Function at 0x14008a400
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x1401b4a98]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r15, rdx
mov r12, rcx
mov qword [rsp + 0x60], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [r11 - 0x78], xmm0
movups xmmword [r11 - 0x68], xmm0
movups xmmword [r11 - 0x58], xmm0
movss dword [rsp + 0xe0], xmm0
xor esi, esi
mov qword [r11 - 0x80], rsi
mov qword [r11 - 0x78], rsi
lea ecx, [rsi + 0x50]
call fcn.1400fbb48
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf8], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x118], 8
movss xmm0, dword [0x140186264]
movss dword [rsp + 0xe0], xmm0
mov r8, rax
lea edx, [rsi + 0x10]
lea rcx, [rsp + 0xf8]
call fcn.14008ab20
nop
mov dword [rsp + 0xd0], esi
mov dword [rsp + 0xc8], esi
mov dword [rsp + 0xcc], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0xcc]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14008a5df
lea rdx, [rsp + 0xe0]
mov rcx, r15
call fcn.1400886b0
nop
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf8]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov r8, rcx
cmp rdx, 0x1000
jb 0x14008a589
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x14008a8cc
call fcn.140074f80
xorps xmm0, xmm0
mov qword [rsp + 0xf8], rsi
movdqa xmmword [rsp + 0x100], xmm0
lea rcx, [rsp + 0xe8]
call fcn.140089020
mov rax, r15
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400fb890
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
inc dword [rsp + 0xcc]
inc dword [rsp + 0xc8]
mov ecx, dword [rsp + 0xcc]
mov eax, 2
mul rcx
mov rbx, rax
mov r13, 0xffffffffffffffff
cmovo rbx, r13
mov rcx, rbx
call fcn.1400fbe0c
mov rdi, rax
test rax, rax
je 0x14008a629
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.1400fe8d0
jmp 0x14008a62c
mov rdi, rsi
mov qword [rsp + 0x120], rdi
mov ecx, dword [rsp + 0xc8]
mov eax, 2
mul rcx
mov r14, rax
cmovo r14, r13
mov rcx, r14
call fcn.1400fbe0c
mov rbx, rax
test rax, rax
je 0x14008a669
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.1400fe8d0
jmp 0x14008a66c
mov rbx, rsi
mov qword [rsp + 0x128], rbx
mov r14d, esi
nop word [rax + rax]
cmp r14d, dword [rsp + 0xd0]
jae 0x14008a856
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0xdc], eax
mov eax, dword [rsp + 0xcc]
mov dword [rsp + 0xd8], eax
mov dword [rsp + 0xd4], esi
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0xd4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xdc]
mov r8, rbx
mov edx, r14d
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x14008a78c
mov rcx, r15
call fcn.140088790
nop
test rbx, rbx
je 0x14008a70c
mov rcx, rbx
call fcn.140074f80
nop
test rdi, rdi
je 0x14008a71a
mov rcx, rdi
call fcn.140074f80
nop
mov rax, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf8]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008a75e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008a8d2
call fcn.140074f80
mov qword [rsp + 0xf8], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x100], xmm0
lea rcx, [rsp + 0xe8]
call fcn.140089020
mov rax, r15
jmp 0x14008a5b2
mov eax, dword [rsp + 0xd4]
dec eax
cmp eax, 1
ja 0x14008a84e
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], si
mov r8, r13
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x14008a7c0
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140002fb0
nop
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], si
mov r8, r13
inc r8
cmp word [rdi + r8*2], 0
jne 0x14008a800
mov rdx, rdi
lea rcx, [rsp + 0x90]
call fcn.140002fb0
nop
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xe0]
call fcn.140087810
nop
lea rcx, [rsp + 0x90]
call fcn.14000d700
lea rcx, [rsp + 0x70]
call fcn.14000d700
inc r14d
jmp 0x14008a680
test rbx, rbx
je 0x14008a864
mov rcx, rbx
call fcn.140074f80
nop
test rdi, rdi
je 0x14008a872
mov rcx, rdi
call fcn.140074f80
nop
jmp 0x14008a87b
lea rdx, [rsp + 0xe0]
mov rcx, r15
call fcn.1400886b0
nop
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf8]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008a589
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008a589
call fcn.140103230
int3
call fcn.140103230
int3