Function at 0x1400096a0
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd0
movaps xmmword [rsp + 0xc0], xmm6
mov rsi, rcx
mov rax, qword [0x14009e010]
xor rax, rsp
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0x90]
call fcn.14000b030
cmp byte [rsp + 0xb0], 1
jne 0x1400096f3
mov eax, dword [rsp + 0x90]
mov byte [rsi + 0x28], 1
mov dword [rsi], eax
jmp 0x140009976
movups xmm0, xmmword [rsp + 0x90]
movups xmm1, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x140067290]
movups xmmword [rsp + 0xa0], xmm0
mov word [rsp + 0x90], 0
mov dword [rsp + 0x4c], 0
cmp qword [rsp + 0x88], 7
jbe 0x140009743
mov r8, qword [rsp + 0x70]
jmp 0x140009748
lea r8, [rsp + 0x70]
lea rbp, [rsp + 0x4c]
mov qword [rsp + 0x30], rbp
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rdx, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov rcx, 0xffffffff80000001
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14000978a
cmp eax, 2
jne 0x1400097bf
mov byte [rsi + 0x28], 0
mov byte [rsi + 0x20], 0
jmp 0x140009962
mov ebx, dword [rsp + 0x4c]
and ebx, 0xfffffffe
add rbx, 2
mov rcx, rbx
call fcn.1400646bc
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
cmp qword [rsp + 0x88], 7
jbe 0x1400097ec
mov r8, qword [rsp + 0x70]
jmp 0x1400097f1
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
lea rdx, str.RegistryGetValueString
mov ecx, edi
mov r8d, 0x37
call fcn.140009ce0
mov byte [rsi + 0x28], 1
mov dword [rsi], edi
jmp 0x140009962
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov rcx, 0xffffffff80000001
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000987a
xorps xmm6, xmm6
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1400098a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea rdx, str.RegistryGetValueString
mov ecx, ebx
mov r8d, 0x4f
jmp 0x140009897
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea rdx, str.RegistryGetValueString
mov ecx, ebx
mov r8d, 0x46
call fcn.140009ce0
mov byte [rsi + 0x28], 1
mov dword [rsi], ebx
jmp 0x14000995a
mov ebp, eax
movsxd rbx, eax
mov rcx, rbx
call fcn.1400646bc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r14
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x14000991a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea rdx, str.RegistryGetValueString
mov ecx, ebx
mov r8d, 0x59
call fcn.140009ce0
mov dword [rsi], ebx
mov al, 1
jmp 0x14000994f
movaps xmm0, xmmword [0x140067830]
movaps xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
mov rdx, r14
call fcn.140015d50
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
mov byte [rsi + 0x20], 1
xor eax, eax
mov byte [rsi + 0x28], al
mov rcx, r14
call fcn.140064680
mov rcx, rdi
call fcn.140064680
lea rcx, [rsp + 0x70]
call fcn.140007340
cmp byte [rsp + 0xb0], 0
je 0x14000999f
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140065710
mov rax, rsi
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea rcx, [rsp + 0x90]
call fcn.140007340
jmp 0x140009976