Function at 0x140030660
Capabilities:
Get thread local storage value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x400
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov r12, rdx
mov qword [rbp + 0x40], rdx
mov r13, rcx
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0xb0], rdx
xor ebx, ebx
mov r15d, ebx
mov dword [rbp - 0x14], ebx
lea ecx, [rbx + 2]
call fcn.1400e8270
mov qword [rbp - 0x58], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.1400e8270
mov rdi, rax
mov qword [rbp + 0x80], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.1400e8270
mov rsi, rax
mov qword [rbp + 0x88], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.1400e8270
mov qword [rbp], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.1400e8270
mov qword [rbp + 0x20], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.1400e8270
mov qword [rbp + 0x18], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.1400e8270
mov r14, rax
mov qword [rbp + 0xb8], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.1400e8270
mov qword [rbp - 8], rax
mov word [rax], bx
mov qword [rbp - 0x20], rbx
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x20], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x28], rbx
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x28], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x30], rbx
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x30], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x38], rbx
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x38], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x40], rbx
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x40], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x48], rbx
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x50], rbx
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x50], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rbp - 0x50]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x78]
call fcn.14000b540
mov rbx, rax
xor ecx, ecx
mov qword [rbp - 0x80], rcx
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x80], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rbp - 0x80]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 8]
call fcn.14000b540
nop
mov dword [rsp + 0x80], 0xffffffff
xor edx, edx
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x70], rdx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x58], rdx
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rdx - 1]
mov rcx, r13
call fcn.140005d90
mov dword [rbp - 0x60], eax
mov rcx, qword [rbp + 8]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x80]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x78]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x50]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x48]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x40]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x38]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x30]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x28]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x20]
call fcn.1400e825c
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, qword [0x14016aa18]
call fcn.140009290
test eax, eax
jne 0x14003102a
lea ecx, [rax + 2]
call fcn.1400e8270
mov qword [rbp - 0x68], rax
xor ecx, ecx
mov word [rax], cx
lea r8, [rbp - 0x68]
xor edx, edx
mov rcx, qword [rbp + 0x10]
call fcn.140018f50
test eax, eax
jne 0x140031015
mov edi, dword [rbp - 0x60]
xor esi, esi
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rcx
mov r9d, eax
xor r8d, r8d
mov rdx, qword [rbp - 0x68]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140030fe8
mov dword [rbp - 0x70], esi
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.LibraryPath
mov rcx, qword [rbp - 0x10]
call fcn.140019160
test eax, eax
jne 0x140030fde
mov qword [rbp + 8], rsi
mov rax, qword [rbp - 8]
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rbp + 8], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov ecx, 2
call fcn.1400e8270
mov qword [rbp + 0x90], rax
mov word [rax], si
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], rsi
lea rdx, [rbp + 0x90]
mov rcx, qword [rbp - 8]
call fcn.14000a460
xor r9d, r9d
lea r8, [rbp + 0x90]
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.140007340
mov rdx, qword [rax]
mov rbx, qword [rbp - 0x58]
lea rcx, [0x14011eaa0]
test rdx, rdx
cmovne rcx, rdx
call fcn.1400e81d8
mov qword [rbp - 0x58], rax
mov rcx, rbx
call fcn.1400e825c
mov rcx, qword [rbp + 0x30]
call fcn.1400e825c
lea r9, [rbp + 0x20]
lea r8, [rbp]
mov rdx, qword [rbp - 0x58]
mov rcx, r13
call fcn.140007330
mov dword [rbp - 0x60], eax
mov qword [rbp - 0x80], rsi
mov rdx, qword [rbp - 0x68]
lea rcx, [0x14011eaa0]
test rdx, rdx
cmovne rcx, rdx
call fcn.1400e81d8
mov qword [rbp - 0x80], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DisplayString
mov rcx, qword [rbp - 0x10]
call fcn.140019160
test eax, eax
jne 0x140030be2
mov rcx, qword [rbp - 0x80]
cmp word [rcx], 0x40
jne 0x140030be2
call fcn.1400e81d8
mov r13, rax
mov qword [rbp - 0x78], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r15d, esi
mov edx, 0x2c
mov rcx, r13
call fcn.1400e3bac
test rax, rax
je 0x140030b41
mov edx, 0x2c
mov rcx, r13
call fcn.1400e3bac
mov word [rax], si
lea rcx, [rax + 2]
call fcn.1400f7970
cdq
mov r15d, eax
xor r15d, edx
sub r15d, edx
lea rdx, [r13 + 2]
lea rcx, [rbp + 0x38]
call fcn.140018990
mov rdx, qword [rax]
lea rcx, [0x14011eaa0]
test rdx, rdx
cmovne rcx, rdx
call fcn.1400e81d8
mov rbx, rax
mov rcx, r13
call fcn.1400e825c
mov rcx, qword [rbp + 0x38]
call fcn.1400e825c
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r12, rax
test rax, rax
je 0x140030bd2
mov r9d, 0x104
lea r8, [rbp + 0xd0]
mov edx, r15d
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x140030bc8
mov r15, qword [rbp - 0x80]
lea rcx, [rbp + 0xd0]
call fcn.1400e81d8
mov qword [rbp - 0x80], rax
mov rcx, r15
call fcn.1400e825c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rcx, rbx
call fcn.1400e825c
mov r12, qword [rbp + 0x40]
mov r13, qword [rbp + 0x48]
mov dword [rbp - 0x70], 4
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Enabled
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp - 0x70], reloc.OLEAUT32.dll_SafeArrayGetDim
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProviderId
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140030fae
lea r9, [rbp - 0x68]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x58]
call fcn.14000b540
mov rbx, rax
mov qword [rbp - 0x20], rsi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x20], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rbp - 0x20]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x50]
call fcn.14000b540
nop
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x20], rcx
mov r9, rbx
mov r8, rax
lea rdx, [rbp - 0x68]
mov rcx, r13
call fcn.1400058c0
movzx ebx, al
mov rcx, qword [rbp + 0x50]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x20]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x58]
call fcn.1400e825c
test bl, bl
je 0x140030fae
cmp edi, 0xffffffff
jne 0x140030ee8
mov qword [rbp - 0x78], rsi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x78], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r15d, dword [rbp - 0x18]
mov qword [rbp + 0x28], rsi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x28], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x50], rsi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x50], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x48], rsi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x40], rsi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x40], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x38], rsi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x38], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x30], rsi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x30], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rbp - 0x30]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x68]
call fcn.14000b540
mov rbx, rax
mov qword [rbp - 0x28], rsi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x28], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rbp - 0x28]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x60]
call fcn.14000b540
nop
mov dword [rsp + 0x80], edi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rsi
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x58], rsi
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
mov r8d, edi
mov rcx, r13
call fcn.140005d90
mov edi, eax
mov rcx, qword [rbp + 0x60]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x28]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x68]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x30]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x38]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x40]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x48]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x50]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x28]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x78]
call fcn.1400e825c
mov qword [rbp - 0x78], rsi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x78], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov ebx, dword [rbp - 0x18]
mov r15, qword [rbp + 0x70]
lea r9, [rbp - 0x68]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x78]
call fcn.14000b540
nop
mov dword [rsp + 0x80], 0xffffffff
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rsi
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x58], r15
lea rcx, [rbp + 8]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, edi
mov edx, dword [rbp - 0x60]
mov rcx, r13
call fcn.140005d90
nop
mov rcx, qword [rbp + 0x78]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x78]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x80]
call fcn.1400e825c
nop
lea rcx, [rbp + 0x98]
call fcn.140002c80
mov rcx, qword [rbp + 0x90]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 8]
call fcn.1400e825c
mov r15d, dword [rbp - 0x14]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r15d
mov dword [rbp - 0x14], r15d
lea r8, [rbp - 0x68]
mov edx, r15d
mov rcx, qword [rbp + 0x10]
call fcn.140018f50
test eax, eax
je 0x140030980
mov rdi, qword [rbp + 0x80]
mov rsi, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp - 0x68]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 8]
call fcn.1400e825c
nop
mov rcx, r14
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x18]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x20]
call fcn.1400e825c
nop
mov rcx, qword [rbp]
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e825c
nop
mov rcx, rdi
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x58]
call fcn.1400e825c
nop
mov rcx, qword [r12]
call fcn.1400e825c
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.1400e17a0
mov rbx, qword [rsp + 0x450]
add rsp, 0x400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret