Function at 0x1401c6f20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x1405e3440]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov rbx, r8
mov rdi, rcx
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov dword [rsp + 0x30], 0x400
cmp qword [rdx + 0x18], 0xf
jbe 0x1401c6f6c
mov rdx, qword [rdx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1401c717b
cmp qword [rbx + 0x18], 0xf
jbe 0x1401c6f9e
mov rbx, qword [rbx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1401c717b
mov eax, dword [rsp + 0x30]
cmp eax, 0x400
ja 0x1401c717b
lea rsi, [rax - 1]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
movabs rbx, 0x7fffffffffffffff
cmp rsi, rbx
ja 0x1401c71b9
cmp rsi, 0xf
ja 0x1401c7052
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov r8, rsi
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rsi + 0x48], r15b
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x48]
jmp 0x1401c70eb
mov rax, rsi
or rax, 0xf
cmp rax, rbx
jbe 0x1401c708b
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140487b50
test rax, rax
je 0x1401c716d
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1401c70c8
mov rbx, rax
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1401c70b6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1401c71bf
jmp 0x1401c706c
test rcx, rcx
je 0x1401c70c5
call fcn.140487b50
mov r14, rax
jmp 0x1401c70c8
mov r14, r15
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rbx
mov r8, rsi
lea rdx, [rsp + 0x70]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rsi], r15b
mov r8, rsi
test rsi, rsi
je 0x1401c710e
lea rax, [rsp + 0x48]
cmp rbx, 0xf
cmova rax, r14
cmp byte [rax + r8 - 1], 0
jne 0x1401c710e
sub r8, 1
jne 0x1401c70f3
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r15
cmp rsi, r8
cmovb r8, rsi
lea rdx, [rsp + 0x48]
cmp rbx, 0xf
cmova rdx, r14
mov rcx, rdi
call fcn.140137550
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x1401c7190
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401c7174
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401c7174
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140487b8c
jmp 0x1401c7190
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], r15b
mov rax, rdi
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.140487ca0
mov rbx, qword [rsp + 0x4c8]
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.14012bbe0
int3
call fcn.14012aec0
int3