Function at 0x1400e2060
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov rdi, r8
mov qword [rsp + 0x38], r8
mov r12, rdx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
lea ebx, [rsi + 0x5c]
mov r15d, 1
lea r13, [rsi - 1]
mov r14d, 7
mov qword [rbp - 0x30], rsi
cmp r15d, 1
jne 0x1400e2305
cmp qword [r12], 0xffffffff80000002
je 0x1400e24c6
mov qword [rsp + 0x70], rsi
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], r14
mov word [rsp + 0x70], si
lea r8d, [r14 + 0x23]
lea rdx, str.MicrosoftWindowsCurrentVersionApp_Paths
lea rcx, [rsp + 0x70]
call fcn.1400739a0
nop
mov qword [rbp - 8], rsi
mov rcx, rsi
mov qword [rbp + 8], rcx
mov edx, r14d
mov qword [rbp + 0x10], rdx
mov word [rbp - 8], si
cmp qword [r12 + 0x18], 0
jbe 0x1400e21c5
lea r9, [r12 + 8]
mov rbx, qword [r9 + 0x10]
cmp qword [r9 + 0x18], 8
jb 0x1400e2133
mov r9, qword [r9]
lea rcx, [rbp - 8]
cmp rbx, 7
ja 0x1400e2154
mov qword [rbp + 8], rbx
lea r8, [rbx + rbx]
mov rdx, r9
call fcn.14035bc80
mov word [rbp + rbx*2 - 8], si
jmp 0x1400e2164
lfence
mov qword [rsp + 0x20], rbx
mov rdx, rbx
call fcn.1400735a0
mov rdx, qword [rbp + 8]
mov r8, qword [rbp + 0x10]
mov rax, r8
sub rax, rdx
cmp rax, 1
jb 0x1400e219c
lea rcx, [rdx + 1]
mov qword [rbp + 8], rcx
lea rax, [rbp - 8]
cmp r8, 8
cmovae rax, qword [rbp - 8]
mov ebx, 0x5c
mov word [rax + rdx*2], bx
mov word [rax + rcx*2], si
jmp 0x1400e21bd
lfence
mov qword [rsp + 0x20], 1
lea r9, [0x1405e45bc]
mov edx, 1
lea rcx, [rbp - 8]
call fcn.1400735a0
mov rcx, qword [rbp + 8]
mov rdx, qword [rbp + 0x10]
lea r9, [rsp + 0x70]
mov rsi, qword [rsp + 0x70]
mov r14, qword [rbp - 0x78]
cmp r14, 8
cmovae r9, rsi
mov rax, rdx
sub rax, rcx
mov r8, qword [rbp - 0x80]
cmp r8, rax
ja 0x1400e221b
lea rdi, [r8 + rcx]
mov qword [rbp + 8], rdi
lea rbx, [rbp - 8]
cmp rdx, 8
cmovae rbx, qword [rbp - 8]
lea rcx, [rbx + rcx*2]
add r8, r8
mov rdx, r9
call fcn.14035bc80
xor eax, eax
mov word [rbx + rdi*2], ax
mov rdi, qword [rsp + 0x38]
jmp 0x1400e2239
lfence
mov rdx, qword [rbp - 0x80]
mov qword [rsp + 0x20], rdx
lea rcx, [rbp - 8]
call fcn.1400735a0
mov r14, qword [rbp - 0x78]
mov rsi, qword [rsp + 0x70]
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rdx, qword [rbp - 8]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
sete bl
mov rdx, qword [rbp + 0x10]
cmp rdx, 8
jb 0x1400e22a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e22a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e2afd
call fcn.140359090
xor eax, eax
mov word [rbp - 8], ax
cmp r14, 8
jb 0x1400e22e9
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400e22e1
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e2b03
mov rcx, rsi
call fcn.140359090
xor esi, esi
mov word [rsp + 0x70], si
test bl, bl
je 0x1400e24c1
mov rcx, qword [rbp - 0x30]
lea r14d, [rsi + 7]
jmp 0x1400e248a
cmp r15d, 2
jne 0x1400e24c6
mov rcx, r12
call fcn.14006ac90
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], r14
mov word [rbp + 0x18], si
mov r8, r13
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400e2330
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.1400739a0
nop
mov rdx, qword [rbp + 0x28]
mov r8, qword [rbp + 0x30]
mov rax, r8
sub rax, rdx
cmp rax, 1
jb 0x1400e237b
lea rcx, [rdx + 1]
mov qword [rbp + 0x28], rcx
lea rax, [rbp + 0x18]
cmp r8, 8
cmovae rax, qword [rbp + 0x18]
mov word [rax + rdx*2], bx
mov word [rax + rcx*2], si
jmp 0x1400e239c
lfence
mov qword [rsp + 0x20], 1
lea r9, [0x1405e45bc]
mov edx, 1
lea rcx, [rbp + 0x18]
call fcn.1400735a0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
mov rax, rdx
sub rax, rcx
cmp rax, 0x2a
jb 0x1400e23e6
lea rdi, [rcx + 0x2a]
mov qword [rbp + 0x28], rdi
lea rbx, [rbp + 0x18]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x18]
lea rcx, [rbx + rcx*2]
mov r8d, 0x54
lea rdx, str.MicrosoftWindowsCurrentVersionApp_Paths
call fcn.14035bc80
mov word [rbx + rdi*2], si
mov rdi, qword [rsp + 0x38]
jmp 0x1400e2407
lfence
mov qword [rsp + 0x20], 0x2a
