Function at 0x1400249e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1100]
mov eax, 0x1200
call fcn.14009c790
sub rsp, rax
mov rax, qword [0x1401198e8]
xor rax, rsp
mov qword [rbp + 0x10f0], rax
movzx r14d, r8b
mov byte [rsp + 0x34], r8b
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov qword [rbp + 0x20], rcx
mov dword [rsp + 0x30], 1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor r15d, r15d
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 7
mov word [rcx], r15w
lea r12, [rcx + 0x20]
mov qword [rbp + 0x60], r12
movups xmmword [r12], xmm0
mov qword [r12 + 0x10], r15
mov qword [r12 + 0x18], 7
mov word [r12], r15w
lea r13, [rcx + 0x40]
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], r15
mov qword [r13 + 0x18], 7
mov word [r13], r15w
lea rax, [rcx + 0x60]
mov qword [rbp - 0x68], rax
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rax, [rcx + 0x80]
mov qword [rbp - 0x70], rax
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov dword [rsp + 0x30], 1
mov qword [rbp + 0x58], r15
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x1400254e0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, str.CLSID_
lea rcx, [rsp + 0x40]
call fcn.1400062d0
lea rsi, [r15 - 1]
test al, al
jne 0x140024b29
mov rax, rsi
lea rdx, str.CLSID_
inc rax
cmp word [rdx + rax*2], 0
jne 0x140024b11
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.1400068f0
nop
mov r8, rbx
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x58]
call fcn.140006020
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140024b59
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
test r14b, r14b
je 0x140024d22
call fcn.14002dc10
test al, al
je 0x140024d22
mov qword [rsp + 0x48], r15
mov rax, qword [rbp + 0x58]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x140024b8f
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140024ba0
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x1400254eb
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x30], 0x41
mov r15, qword [rbp + 0x58]
movsxd r12, dword [r15 - 0x10]
lea rdx, str.Wow6432Node_
mov rdi, rsi
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x140024bd2
lea r14d, [r12 + rdi]
test r14d, r14d
js 0x1400254f6
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x140024c14
mov edx, r14d
lea rcx, [rsp + 0x48]
call fcn.140006870
mov rbx, qword [rsp + 0x48]
lea rdx, str.Wow6432Node_
movsxd rax, edi
lea rdi, [rax + rax]
test rdi, rdi
je 0x140024c42
test rbx, rbx
jne 0x140024c37
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x140024c42
mov r8, rdi
mov rcx, rbx
call fcn.14009d3c0
mov r8, r12
add r8, r8
lea rcx, [rdi + rbx]
je 0x140024c79
test rcx, rcx
je 0x140024c69
test r15, r15
je 0x140024c62
mov rdx, r15
call fcn.14009d3c0
jmp 0x140024c79
xor edx, edx
call fcn.14009e880
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
lea rdi, [rbx - 0x18]
cmp r14d, dword [rdi + 0xc]
jg 0x1400254f6
mov dword [rdi + 8], r14d
movsxd rax, r14d
xor ecx, ecx
mov word [rbx + rax*2], cx
mov r14, qword [rbp + 0x58]
add r14, 0xffffffffffffffe8
cmp rdi, r14
je 0x140024cf9
mov eax, dword [r14 + 0x10]
shr eax, 0x1f
test al, al
jne 0x140024ce9
mov rax, qword [r14]
cmp qword [rdi], rax
jne 0x140024ce9
mov rcx, rdi
call fcn.140006780
mov rbx, rax
mov ecx, esi
lock xadd dword [r14 + 0x10], ecx
sub ecx, 1
jg 0x140024cdf
mov r9, qword [r14]
mov rcx, qword [r9]
mov r8, qword [rcx + 8]
mov rdx, r14
mov rcx, r9
call r8
lea rax, [rbx + 0x18]
mov qword [rbp + 0x58], rax
jmp 0x140024cf9
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 0x58]
call fcn.1400068f0
mov dword [rsp + 0x30], 1
mov eax, esi
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x140024d19
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + VariantCopy]
mov rdi, qword [rsp + 0x38]
mov r12, qword [rbp + 0x60]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], rax
lea r9d, [rax + 1]
mov r8, qword [rbp + 0x58]
mov rdx, 0xffffffff80000000
lea rcx, [rbp + 0xd0]
call fcn.140027410
nop
mov r15, qword [rbp + 0xd0]
test r15, r15
jne 0x140024d81
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400254ad
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x1400254ad
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xor ebx, ebx
mov qword [rbp + 0x90], rbx
mov dword [rbp + 0x98], ebx
mov qword [rbp + 0xa0], rbx
mov byte [rdi + 0xa0], 1
lea r9d, [rbx + 1]
lea r8, str.InprocServer32
mov rdx, r15
lea rcx, [rbp + 0x90]
call fcn.140013900
mov r14, qword [rbp + 0x90]
test r14, r14
jne 0x140024dff
lea r9d, [rbx + 1]
lea r8, str.LocalServer32
mov rdx, r15
lea rcx, [rbp + 0x90]
call fcn.140013900
mov byte [rdi + 0xa0], r14b
mov r14, qword [rbp + 0x90]
test r14, r14
je 0x140025477
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1400f80d0]
movdqu xmmword [rbp - 0x50], xmm1
mov word [rbp - 0x60], bx
mov dword [rsp + 0x30], 0x11
mov dword [rbp + 0x50], 0x800
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x88]
xor r8d, r8d
lea rdx, [0x1400f1b38]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140024e60
cmp eax, 0xd
jne 0x140024e9f
jmp 0x140024e7a
mov eax, dword [rbp + 0x88]
dec eax
cmp eax, 1
ja 0x140024e7a
cmp dword [rbp + 0x50], 0
jne 0x140024e7a
mov word [rbp + 0xf0], bx
lea rax, [rbp + 0xf0]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x140024e84
lea rdx, [rbp + 0xf0]
lea rcx, [rbp - 0x60]
call fcn.140003510
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.140005f80
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140024eed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024ee7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400254da
call fcn.14009bfe4
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], rbx
mov qword [rbp + 0x80], 7
mov word [rbp + 0x68], bx
mov dword [rsp + 0x30], 0x21
mov dword [rbp + 0x54], 0x800
lea rax, [rbp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x8f0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x60]
xor r8d, r8d
lea rdx, [0x1400f1b38]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140024f4d
cmp eax, 0xd
jne 0x140024f8b
jmp 0x140024f64
mov eax, dword [rbp + 0x60]
dec eax
cmp eax, 1
ja 0x140024f64
cmp dword [rbp + 0x54], 0
jne 0x140024f64
mov word [rbp + 0x8f0], bx
lea rax, [rbp + 0x8f0]
mov r8, rsi
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140024f70
lea rdx, [rbp + 0x8f0]
lea rcx, [rbp + 0x68]
call fcn.140003510
lea rdx, [rbp + 0x68]
cmp qword [rbp + 0x80], 8
cmovae rdx, qword [rbp + 0x68]
mov rax, qword [rbp + 0x78]
test rax, rax
je 0x140024fd4
mov rcx, rdx
mov rdi, rbx
cmp word [rdx], 0x25
je 0x140024fc4
cmp rax, 1
je 0x140024fc7
dec rax
add rcx, 2
cmp word [rcx], 0x25
jne 0x140024fb1
mov rdi, rcx
test rdi, rdi
je 0x140024fd4
sub rdi, rdx
sar rdi, 1
jmp 0x140024fd7
mov rdi, rsi
lea rcx, [rbp + 0x68]
call fcn.14002e1f0
lea rax, [rbp + 0x68]
cmp r13, rax
je 0x140025056
mov rdx, qword [r13 + 0x18]
cmp rdx, 8
jb 0x140025029
mov rcx, qword [r13]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140025024
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140025501
mov rcx, r8
call fcn.14009bfe4
mov qword [r13 + 0x18], 7
movups xmm0, xmmword [rbp + 0x68]
movups xmmword [r13], xmm0
movups xmm1, xmmword [rbp + 0x78]
movups xmmword [r13 + 0x10], xmm1
mov qword [rbp + 0x78], rbx
mov qword [rbp + 0x80], 7
mov word [rbp + 0x68], bx
mov rax, qword [rsp + 0x38]
mov rdx, r13
cmp byte [rax + 0xa0], 0
je 0x140025078
lea rcx, [rbp + 0x30]
call fcn.1400132f0
nop
mov ebx, 0x23
jmp 0x140025086
lea rcx, [rbp - 0x40]
call fcn.14002c0f0
mov ebx, 0x25
mov dword [rsp + 0x30], ebx
mov rdx, rax
mov rcx, r12
call fcn.140005f80
test bl, 4
je 0x1400250f8
and ebx, 0xfffffffb
mov dword [rsp + 0x30], ebx
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x1400250e1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400250dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025507
call fcn.14009bfe4
movdqa xmm0, xmmword [0x1400f80d0]
movdqu xmmword [rbp - 0x30], xmm0
xor r13d, r13d
mov word [rbp - 0x40], r13w
jmp 0x1400250fb
xor r13d, r13d
test bl, 2
je 0x140025147
and ebx, 0xfffffffd
mov dword [rsp + 0x30], ebx
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x140025147
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025142
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002550d
call fcn.14009bfe4
cmp byte [rsp + 0x34], 0
je 0x14002515c
cmp rdi, 0xffffffffffffffff
je 0x14002515c
mov rcx, r12
call fcn.14002e8b0
cmp byte [0x14011a5a4], 0
jne 0x140025433
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xa8], xmm0
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], rax
cmp qword [r12 + 0x18], 8
jb 0x14002518f
mov r12, qword [r12]
mov rdx, r12
lea rcx, [rbp + 0xa8]
call fcn.140003280
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 7
mov edx, 0x10
lea rcx, [rsp + 0x50]
call fcn.1400037f0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0xb
mov qword [rsp + 0x68], 0xf
movups xmm0, xmmword [0x1400f4ff0]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400f5000]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x1400f5004]
mov word [rax + 0x14], cx
mov word [rax + 0x16], r13w
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0xa8]
call fcn.140003390
mov rdx, rax
mov rcx, qword [rbp - 0x70]
call fcn.140005f80
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14002525f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002525a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025513
call fcn.14009bfe4
movdqa xmm0, xmmword [0x1400f80d0]
movdqu xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x20], r13w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400252b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400252ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025519
call fcn.14009bfe4
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov edx, 0x10
lea rcx, [rsp + 0x70]
call fcn.1400037f0
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x80], 0xb
mov qword [rbp - 0x78], 0xf
movups xmm0, xmmword [str.Description]
movups xmmword [rax], xmm0
mov edx, dword [0x1400f5018]
mov dword [rax + 0x10], edx
movzx edx, word [0x1400f501c]
mov word [rax + 0x14], dx
mov word [rax + 0x16], r13w
lea r8, [rsp + 0x70]
lea rdx, [rbp]
lea rcx, [rbp + 0xa8]
call fcn.140003390
mov rdx, rax
mov rcx, qword [rbp - 0x68]
call fcn.140005f80
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x14002536f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002536a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002551f
call fcn.14009bfe4
movdqa xmm0, xmmword [0x1400f80d0]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], r13w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400253c3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400253bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025525
call fcn.14009bfe4
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 8
jb 0x140025409
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025404
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002552b
call fcn.14009bfe4
movdqa xmm0, xmmword [0x1400f80d0]
movdqu xmmword [rbp + 0xc0], xmm0
mov word [rbp + 0xb0], r13w
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x140025433
call fcn.14009bfe4
nop
mov rdx, qword [rbp + 0x80]
cmp rdx, 8
jb 0x140025472
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002546d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400254da
call fcn.14009bfe4
mov rdi, qword [rsp + 0x38]
test r14, r14
je 0x140025486
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400254ad
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rVariantCopy + 8]
nop
mov rax, rdi
mov rcx, qword [rbp + 0x10f0]
xor rcx, rsp
call fcn.14009c570
mov rbx, qword [rsp + 0x1250]
add rsp, 0x1200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400a3080
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80070057
call fcn.140007f00
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
int3