Function at 0x1400ea1e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x14039bc30]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r15, rdx
mov r12, rcx
mov qword [rsp + 0x60], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [r11 - 0x78], xmm0
movups xmmword [r11 - 0x68], xmm0
movups xmmword [r11 - 0x58], xmm0
movss dword [rsp + 0xe0], xmm0
xor esi, esi
mov qword [r11 - 0x80], rsi
mov qword [r11 - 0x78], rsi
lea ecx, [rsi + 0x50]
call fcn.14013afa8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf8], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x118], 8
movss xmm0, dword [0x14034ce48]
movss dword [rsp + 0xe0], xmm0
mov r8, rax
lea edx, [rsi + 0x10]
lea rcx, [rsp + 0xf8]
call fcn.140029320
nop
mov dword [rsp + 0xd0], esi
mov dword [rsp + 0xc8], esi
mov dword [rsp + 0xcc], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0xcc]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x1400ea3bf
lea rdx, [rsp + 0xe0]
mov rcx, r15
call fcn.140059bd0
nop
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf8]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov r8, rcx
cmp rdx, 0x1000
jb 0x1400ea369
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x1400ea6ac
call fcn.14013afa0
xorps xmm0, xmm0
mov qword [rsp + 0xf8], rsi
movdqa xmmword [rsp + 0x100], xmm0
lea rcx, [rsp + 0xe8]
call fcn.140028f10
mov rax, r15
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14013af80
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
inc dword [rsp + 0xcc]
inc dword [rsp + 0xc8]
mov ecx, dword [rsp + 0xcc]
mov eax, 2
mul rcx
mov rbx, rax
mov r13, 0xffffffffffffffff
cmovo rbx, r13
mov rcx, rbx
call fcn.14013b750
mov rdi, rax
test rax, rax
je 0x1400ea409
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14013d7a0
jmp 0x1400ea40c
mov rdi, rsi
mov qword [rsp + 0x120], rdi
mov ecx, dword [rsp + 0xc8]
mov eax, 2
mul rcx
mov r14, rax
cmovo r14, r13
mov rcx, r14
call fcn.14013b750
mov rbx, rax
test rax, rax
je 0x1400ea449
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.14013d7a0
jmp 0x1400ea44c
mov rbx, rsi
mov qword [rsp + 0x128], rbx
mov r14d, esi
nop word [rax + rax]
cmp r14d, dword [rsp + 0xd0]
jae 0x1400ea636
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0xdc], eax
mov eax, dword [rsp + 0xcc]
mov dword [rsp + 0xd8], eax
mov dword [rsp + 0xd4], esi
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0xd4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xdc]
mov r8, rbx
mov edx, r14d
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1400ea56c
mov rcx, r15
call fcn.140028e80
nop
test rbx, rbx
je 0x1400ea4ec
mov rcx, rbx
call fcn.14013afa0
nop
test rdi, rdi
je 0x1400ea4fa
mov rcx, rdi
call fcn.14013afa0
nop
mov rax, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf8]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ea53e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ea6b2
call fcn.14013afa0
mov qword [rsp + 0xf8], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x100], xmm0
lea rcx, [rsp + 0xe8]
call fcn.140028f10
mov rax, r15
jmp 0x1400ea392
mov eax, dword [rsp + 0xd4]
dec eax
cmp eax, 1
ja 0x1400ea62e
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], si
mov r8, r13
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400ea5a0
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140032810
nop
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], si
mov r8, r13
inc r8
cmp word [rdi + r8*2], 0
jne 0x1400ea5e0
mov rdx, rdi
lea rcx, [rsp + 0x90]
call fcn.140032810
nop
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xe0]
call fcn.1400e8d00
nop
lea rcx, [rsp + 0x90]
call fcn.140033a90
lea rcx, [rsp + 0x70]
call fcn.140033a90
inc r14d
jmp 0x1400ea460
test rbx, rbx
je 0x1400ea644
mov rcx, rbx
call fcn.14013afa0
nop
test rdi, rdi
je 0x1400ea652
mov rcx, rdi
call fcn.14013afa0
nop
jmp 0x1400ea65b
lea rdx, [rsp + 0xe0]
mov rcx, r15
call fcn.140059bd0
nop
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf8]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ea369
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ea369
call fcn.1401421d8
int3
call fcn.1401421d8
int3