x14006b48a
mov qword [rbp + 0x198], r14
mov byte [rax + r14], 0
mov rbx, qword [rbp + 0x198]
movsx rax, byte [rbp + 0x1a7]
test rax, rax
cmovns rbx, rax
test rbx, rbx
je 0x14006b4af
lea r14, [rbx - 1]
test al, al
jns 0x14006b4d0
mov r15, qword [rbp + 0x190]
jmp 0x14006b4d7
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x170], rax
movaps xmm0, xmmword [rbp + 0x190]
movaps xmmword [rbp + 0x160], xmm0
jmp 0x14006b58a
lea r15, [rbp + 0x190]
movabs rax, 0x7ffffffffffffff8
cmp r14, rax
jae 0x14006ba4e
cmp rbx, 0x18
jae 0x14006b505
mov byte [rbp + 0x177], r14b
lea rbx, [rbp + 0x160]
test r14, r14
jne 0x14006b54a
jmp 0x14006b558
mov rax, r14
or rax, 7
lea rcx, [rax + 1]
cmp rax, 0x17
mov edi, 0x19
cmovne rdi, rcx
mov rcx, rdi
call fcn.140096664
mov rbx, rax
mov qword [rbp + 0x160], rax
movabs rax, 0x8000000000000000
or rdi, rax
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x168], r14
mov rcx, rbx
mov rdx, r15
mov r8, r14
call fcn.140098a10
mov byte [rbx + r14], 0
cmp byte [rbp + 0x1a7], 0
mov rdi, qword [rbp + 0x180]
jns 0x14006b58a
movabs rdx, 0x7fffffffffffffff
and rdx, qword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x190]
call fcn.14009665c
mov eax, dword [rbp - 0x20]
not eax
test eax, 0x40004
jne 0x14006b5bb
lea rax, [rbp + 0x19a]
movabs rcx, 0x2073776f646e6957
mov qword [rbp + 0x190], rcx
mov word [rbp + 0x198], 0x544e
mov cl, 0xa
jmp 0x14006b5d8
lea rax, [rbp + 0x197]
mov dword [rbp + 0x193], 0x6e776f6e
mov dword [rbp + 0x190], 0x6e6b6e55
mov cl, 7
mov byte [rax], 0
mov byte [rbp + 0x1a7], cl
cmp byte [rbp + 0x188], 0
jne 0x14006b605
mov eax, dword [rbp - 0x38]
movzx ecx, ax
shr eax, 0x10
mov dword [rsi + 0x40], eax
mov dword [rsi + 0x44], ecx
mov eax, dword [rbp - 0x34]
movzx edi, ax
shr eax, 0x10
mov dword [rsi + 0x48], eax
lea rdx, [0x1400d0d3e]
lea rcx, [rbp + 0xe0]
mov r8d, edi
call fcn.1400196e0
lea rdi, [rsi + 0x20]
cmp byte [rsi + 0x37], 0
jns 0x14006b63c
movabs rdx, 0x7fffffffffffffff
and rdx, qword [rsi + 0x30]
mov rcx, qword [rsi + 0x20]
call fcn.14009665c
mov rax, qword [rbp + 0xf0]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rbp + 0xe0]
movups xmmword [rdi], xmm0
movsx rax, byte [rbp + 0x177]
mov rbx, rax
test rax, rax
jns 0x14006b668
mov rbx, qword [rbp + 0x168]
test rbx, rbx
mov qword [rbp + 0x188], rbx
je 0x14006b6cf
mov byte [rbp + 0x137], 2
mov word [rbp + 0x120], 0x2820
mov byte [rbp + 0x122], 0
test al, al
jns 0x14006b7cb
mov rdx, qword [rbp + 0x160]
cmp rbx, 0x14
ja 0x14006b7dc
lea rcx, [rbp + 0x122]
mov r8, rbx
call fcn.140098a10
lea rax, [rbx + 2]
cmp byte [rbp + 0x137], 0
js 0x14006b8e2
mov byte [rbp + 0x137], al
jmp 0x14006b8e9
lea rax, [0x1400c539b]
cmp byte [rsi + 0x37], 0
jns 0x14006b6e0
mov rdi, qword [rsi + 0x20]
mov ecx, dword [rsi + 0x48]
mov r9d, dword [rsi + 0x40]
mov edx, dword [rsi + 0x44]
cmp byte [rbp + 0x1a7], 0
jns 0x14006b6fc
mov r8, qword [rbp + 0x190]
jmp 0x14006b703
lea r8, [rbp + 0x190]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rdx, str._s__u._u._u._s_s
lea rcx, [rbp + 0xe0]
call fcn.1400196e0
lea rdi, [rsi + 8]
cmp byte [rsi + 0x1f], 0
jns 0x14006b749
movabs rdx, 0x7fffffffffffffff
and rdx, qword [rsi + 0x18]
mov rcx, qword [rsi + 8]
call fcn.14009665c
mov rax, qword [rbp + 0xf0]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rbp + 0xe0]
movups xmmword [rdi], xmm0
mov byte [rbp + 0xf7], 0
mov byte [rbp + 0xe0], 0
cmp qword [rbp + 0x188], 0
je 0x14006b79d
cmp byte [rbp + 0x117], 0
js 0x14006b818
cmp byte [rbp + 0x157], 0
js 0x14006b842
cmp byte [rbp + 0x137], 0
js 0x14006b86c
cmp byte [rbp + 0x1a7], 0
js 0x14006b896
cmp byte [rbp + 0x177], 0
js 0x14006b8c0
add rsp, 0x238
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rdx, [rbp + 0x160]
cmp rbx, 0x14
jbe 0x14006b6a4
lea r8, [rbx - 0x14]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 2
lea rcx, [rbp + 0x120]
mov edx, 0x16
mov r9d, 2
call fcn.140009250
jmp 0x14006b8f1
movabs rdx, 0x7fffffffffffffff
and rdx, qword [rbp + 0x110]
mov rcx, qword [rbp + 0x100]
call fcn.14009665c
cmp byte [rbp + 0x157], 0
jns 0x14006b790
movabs rdx, 0x7fffffffffffffff
and rdx, qword [rbp + 0x150]
mov rcx, qword [rbp + 0x140]
call fcn.14009665c
cmp byte [rbp + 0x137], 0
jns 0x14006b79d
movabs rdx, 0x7fffffffffffffff
and rdx, qword [rbp + 0x130]
mov rcx, qword [rbp + 0x120]
call fcn.14009665c
cmp byte [rbp + 0x1a7], 0
jns 0x14006b7aa
movabs rdx, 0x7fffffffffffffff
and rdx, qword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x190]
call fcn.14009665c
cmp byte [rbp + 0x177], 0
jns 0x14006b7b7
movabs rdx, 0x7fffffffffffffff
and rdx, qword [rbp + 0x170]
mov rcx, qword [rbp + 0x160]
call fcn.14009665c
jmp 0x14006b7b7
mov qword [rbp + 0x128], rax
mov byte [rbp + rax + 0x120], 0
mov r8, qword [rbp + 0x130]
mov qword [rbp + 0x150], r8
mov rax, qword [rbp + 0x120]
mov qword [rbp + 0x140], rax
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x148], rax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], 0
movsx rcx, byte [rbp + 0x157]
mov edx, 0x16
mov rax, rcx
test rcx, rcx
jns 0x14006b95f
movabs rax, 0x7fffffffffffffff
and r8, rax
dec r8
mov rax, qword [rbp + 0x148]
mov rdx, r8
cmp rdx, rax
jne 0x14006b99e
lea rax, [0x1400cbb71]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], 0
lea rcx, [rbp + 0x140]
mov r8d, 1
mov r9, rdx
call fcn.140009250
jmp 0x14006b9da
test cl, cl
jns 0x14006b9ab
mov rcx, qword [rbp + 0x140]
jmp 0x14006b9b2
lea rcx, [rbp + 0x140]
mov byte [rcx + rax], 0x29
inc rax
cmp byte [rbp + 0x157], 0
js 0x14006b9cf
mov edx, eax
and dl, 0x7f
mov byte [rbp + 0x157], dl
jmp 0x14006b9d6
mov qword [rbp + 0x148], rax
mov byte [rcx + rax], 0
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x140]
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x148]
mov qword [rbp + 0x108], rax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], 0
cmp byte [rbp + 0x117], 0
jns 0x14006ba38
mov rax, qword [rbp + 0x100]
cmp byte [rsi + 0x37], 0
js 0x14006b6dc
jmp 0x14006b6e0
lea rax, [rbp + 0x100]
cmp byte [rsi + 0x37], 0
jns 0x14006b6e0
jmp 0x14006b6dc
lea rcx, [rbp + 0x160]
call fcn.140004e00
lea rcx, [rbp + 0x190]
call fcn.140004e00
lea rcx, [rbp + 0x190]
call fcn.140004e00
lea rcx, [rbp - 0x40]
call fcn.140004e00
int3