Function at 0x14001ce50
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov qword [rbp + 0x2f], 0xfffffffffffffffe
mov rbx, rcx
xor r12d, r12d
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 9], rax
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 1], rax
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 7], rax
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xf], rax
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 2
mov dword [rbp + 0x23], 2
mov byte [rbp + 0x27], r12b
mov dword [rbp + 0x2b], r12d
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x29], rax
or rsi, 0xffffffffffffffff
test rbx, rbx
je 0x14001cf62
test rbx, 0xffffffffffff0000
jne 0x14001cf4f
movzx edi, bx
mov ecx, edi
call fcn.140003200
test rax, rax
je 0x14001cf75
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.14000a630
jmp 0x14001cf75
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x14001cf65
mov ecx, r12d
mov r8d, ecx
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000a480
nop
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x29]
call fcn.14001d490
movzx edi, al
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14001cfa3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test dil, dil
je 0x14001d10f
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x21], rax
mov r9, rbx
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionExtSettings
lea rdx, str._s_s
lea rcx, [rbp - 0x21]
call fcn.14000b330
mov dword [rbp + 0x6f], r12d
mov qword [rbp - 0x19], r12
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdi, qword [rbp - 0x21]
mov rdx, rdi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001d053
mov dword [rbp + 0x7f], 4
mov dword [rbp + 0x77], 4
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.Flags
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x11], rax
lea r9, [rbp - 0x11]
lea r8, str.Version
mov rdx, rdi
mov rcx, 0xffffffff80000001
call fcn.14000e7a0
mov edx, dword [rbp + 0x6f]
and dl, 1
cmp dl, 1
setne byte [rbp + 0x27]
mov rbx, qword [rbp - 0x11]
test rbx, rbx
jne 0x14001d0a1
mov ecx, r12d
jmp 0x14001d0b2
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rbp + 0x17]
call fcn.14000a480
mov rdx, qword [rbp + 7]
cmp dword [rdx - 0x10], 0
je 0x14001d0d7
movzx eax, byte [rbp + 0x27]
neg al
sbb ecx, ecx
lea r12d, [rcx + 2]
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001d0f2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x14001d10f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rbp - 9]
call fcn.140013fc0
mov eax, r12d
add rsp, 0x90
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret