Function at 0x140031c90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x1400cc038]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov r14, rcx
xor edi, edi
mov dword [rsp + 0x40], edi
mov qword [rcx + 0x48], rdx
mov qword [rbp + 0x60], 0x11c
mov qword [rbp + 0x68], rdi
mov dword [rbp + 0x70], edi
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x74]
call fcn.140058cc0
mov dword [rbp + 0x174], edi
mov dword [rbp + 0x178], 0x10000
mov r8b, 1
mov edx, 0x80
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8, rax
mov edx, 0x80
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
sete al
mov byte [r14 + 0x5c], al
xor r12b, r12b
mov r15d, edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140031e75
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.CurrentMajorVersionNumber
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140031e67
cmp dword [rsp + 0x44], 4
jne 0x140031e67
mov eax, dword [rsp + 0x48]
mov dword [r14 + 0x50], eax
mov dword [rsp + 0x48], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.CurrentMinorVersionNumber
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140031e67
cmp dword [rsp + 0x44], 4
jne 0x140031e67
mov eax, dword [rsp + 0x40]
mov dword [r14 + 0x54], eax
lea r8, [r14 + 0x58]
lea rdx, str.CurrentBuildNumber
mov rcx, qword [rsp + 0x50]
call fcn.1400324d0
test al, al
je 0x140031e67
mov dword [rsp + 0x48], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, [0x1400a0498]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140031e67
cmp dword [rsp + 0x44], 4
jne 0x140031e67
mov r15d, dword [rsp + 0x40]
mov r12b, 1
test rbx, rbx
je 0x140031e75
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], rdi
lea r13, str.kernel32.dll
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [r13 + rbx*2], 0
jne 0x140031e92
movabs rsi, 0x7ffffffffffffffe
cmp rbx, rsi
ja 0x14003240e
mov ecx, 0xa
mov qword [rbp - 0x50], 7
cmp rbx, 8
jae 0x140031ee3
mov qword [rbp - 0x58], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.140058620
mov word [rbp + rbx - 0x68], di
xor esi, esi
jmp 0x140031f2c
mov rax, rbx
or rax, 7
cmp rax, rsi
ja 0x140031ef9
mov rsi, rax
cmp rax, rcx
cmovb rsi, rcx
lea rdx, [rsi + 1]
lea rcx, [rbp - 0x68]
call fcn.14001bd00
mov rdi, rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r13
mov rcx, rax
call fcn.140058620
xor esi, esi
mov word [rbx + rdi], si
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 8]
call fcn.14004c690
nop
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140049b20
movzx ebx, al
lea rcx, [rbp - 8]
call fcn.140016710
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x140031f94
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031f8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032414
call fcn.1400567fc
test bl, bl
je 0x1400323d8
mov edx, dword [rsp + 0x7c]
lea rcx, [rbp + 0x38]
call fcn.1400319e0
nop
mov eax, dword [rbp - 0x80]
and eax, 0x40004
xorps xmm0, xmm0
mov qword [rbp - 0x50], 0xf
mov ebx, 8
movups xmmword [rbp - 0x68], xmm0
mov dword [rsp + 0x40], ebx
cmp eax, 0x40004
jne 0x140031ff7
mov qword [rbp - 0x58], 0xa
movsd xmm0, qword [str.Windows_NT]
movsd qword [rbp - 0x68], xmm0
movzx eax, word [0x1400a0380]
mov word [rbp - 0x60], ax
mov byte [rbp - 0x5e], 0
jmp 0x140032022
mov qword [rbp - 0x58], 7
mov rax, qword [str.Unknown]
mov dword [rbp - 0x68], eax
movzx eax, word [0x1400a038c]
mov word [rbp - 0x64], ax
movzx eax, byte [0x1400a038e]
mov byte [rbp - 0x62], al
mov byte [rbp - 0x61], 0
test r12b, r12b
jne 0x14003204c
mov ecx, dword [rsp + 0x68]
mov eax, ecx
shr eax, 0x10
mov dword [r14 + 0x50], eax
movzx eax, cx
mov dword [r14 + 0x54], eax
mov ecx, dword [rsp + 0x6c]
mov eax, ecx
shr eax, 0x10
mov dword [r14 + 0x58], eax
movzx r15d, cx
mov r8d, r15d
lea rdx, [0x1400a04a0]
lea rcx, [rbp - 8]
call fcn.14004ed00
lea rdi, [r14 + 0x28]
mov rdx, rax
mov rcx, rdi
call fcn.140003db0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x1400320a9
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400320a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003241a
call fcn.1400567fc
mov r8, qword [rbp + 0x48]
test r8, r8
jne 0x1400320be
lea rdx, [0x14009789d]
jmp 0x1400321cf
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], 2
mov qword [rbp + 0x30], 0xf
mov eax, 0x2820
mov word [rbp + 0x18], ax
mov byte [rbp + 0x1a], 0
mov dword [rsp + 0x40], 9
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rdx, qword [rbp + 0x38]
lea rcx, [rbp + 0x18]
call fcn.1400084f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x40], 0x1b
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14003216b
lea rax, [rcx + 1]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x48]
cmp rdx, 0x10
cmovae rax, qword [rbp - 0x48]
mov word [rax + rcx], 0x29
lea rax, [rbp - 0x48]
jmp 0x14003218b
mov qword [rsp + 0x20], 1
lea r9, [0x140098d20]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x48]
call fcn.140002370
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov ebx, 0x3f
mov dword [rsp + 0x40], ebx
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
cmp qword [rdi + 0x18], 0x10
jb 0x1400321d9
mov rdi, qword [rdi]
mov eax, dword [r14 + 0x58]
mov ecx, dword [r14 + 0x54]
lea r8, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae r8, qword [rbp - 0x68]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov r9d, dword [r14 + 0x50]
lea rdx, str._s__u._u._u._s_s
lea rcx, [rbp - 8]
call fcn.14004ed00
lea rcx, [r14 + 8]
mov rdx, rax
call fcn.140003db0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x14003225c
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032257
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032420
call fcn.1400567fc
movdqa xmm0, xmmword [0x140098e30]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], 0
test bl, 4
je 0x1400322c1
and ebx, 0xfffffffb
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x1400322b0
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400322ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032426
call fcn.1400567fc
movdqa xmm0, xmmword [0x140098e30]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
test bl, 2
je 0x140032315
and ebx, 0xfffffffd
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140032304
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400322ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003242c
call fcn.1400567fc
movdqa xmm0, xmmword [0x140098e30]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
test bl, 1
je 0x140032356
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x140032356
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032350
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032432
call fcn.1400567fc
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140032391
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003238c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032438
call fcn.1400567fc
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x1400323d8
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400323d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032408
call fcn.1400567fc
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140056a30
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14005d0ac
int3
call fcn.1400083c0
int3
call fcn.14005d0ac
nop
call fcn.14005d0ac
nop
call fcn.14005d0ac
nop
call fcn.14005d0ac
nop
call fcn.14005d0ac
nop
call fcn.14005d0ac
nop
call fcn.14005d0ac
int3