Function at 0x1400410e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xf8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x70], 0xfffffffffffffffe
mov rsi, rcx
lea rdx, [0x14021c6f3]
lea rcx, [rbp + 0x30]
mov r8d, 0x12
call fcn.140041880
movabs rdi, 0x8000000000000000
cmp qword [rbp + 0x30], rdi
jne 0x140041142
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x18], 1
mov qword [rbp + 0x20], 0
jmp 0x140041152
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x20], rax
movups xmm0, xmmword [rbp + 0x30]
movaps xmmword [rbp + 0x10], xmm0
lea rdx, [0x14021c6f3]
lea rcx, [rbp + 0x30]
mov r8d, 0x12
call fcn.140041880
mov rax, qword [rbp + 0x30]
xor edx, edx
cmp rax, rdi
mov ecx, 1
cmovne rcx, qword [rbp + 0x38]
cmove rax, rdx
mov qword [rbp + 0x68], rax
cmovne rdx, qword [rbp + 0x40]
mov qword [rbp + 8], rcx
call fcn.140202340
mov rdi, rax
mov rdx, qword [rbp + 0x68]
test rdx, rdx
je 0x1400411ac
mov r8d, 1
mov rcx, qword [rbp + 8]
call fcn.140022d50
test dil, 1
jne 0x1400411c8
shr rdi, 0x20
mov r15d, 0xb
cmp edi, 0x55ef
ja 0x14004135a
lea rax, [0x14021c6c7]
mov qword [rbp + 0x30], rax
lea rax, [0x14021c6f3]
mov qword [rbp + 0x38], rax
mov word [rbp + 0x40], 0
mov dword [rbp + 0x48], 1
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x30]
call fcn.140033a70
lea rax, [0x14021c705]
mov qword [rbp + 0x30], rax
lea rax, [0x14021c71e]
mov qword [rbp + 0x38], rax
mov word [rbp + 0x40], 0
mov dword [rbp + 0x48], 1
lea rcx, [rbp - 0x18]
lea rbx, [rbp + 0x30]
mov rdx, rbx
call fcn.140033a70
mov rdi, qword [rbp - 0x28]
call fcn.140018590
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x20], rbx
mov rcx, 0xffffffff80000002
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140041298
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x140041275
mov rcx, qword [rbp - 0x10]
add rdx, rdx
mov r8d, 2
call fcn.140022d50
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x140041357
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140022d50
jmp 0x140041357
mov rcx, qword [rbp + 0x30]
mov dword [rbp + 0x2c], 4
mov dword [rbp + 0x64], 0
mov r14, qword [rbp - 0x10]
mov dword [rbp + 0x30], 0
lea rax, [rbp + 0x2c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x64]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
mov qword [rbp + 0x68], rcx
mov rdx, r14
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x14004130f
movzx ecx, bx
or ecx, 0x80070000
test ebx, ebx
cmovle ecx, ebx
call fcn.1400460f0
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x40], edx
mov byte [rbp + 0x30], 1
test rax, rax
je 0x140041315
lea rcx, [rbp + 0x38]
call fcn.1400460b0
jmp 0x140041315
mov r15d, dword [rbp + 0x64]
jmp 0x140041315
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x140041339
add rdx, rdx
mov r8d, 2
mov rcx, r14
call fcn.140022d50
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x140041353
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140022d50
test ebx, ebx
je 0x14004135a
xor r15d, r15d
mov dword [rbp - 0x30], r15d
lea rax, [rbp - 0x30]
mov qword [rbp - 0x18], rax
lea rax, [0x140203690]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x10]
mov qword [rbp - 8], rax
lea rax, [0x140008a90]
mov qword [rbp], rax
lea rax, [0x14021c728]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], 3
mov qword [rbp + 0x50], 0
lea rax, [rbp - 0x18]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], 2
lea rcx, [rbp - 0x48]
lea rdx, [rbp + 0x30]
call fcn.1401f56d0
mov rax, qword [rbp - 0x38]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x10]
test rdx, rdx
je 0x1400413e3
mov rcx, qword [rbp + 0x18]
mov r8d, 1
call fcn.140022d50
mov rax, rsi
add rsp, 0xf8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret