Function at 0x1400518e0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
movaps xmmword [rsp + 0xe0], xmm6
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0xd8], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0xb0]
mov qword [rdi + 0x10], r15
movaps xmm6, xmmword [0x14029ca60]
movaps xmmword [rdi], xmm6
mov rcx, qword [0x1402e5ab0]
lea rax, str.enable_registry_features
lea r8, [rsp + 0xa0]
mov qword [r8], rax
mov qword [r8 + 8], 0x18
mov rdx, rdi
call fcn.14017d0a0
movzx ecx, byte [rdi + 0x17]
test cl, cl
js 0x140051968
mov eax, ecx
and eax, 0x7f
jmp 0x140051970
mov rax, qword [rsp + 0xb8]
test rax, rax
je 0x140051a8d
mov qword [rsp + 0x90], r15
movaps xmmword [rsp + 0x80], xmm6
lea rdx, [0x1402a1e84]
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], 1
test cl, cl
jns 0x1400519aa
mov rdi, qword [rsp + 0xb0]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rax
test rax, rax
js 0x140051dea
test rdi, rdi
je 0x140051ded
mov dword [rsp + 0x20], 1
lea rbx, [rsp + 0x80]
lea rdx, [rsp + 0x60]
lea r8, [rsp + 0x70]
mov rcx, rbx
mov r9d, 1
call fcn.1401c21c0
mov rdi, qword [rbx]
mov r12, qword [rbx + 8]
cmp rdi, r12
je 0x140051a16
mov rbx, qword [rsi]
test rbx, rbx
je 0x140051d5d
mov rcx, rbx
call fcn.1401f05b0
mov r14, rax
mov r13, rdi
jmp 0x140051a67
test rdi, rdi
je 0x140051a8d
mov qword [rsp + 0x88], rdi
mov rcx, rdi
call fcn.1401cbbbc
jmp 0x140051a8d
and eax, 0x7f
mov rcx, r13
test rax, rax
js 0x140051de4
test rcx, rcx
jne 0x140051a4a
test rax, rax
jne 0x140051de7
cmp rax, r14
jne 0x140051a5e
mov rdx, rbx
mov r8, r14
call fcn.1401cff30
test eax, eax
je 0x140051a7a
add r13, 0x18
cmp r13, r12
je 0x140051a88
movzx eax, byte [r13 + 0x17]
test al, al
jns 0x140051a2d
mov rax, qword [r13 + 8]
mov rcx, qword [r13]
jmp 0x140051a33
mov ebx, 1
test rdi, rdi
je 0x140051a8f
xor ebp, ebp
jmp 0x140051ae4
test rdi, rdi
jne 0x140051adf
xor ebx, ebx
cmp byte [rsp + 0xc7], 0
jns 0x140051aa6
mov rcx, qword [rsp + 0xb0]
call fcn.1401cbbbc
mov dil, 1
test ebx, ebx
je 0x140051b34
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, edi
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov bpl, 1
xor ebx, ebx
add r12, 0xffffffffffffffe8
test r12, r12
je 0x140051df0
cmp byte [r12 + 0x17], 0
js 0x140051b29
lea rax, [r12 - 0x18]
cmp r12, rdi
mov r12, rax
jne 0x140051ae8
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rdi
call fcn.1401cbbbc
test bpl, bpl
jne 0x140051a8d
jmp 0x140051a8f
mov rcx, qword [r12]
call fcn.1401cbbbc
jmp 0x140051af9
mov rcx, qword [0x1402e5ab0]
lea rdx, str.registry_feature_in_test
call fcn.1401a49f0
mov qword [rsp + 0x90], r15
movaps xmmword [rsp + 0x80], xmm6
lea rcx, [rsp + 0xb0]
mov qword [rcx + 0x10], r15
movaps xmmword [rcx], xmm6
lea rdx, str.Software_
call fcn.140207340
mov rax, qword [0x1402e5ad0]
test rax, rax
je 0x140051d79
mov rbx, qword [rax + 8]
mov rcx, qword [rbx + 0x18]
lea rdi, [rsp + 0xb0]
mov dl, 1
mov r8, rdi
call fcn.140032420
lea rdx, str.Features
mov r8d, 9
mov rcx, rdi
call fcn.14001de40
cmp byte [rax + 0x17], 0
jns 0x140051d63
mov rdx, qword [rax]
mov r8, qword [rax + 8]
lea rcx, [rsp + 0x40]
call fcn.1400179f0
cmp byte [rsp + 0xc7], 0
jns 0x140051be3
mov rcx, qword [rsp + 0xb0]
call fcn.1401cbbbc
cmp byte [rsp + 0x57], 0
js 0x140051bf1
lea r8, [rsp + 0x40]
jmp 0x140051bf6
mov r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x80]
mov rdx, 0xffffffff80000001
mov r9d, 0x20019
call fcn.14004fbb0
cmp byte [rsp + 0x57], 0
jns 0x140051c21
mov rcx, qword [rsp + 0x40]
call fcn.1401cbbbc
mov rcx, qword [rsi]
mov qword [rsp + 0x30], rcx
test rcx, rcx
je 0x140051d60
call fcn.1401f05b0
lea rdx, [rsp + 0x30]
mov qword [rdx + 8], rax
mov rcx, rdi
call fcn.1401b6b60
cmp byte [rsp + 0xc7], 0
jns 0x140051c5a
mov rdi, qword [rsp + 0xb0]
mov eax, 4
lea r9, [rsp + 0x40]
mov dword [r9], eax
lea rdx, [rsp + 0xd4]
mov dword [rdx], eax
lea rax, [rsp + 0xd0]
mov dword [rax], 0
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
xor ebx, ebx
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140051d55
mov eax, dword [rsp + 0x40]
add eax, 0xfffffffd
cmp eax, 2
setb al
cmp dword [rsp + 0xd4], 4
sete bl
and bl, al
cmp dword [rsp + 0xd0], 0
setne al
mov ebp, ebx
xor bpl, 1
or bpl, al
cmp byte [rsp + 0xc7], 0
jns 0x140051cec
mov rcx, qword [rsp + 0xb0]
call fcn.1401cbbbc
xor edi, edi
cmp dword [rsi + 8], 1
sete dil
movzx eax, bpl
test bl, bl
cmovne edi, eax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140051d29
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x88], 0
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x90], 0
test rcx, rcx
je 0x140051ab1
mov edx, 1
call fcn.140040de0
jmp 0x140051ab1
mov bpl, 1
jmp 0x140051cd5
int3
int3
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x50], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
jmp 0x140051bcc
mov ecx, 0xc8
call fcn.1401cbbc4
mov rdi, rax
lea rbx, [rax + 0x70]
mov qword [rax + 8], rbx
lea rax, [0x14029e8a0]
mov qword [rdi], rax
lea rcx, [rdi + 0x10]
mov r8d, 0xb8
xor edx, edx
call fcn.1401d06e0
mov qword [rdi + 0x70], 0x58
lea rax, str.120.0.6099.809
mov qword [rdi + 0x78], rax
lea rax, [0x1402aa3fb]
mov qword [rdi + 0x80], rax
lea rax, [0x1402b2a00]
mov qword [rdi + 0x88], rax
mov qword [0x1402e5ad0], rdi
jmp 0x140051b86
int3
int3
int3
int3
int3