Function at 0x140041940
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x1400f63f8]
xor rax, rsp
mov qword [rbp + 0xf8], rax
mov r11, r9
mov rcx, r8
mov rbx, rdx
mov qword [rsp + 0x30], rdx
mov r15, qword [rbp + 0x160]
xor r12d, r12d
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400419cc
mov dword [rsp + 0x40], eax
call fcn.140003900
mov qword [rsp + 0x48], rax
mov byte [rbx + 0x40], r12b
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
jmp 0x140041f4e
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x60], r12b
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x3c], r12d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x140041a2f
call fcn.140003900
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x40]
mov byte [rbx + 0x40], 0
movups xmmword [rbx], xmm0
jmp 0x140041f3e
mov ecx, dword [rsp + 0x38]
test ecx, ecx
jne 0x140041a48
mov dword [rsp + 0x40], 0x81
lea rax, [0x1400f7028]
jmp 0x140041a19
mov eax, dword [rsp + 0x3c]
sub eax, 1
je 0x140041d89
cmp eax, 3
je 0x140041a6b
mov dword [rsp + 0x40], 0x81
lea rax, [0x1400f7028]
jmp 0x140041a19
mov dword [rsp + 0x40], r12d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x140041abf
call fcn.140003900
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rsp + 0x58]
mov byte [rbx + 0x40], 0
movups xmmword [rbx], xmm0
jmp 0x140041f3e
lea rax, [0x1400c7de8]
mov qword [rbp - 0x50], rax
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x68], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x70], xmm0
mov dword [rsp + 0x50], 8
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x34], 0x78
xor r8d, r8d
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x38]
call fcn.140038fe0
nop
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx - 0x50], rax
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx - 0x54], edx
lea rax, vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp - 0x48], rax
mov ecx, 0x10
call fcn.140084c04
mov rdi, rax
test rax, rax
je 0x140041b55
mov cl, 1
call fcn.14005d95c
mov qword [rdi + 8], rax
jmp 0x140041b58
mov rdi, r12
mov qword [rbp + 0x18], rdi
lea rax, [rbp - 0x40]
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x38]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x18]
mov qword [rbp - 8], rax
lea rax, [rbp]
mov qword [rbp + 8], rax
lea rax, [rbp + 4]
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x18], r12
mov qword [rbp], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x20], r12
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x20], r12
mov dword [rbp + 0x28], 4
mov edx, dword [rsp + 0x40]
lea rcx, [rbp - 0x50]
call fcn.140041100
nop
mov qword [rbp + 0xb8], r12
mov qword [rbp + 0xc8], r12
mov qword [rbp + 0xd0], 7
mov word [rbp + 0xb8], r12w
mov dword [rsp + 0x50], 0x48
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov ecx, dword [rbp + 0x28]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x140041c26
mov rax, qword [rbp - 8]
mov r8, qword [rax]
test r8, r8
je 0x140041c26
mov rax, qword [rbp - 0x28]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x20]
cmovb r8, qword [rbp + 0x20]
sub r8, rdx
sar r8, 1
jmp 0x140041c61
test cl, 4
jne 0x140041c53
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
test rcx, rcx
je 0x140041c53
mov rax, qword [rbp - 0x30]
mov rdx, qword [rax]
mov rax, qword [rbp + 8]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
jmp 0x140041c61
mov r8, qword [rbp + 0xa8]
mov rdx, qword [rbp + 0xa0]
test rdx, rdx
je 0x140041c73
lea rcx, [rbp + 0xb8]
call fcn.140003b60
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
lea rdx, [rbp + 0xb8]
lea rcx, [rsp + 0x68]
call fcn.140005910
lea rax, fcn.140029330
mov qword [rbp - 0x68], rax
lea rax, vtable.type_info.0
or rax, 2
mov qword [rbp - 0x60], rax
mov byte [rbx + 0x40], 1
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.1400436d0
nop
mov rax, qword [rbp - 0x60]
and eax, 3
sub rax, 1
je 0x140041d09
cmp rax, 1
jne 0x140041d30
mov rax, qword [rbp - 0x68]
mov rdx, qword [rax]
lea rax, [fcn.140029330]
lea rcx, [rsp + 0x68]
cmp rdx, rax
jne 0x140041d27
call fcn.140002410
jmp 0x140041d30
mov rax, qword [rbp - 0x68]
mov rdx, qword [rax]
lea rax, [fcn.140029330]
mov rcx, qword [rbp - 0x70]
cmp rdx, rax
jne 0x140041d27
call fcn.140002410
jmp 0x140041d30
mov rax, rdx
call qword [case.0x14005a798.0]
mov qword [rbp - 0x60], r12
mov rdx, qword [rbp + 0xd0]
cmp rdx, 8
jb 0x140041d7b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041d75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041f72
call fcn.140084c40
nop
lea rcx, [rbp - 0x50]
call fcn.1400413f0
jmp 0x140041f3e
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov r14, rax
mov rsi, 0xffffffffffffffff
cmovo r14, rsi
mov rcx, r14
call fcn.140085688
mov rdi, rax
test rax, rax
je 0x140041dc4
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.1400878c0
jmp 0x140041dc7
mov rdi, r12
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, eax
test eax, eax
je 0x140041e16
call fcn.140003900
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x60], rax
mov byte [rbx + 0x40], 0
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rbx], xmm0
jmp 0x140041f30
mov eax, dword [rsp + 0x38]
shr rax, 1
mov word [rdi + rax*2], r12w
mov qword [rbp + 0xc0], r12
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], r12
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xb8], r12
movdqa xmm0, xmmword [0x1400de3f0]
movdqu xmmword [rbp + 0xc8], xmm0
nop dword [rax]
inc rsi
cmp word [rdi + rsi*2], 0
jne 0x140041e60
mov r8, rsi
mov rdx, rdi
lea rcx, [rbp + 0xb8]
call fcn.140003b60
lea rax, fcn.140029330
mov qword [rbp + 0xe8], rax
lea rax, vtable.type_info.0
or rax, 2
mov qword [rbp + 0xf0], rax
mov byte [rbx + 0x40], 1
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
lea rdx, [rbp + 0xb8]
mov rcx, rbx
call fcn.1400436d0
nop
mov rax, qword [rbp + 0xf0]
and eax, 3
sub rax, 1
je 0x140041efc
cmp rax, 1
jne 0x140041f29
mov rax, qword [rbp + 0xe8]
mov rdx, qword [rax]
lea rax, [fcn.140029330]
lea rcx, [rbp + 0xb8]
cmp rdx, rax
jne 0x140041f20
call fcn.140002410
jmp 0x140041f29
mov rax, qword [rbp + 0xe8]
mov rdx, qword [rax]
lea rax, [fcn.140029330]
mov rcx, qword [rbp + 0xe0]
cmp rdx, rax
jne 0x140041f20
call fcn.140002410
jmp 0x140041f29
mov rax, rdx
call qword [case.0x14005a798.0]
mov qword [rbp + 0xf0], r12
test rdi, rdi
je 0x140041f3e
mov rcx, rdi
call fcn.140084c40
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140041f4e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rbp + 0xf8]
xor rcx, rsp
call fcn.140085660
add rsp, 0x200
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14008c334
nop
int3