Function at 0x140040f00
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov rsi, rcx
movabs rbx, 0x8000000000000000
lea rdx, [0x14017d034]
lea rcx, [rsp + 0x38]
mov r8d, 0x12
call fcn.1400419b0
cmp qword [rsp + 0x38], rbx
jne 0x140040f5a
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 1
mov qword [rsp + 0x80], 0
jmp 0x140040f71
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rsp + 0x38]
movaps xmmword [rsp + 0x70], xmm0
lea rdx, [0x14017d034]
lea rcx, [rsp + 0x38]
mov r8d, 0x12
call fcn.1400419b0
mov rdi, qword [rsp + 0x38]
xor edx, edx
cmp rdi, rbx
mov ebx, 1
cmovne rbx, qword [rsp + 0x40]
cmove rdi, rdx
cmovne rdx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.14010d3e0
mov r14, rax
test rdi, rdi
je 0x140040fc8
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call fcn.140011dc0
test r14b, 1
jne 0x140040fe4
shr r14, 0x20
mov ebp, 0xb
cmp r14d, 0x55ef
ja 0x1400411aa
lea rax, [0x14017cfe7]
mov qword [rsp + 0x38], rax
lea rax, [0x14017d013]
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0xa8]
lea rdx, [rsp + 0x38]
call fcn.14004ee70
lea rax, [0x14017d046]
mov qword [rsp + 0x38], rax
lea rax, [0x14017d05f]
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0x88]
lea rbx, [rsp + 0x38]
mov rdx, rbx
call fcn.14004ee70
mov rdi, qword [rsp + 0xb0]
call fcn.140063410
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rbx
mov rcx, 0xffffffff80000002
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x20019
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x1400410d6
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x1400410af
mov rcx, qword [rsp + 0x90]
add rdx, rdx
mov r8d, 2
call fcn.140011dc0
mov rdx, qword [rsp + 0xa8]
test rdx, rdx
je 0x1400411a8
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140011dc0
jmp 0x1400411a8
mov r15, qword [rsp + 0x38]
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x34], 0
mov r14, qword [rsp + 0x90]
mov dword [rsp + 0x38], 0
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov rcx, r15
mov rdx, r14
xor r8d, r8d
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
test eax, eax
je 0x14004115a
movzx ecx, bx
or ecx, 0x80070000
test ebx, ebx
cmovle ecx, ebx
call fcn.14006e4f0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], edx
mov byte [rsp + 0x38], 1
test rax, rax
je 0x140041160
lea rcx, [rsp + 0x40]
call fcn.14006ef90
jmp 0x140041160
mov ebp, dword [rsp + 0x34]
jmp 0x140041160
mov rcx, r15
call sub.advapi32.dll_RegCloseKey
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x140041186
add rdx, rdx
mov r8d, 2
mov rcx, r14
call fcn.140011dc0
mov rdx, qword [rsp + 0xa8]
test rdx, rdx
je 0x1400411a4
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140011dc0
test ebx, ebx
je 0x1400411aa
xor ebp, ebp
mov dword [rsp + 0xa8], ebp
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x88], rax
lea rax, [fcn.1401127d0]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x98], rax
lea rax, [0x14003f0c0]
mov qword [rsp + 0xa0], rax
lea rax, [0x14017d068]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x58], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 2
lea rcx, [rsp + 0xc0]
lea rdx, [rsp + 0x38]
call fcn.1400f4940
mov rax, qword [rsp + 0xd0]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsi], xmm0
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140041263
mov rcx, qword [rsp + 0x78]
mov r8d, 1
call fcn.140011dc0
mov rax, rsi
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret