Function at 0x1400477b0
Capabilities:
Get thread local storage value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6c0]
sub rsp, 0x7d0
mov rax, qword [0x1400a3758]
xor rax, rsp
mov qword [rbp + 0x6b0], rax
mov r12, rdx
mov r13, rcx
mov qword [rbp + 0x108], rdx
xor r15d, r15d
mov dword [rbp - 0x68], r15d
lea ecx, [r15 + 2]
call fcn.140059d40
mov qword [rbp - 0x70], rax
mov word [rax], r15w
lea ecx, [r15 + 2]
call fcn.140059d40
mov rbx, rax
mov qword [rbp + 0xe8], rax
mov word [rax], r15w
lea ecx, [r15 + 2]
call fcn.140059d40
mov rdi, rax
mov qword [rbp + 0xf0], rax
mov word [rax], r15w
lea ecx, [r15 + 2]
call fcn.140059d40
mov qword [rbp - 0x60], rax
mov word [rax], r15w
lea ecx, [r15 + 2]
call fcn.140059d40
mov qword [rbp - 0x50], rax
mov word [rax], r15w
lea ecx, [r15 + 2]
call fcn.140059d40
mov qword [rbp - 0x58], rax
mov word [rax], r15w
lea ecx, [r15 + 2]
call fcn.140059d40
mov rsi, rax
mov qword [rbp + 0xf8], rax
mov word [rax], r15w
lea ecx, [r15 + 2]
call fcn.140059d40
mov r14, rax
mov qword [rbp + 0x100], rax
mov word [rax], r15w
mov qword [rbp + 0x10], r15
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp + 0x10], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp + 8], r15
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp + 8], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp], r15
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 8], r15
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 8], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x10], r15
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x10], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x18], r15
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x18], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x20], r15
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x20], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, [rbp - 0x20]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x98]
call fcn.14001f610
mov r15, rax
xor ecx, ecx
mov qword [rbp - 0x28], rcx
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x28], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, [rbp - 0x28]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x90]
call fcn.14001f610
nop
mov dword [rsp + 0x80], 0xffffffff
xor edx, edx
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x70], rdx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x58], rdx
lea rcx, [rbp + 8]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 8]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rdx - 1]
mov rcx, r13
call fcn.140014980
mov r15d, eax
mov rcx, qword [rbp + 0x90]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x28]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x98]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x20]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x18]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x10]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 8]
call fcn.140059d2c
nop
mov rcx, qword [rbp]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 8]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x10]
call fcn.140059d2c
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, qword [0x1400a36f8]
call fcn.14001d250
test eax, eax
jne 0x14004824a
lea ecx, [rax + 2]
call fcn.140059d40
mov qword [rbp - 0x80], rax
xor ecx, ecx
mov word [rax], cx
lea r8, [rbp - 0x80]
xor edx, edx
mov rcx, qword [rbp - 0x40]
call fcn.14002d2c0
test eax, eax
jne 0x140048235
nop
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, eax
xor r8d, r8d
mov rdx, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x40]
call fcn.14001d250
test eax, eax
jne 0x1400481fa
mov dword [rbp - 0x38], 0x378
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.PackedCatalogItem
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400481f0
lea ecx, [rax + 0x18]
call fcn.14004bd50
mov rbx, rax
mov qword [rbp + 0x110], rax
xor edi, edi
test rax, rax
je 0x140047b85
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, [rbp + 0x120]
call fcn.14004dff0
mov qword [rbx], rax
jmp 0x140047b88
mov rbx, rdi
test rbx, rbx
je 0x1400482cf
mov rax, qword [rbx]
mov qword [rbp - 0x48], rdi
lea rcx, [0x14007a7c4]
test rax, rax
cmovne rcx, rax
call fcn.140059d48
mov qword [rbp - 0x48], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140047bf6
mov rcx, qword [rbx]
test rcx, rcx
je 0x140047bd7
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rdi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140047be9
call fcn.14004bd8c
mov qword [rbx + 8], rdi
mov edx, 0x18
mov rcx, rbx
call fcn.14004bd8c
mov ecx, 2
call fcn.140059d40
mov qword [rbp + 0x68], rax
mov word [rax], di
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rdi
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp - 0x48]
call fcn.14001e010
xor r9d, r9d
lea r8, [rbp + 0x68]
mov rdx, r13
lea rcx, [rbp + 0xa0]
call fcn.140018960
mov rdx, qword [rax]
mov rbx, qword [rbp - 0x70]
lea rcx, [0x14007a7c4]
test rdx, rdx
cmovne rcx, rdx
call fcn.140059d48
mov qword [rbp - 0x70], rax
mov rcx, rbx
call fcn.140059d2c
mov rcx, qword [rbp + 0xa0]
call fcn.140059d2c
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x60]
mov rdx, qword [rbp - 0x70]
mov rcx, r13
call fcn.1400185f0
mov r14d, eax
mov qword [rbp - 0x78], rdi
mov rdx, qword [rbp - 0x80]
lea rcx, [0x14007a7c4]
test rdx, rdx
cmovne rcx, rdx
call fcn.140059d48
mov qword [rbp - 0x78], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProtocolName
mov rcx, qword [rbp - 0x30]
call fcn.14002d4d0
test eax, eax
jne 0x140047dd0
mov rcx, qword [rbp - 0x78]
cmp word [rcx], 0x40
jne 0x140047dd0
call fcn.140059d48
mov rsi, rax
mov qword [rbp + 0xa8], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov edx, 0x2c
mov rcx, rsi
call fcn.14004eb30
test rax, rax
je 0x140047d29
mov edx, 0x2c
mov rcx, rsi
call fcn.14004eb30
xor ecx, ecx
mov word [rax], cx
lea rcx, [rax + 2]
call fcn.140063f38
cdq
mov edi, eax
xor edi, edx
sub edi, edx
lea rdx, [rsi + 2]
lea rcx, [rbp + 0xb0]
call fcn.14002cd00
mov rdx, qword [rax]
lea rcx, [0x14007a7c4]
test rdx, rdx
cmovne rcx, rdx
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0xa8], rax
mov rcx, rsi
call fcn.140059d2c
mov rcx, qword [rbp + 0xb0]
call fcn.140059d2c
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
je 0x140047dc6
mov r9d, 0x104
lea r8, [rbp + 0x4a0]
mov edx, edi
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x140047dbc
mov rdi, qword [rbp - 0x78]
lea rcx, [rbp + 0x4a0]
call fcn.140059d48
mov qword [rbp - 0x78], rax
mov rcx, rdi
call fcn.140059d2c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rcx, rbx
call fcn.140059d2c
xor edi, edi
lea r9, [rbp - 0x80]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xc0]
call fcn.14001f610
mov rbx, rax
mov qword [rbp + 0x18], rdi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp + 0x18], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, [rbp + 0x18]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xb8]
call fcn.14001f610
nop
lea rcx, [rbp + 0xd8]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x20], rcx
mov r9, rbx
mov r8, rax
lea rdx, [rbp - 0x80]
mov rcx, r13
call fcn.140014330
movzx ebx, al
mov rcx, qword [rbp + 0xb8]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x18]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0xc0]
call fcn.140059d2c
test bl, bl
je 0x140048158
cmp r15d, 0xffffffff
jne 0x140048088
mov qword [rbp + 0x58], rdi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp + 0x58], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp + 0x50], rdi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp + 0x50], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp + 0x48], rdi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp + 0x40], rdi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp + 0x38], rdi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp + 0x38], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp + 0x30], rdi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp + 0x30], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp + 0x28], rdi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp + 0x28], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, [rbp + 0x28]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xd0]
call fcn.14001f610
mov rbx, rax
mov qword [rbp + 0x20], rdi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp + 0x20], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, [rbp + 0x20]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xc8]
call fcn.14001f610
nop
mov dword [rsp + 0x80], r15d
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
lea rcx, [rbp + 0x58]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x58], rdi
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0x48]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x38]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
mov r8d, r15d
mov rcx, r13
call fcn.140014980
mov r15d, eax
mov rcx, qword [rbp + 0xc8]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x20]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0xd0]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x28]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x30]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x38]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x48]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x50]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x58]
call fcn.140059d2c
mov qword [rbp + 0x60], rdi
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp + 0x60], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov rbx, qword [rbp + 0xd8]
lea r9, [rbp - 0x80]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xe0]
call fcn.14001f610
nop
mov dword [rsp + 0x80], 0xffffffff
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
lea rcx, [rbp + 0x60]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x58], rbx
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, VariantTimeToDosDateTime
mov r8d, r15d
mov edx, r14d
mov rcx, r13
call fcn.140014980
nop
mov rcx, qword [rbp + 0xe0]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x60]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x78]
call fcn.140059d2c
nop
mov rbx, qword [rbp + 0x70]
test rbx, rbx
je 0x1400481dd
mov rdi, qword [rbp + 0x78]
cmp rbx, rdi
je 0x140048189
mov rcx, qword [rbx]
call fcn.140059d2c
add rbx, 8
cmp rbx, rdi
jne 0x140048174
mov rbx, qword [rbp + 0x70]
mov rax, qword [rbp + 0x80]
sub rax, rbx
sar rax, 3
lea rdx, [rax*8]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400481c4
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400482c9
mov rcx, rbx
call fcn.14004bd8c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x70], xmm0
xor ecx, ecx
mov qword [rbp + 0x80], rcx
mov rcx, qword [rbp + 0x68]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x48]
call fcn.140059d2c
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp - 0x68]
inc eax
mov dword [rbp - 0x68], eax
lea r8, [rbp - 0x80]
mov edx, eax
mov rcx, qword [rbp - 0x40]
call fcn.14002d2c0
test eax, eax
je 0x140047ae0
mov rbx, qword [rbp + 0xe8]
mov rdi, qword [rbp + 0xf0]
mov rsi, qword [rbp + 0xf8]
mov r14, qword [rbp + 0x100]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp - 0x80]
call fcn.140059d2c
nop
mov rcx, r14
call fcn.140059d2c
nop
mov rcx, rsi
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x58]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x50]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x60]
call fcn.140059d2c
nop
mov rcx, rdi
call fcn.140059d2c
nop
mov rcx, rbx
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x70]
call fcn.140059d2c
nop
mov rcx, qword [r12]
call fcn.140059d2c
mov rcx, qword [rbp + 0x6b0]
xor rcx, rsp
call fcn.14004bd30
mov rbx, qword [rsp + 0x820]
add rsp, 0x7d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14005a178
nop
mov ecx, 0x8007000e
call fcn.14004dd40
int3