lea r9, str.MicrosoftWindowsCurrentVersionApp_Paths
mov edx, 0x2a
lea rcx, [rbp + 0x18]
call fcn.1400735a0
lea rdx, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae rdx, qword [rbp + 0x18]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp - 0x30]
test eax, eax
cmovne rcx, rsi
mov qword [rbp - 0x30], rcx
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x1400e2486
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e247d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e2b09
call fcn.140359090
mov rcx, qword [rbp - 0x30]
mov word [rbp + 0x18], si
test rcx, rcx
je 0x1400e24c1
mov dword [rbp + 0x38], 0x208
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400e24a3
mov rdx, qword [rdi]
lea r9, [rbp + 0x38]
lea r8, [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ebx, eax
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1400e250f
mov ebx, 0x5c
inc r15d
cmp r15d, 2
jle 0x1400e20b4
mov rdx, rdi
mov rcx, qword [rsp + 0x60]
call fcn.1400733c0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x3d8]
add rsp, 0x380
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r14
mov word [rsp + 0x40], si
lea rax, [rbp + 0x60]
mov r15, 0xffffffffffffffff
mov r8, r15
inc r8
cmp word [rax + r8*2], 0
jne 0x1400e2531
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1400739a0
nop
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x68], rbx
test rbx, rbx
jne 0x1400e2590
mov rsi, qword [rsp + 0x60]
xor ecx, ecx
mov qword [rsi], rcx
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rcx
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rax, qword [rsp + 0x40]
movups xmm0, xmmword [rax]
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], r14
jmp 0x1400e2ab1
lea rsi, [rbx + 1]
mov eax, 0x104
cmp rsi, rax
cmovb rsi, rax
mov qword [rsp + 0x38], rsi
mov eax, 2
mul rsi
cmovo rax, r15
mov rcx, rax
call fcn.140368330
mov r14, rax
test rax, rax
jne 0x1400e2667
mov rsi, qword [rsp + 0x60]
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rax
mov rbx, qword [rsp + 0x50]
lea rdi, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdi, qword [rsp + 0x40]
cmp rbx, 8
jae 0x1400e260a
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
mov r13d, 7
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], r13
jmp 0x1400e2ab1
mov r13, rbx
or r13, 7
movabs rax, 0x7ffffffffffffffe
cmp r13, rax
cmova r13, rax
lea rcx, [r13 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400e2b0f
lfence
add rcx, rcx
call fcn.140073800
mov qword [rsi], rax
lea r8, [rbx*2 + 2]
mov rdx, rdi
mov rcx, rax
call fcn.14035bc80
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], r13
jmp 0x1400e2ab1
lea r13, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
jb 0x1400e267e
mov r13, qword [rsp + 0x40]
test r13, r13
je 0x1400e26b2
cmp word [r13], 0x22
jne 0x1400e26b2
lea rdi, [r13 + 2]
mov edx, 0x22
mov rcx, rdi
call fcn.14035b3bc
test rax, rax
je 0x1400e277d
sub rax, rdi
sar rax, 1
lea rbx, [rax + rax]
mov rdx, rdi
jmp 0x1400e2791
mov r12, r13
test r13, r13
je 0x1400e277d
mov ecx, 0x2e
call fcn.140383514
movzx edi, ax
mov word [rsp + 0x30], ax
mov ecx, 0x2e
call fcn.140375d24
movzx ecx, ax
mov word [rsp + 0x32], ax
movzx eax, word [r13]
test ax, ax
je 0x1400e277d
lea r15, [r13 + 2]
cmp ax, di
je 0x1400e26fe
cmp ax, cx
jne 0x1400e275a
lea rdi, [0x140607b3a]
test r15, r15
je 0x1400e2755
mov rsi, r15
nop dword [rax]
cmp word [rsi], 0
je 0x1400e2746
test rdi, rdi
je 0x1400e2746
movzx ecx, word [rdi]
test cx, cx
je 0x1400e2831
call fcn.140383514
movzx ebx, ax
movzx ecx, word [rsi]
call fcn.140383514
cmp ax, bx
jne 0x1400e2746
add rdi, 2
add rsi, 2
jne 0x1400e2710
cmp word [rdi], 0
je 0x1400e2831
movzx ecx, word [rsp + 0x32]
movzx edi, word [rsp + 0x30]
add r12, 2
add r15, 2
movzx eax, word [r12]
test ax, ax
jne 0x1400e26f4
mov rbx, qword [rsp + 0x68]
mov r15, 0xffffffffffffffff
mov rsi, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
add rbx, rbx
mov r8, rbx
mov rcx, r14
call fcn.14035bc80
xor r12d, r12d
mov word [r14 + rbx], r12w
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x18], r12
mov r13d, 7
mov qword [rbp - 0x10], r13
mov word [rbp - 0x28], r12w
cmp word [r14], 0x25
jne 0x1400e28f0
lea rax, str._ProgramFiles_
mov qword [rbp + 0x40], rax
lea rax, str._ProgramW6432_
mov qword [rbp + 0x48], rax
lea rax, str._CommonProgramFiles_
mov qword [rbp + 0x50], rax
lea rax, str._CommonProgramW6432_
mov qword [rbp + 0x58], rax
lea rdi, [rbp + 0x40]
nop word [rax + rax]
mov rdx, qword [rdi]
mov rbx, r15
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x1400e2806
mov r8, rbx
mov rcx, r14
call fcn.14036ef28
test eax, eax
je 0x1400e2843
add rdi, 0x10
lea rax, [rbp + 0x60]
cmp rdi, rax
jne 0x1400e2800
jmp 0x1400e28e5
mov rbx, r12
sub rbx, r13
sar rbx, 1
add rbx, 4
jmp 0x1400e2771
mov rdx, qword [rdi + 8]
mov r8, r15
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400e2850
lea rcx, [rbp - 0x28]
call fcn.1400739a0
lea r9, [r14 + rbx*2]
mov rdx, r15
nop dword [rax + rax]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x1400e2870
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
sub rax, rcx
lfence
cmp rdx, rax
ja 0x1400e28be
mov rdi, qword [rbp - 0x18]
add rdi, rdx
mov qword [rbp - 0x18], rdi
lea rbx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rbx, qword [rbp - 0x28]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
mov rdx, r9
call fcn.14035bc80
mov word [rbx + rdi*2], r12w
jmp 0x1400e28cc
mov qword [rsp + 0x20], rdx
lea rcx, [rbp - 0x28]
call fcn.1400735a0
lea r8, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r8, qword [rbp - 0x28]
mov rdx, rsi
mov rcx, r14
call fcn.140368338
mov edx, esi
mov rcx, r14
call qword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
mov rax, r15
inc rax
cmp word [r14 + rax*2], 0
jne 0x1400e28f3
cmp rax, 1
jbe 0x1400e2954
lfence
nop word [rax + rax]
movzx ecx, word [r14 + rax*2 - 2]
cmp cx, 0x20
jne 0x1400e2926
dec rax
mov word [r14 + rax*2], r12w
jmp 0x1400e294e
cmp cx, 0x22
jne 0x1400e2954
mov word [r14 + rax*2 - 2], r12w
mov edx, 0x22
mov rcx, r14
call fcn.14035b2dc
test rax, rax
je 0x1400e2954
mov word [rax], r12w
sub rax, r14
sar rax, 1
cmp rax, 1
ja 0x1400e2910
mov r8, r15
nop word [rax + rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x1400e2960
mov rdx, r14
lea rcx, [rbp - 0x28]
call fcn.1400739a0
mov rcx, r14
call fcn.1403683a0
lea rcx, [rbp - 0x28]
call fcn.1401d4ac0
test al, al
je 0x1400e2a14
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov edi, eax
test eax, eax
je 0x1400e2a14
lfence
mov eax, 2
mul rdi
cmovo rax, r15
mov rcx, rax
call fcn.140368330
mov rbx, rax
test rax, rax
je 0x1400e2a14
lfence
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
mov r8d, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1400e2a0c
lfence
inc r15
cmp word [rbx + r15*2], 0
jne 0x1400e29f2
mov r8, r15
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.1400739a0
mov rcx, rbx
call fcn.1403683a0
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r13
mov word [rbp - 0x70], r12w
mov r8, qword [rbp - 0x18]
lea rcx, [rbp - 0x70]
call fcn.1400739a0
nop
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x70]
call fcn.1401d7750
nop
mov rdx, rax
mov rsi, qword [rsp + 0x60]
mov rcx, rsi
call fcn.1400733c0
nop
lea rcx, [rbp - 0x50]
call fcn.140073b90
nop
lea rcx, [rbp - 0x70]
call fcn.140073b90
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x1400e2ab1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e2aab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e2b15
call fcn.140359090
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400e2aef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e2aea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e2af7
call fcn.140359090
mov rax, rsi
jmp 0x1400e24e5
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
int3
call fcn.140368068
nop
call fcn.140073980
int3
call fcn.140368068
int3