Function at 0x140106e00
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rdi, r9
mov rsi, r8
mov qword [rsp + 0x38], rdx
mov r14, rcx
mov qword [rsp + 0x30], rcx
mov r12, qword [r8 + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r12
cmp rax, 0x22
jb 0x140107226
cmp qword [r8 + 0x18], 8
jb 0x140106e60
mov rsi, qword [r8]
xor eax, eax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rax
lea r13, [r12 + 0x22]
mov ebx, 7
lea r15, [rsp + 0xf0]
cmp r13, rbx
jbe 0x140106ee9
mov rbx, r13
or rbx, 7
cmp rbx, rcx
jbe 0x140106ea2
mov rbx, rcx
jmp 0x140106eae
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14010722b
lfence
add rcx, rcx
call fcn.140012d70
mov r15, rax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x100], r13
mov qword [rsp + 0x108], rbx
movaps xmm0, xmmword [str.SOFTWARESophosManagementPolicy_]
movups xmmword [r15], xmm0
movaps xmm1, xmmword [0x14024b980]
movups xmmword [r15 + 0x10], xmm1
movaps xmm0, xmmword [0x14024b990]
movups xmmword [r15 + 0x20], xmm0
movaps xmm1, xmmword [0x14024b9a0]
movups xmmword [r15 + 0x30], xmm1
mov eax, dword [0x14024b9b0]
mov dword [r15 + 0x40], eax
lea rcx, [r15 + 0x44]
lea r8, [r12 + r12]
mov rdx, rsi
call fcn.1401a9040
xor esi, esi
mov word [r15 + r13*2], si
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
lea rdx, [rsp + 0xf0]
cmp qword [rsp + 0x108], 8
cmovae rdx, qword [rsp + 0xf0]
mov qword [rsp + 0xe0], rsi
lea r15, vtable.RegistryAccess.0
mov qword [rsp + 0xd8], r15
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140107231
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xe8]
xor r8d, r8d
lea rdx, str.latest
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140107250
mov edx, dword [rsp + 0xc0]
mov ecx, dword [rsp + 0xe8]
call fcn.1401338b0
mov r9d, dword [rsp + 0xc0]
lea r8, str.latest
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0xd8]
call fcn.140134c10
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0xc8], xmm0
lea rdx, [rsp + 0x110]
cmp qword [rsp + 0x128], 8
cmovae rdx, qword [rsp + 0x110]
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xc8], r15
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x14010726f
mov qword [rsp + 0xc8], r15
cmp qword [rdi + 0x18], 8
jb 0x140107099
mov rdi, qword [rdi]
lea rax, [rsp + 0xc4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xec]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140107294
mov edx, dword [rsp + 0xc4]
mov ecx, dword [rsp + 0xec]
call fcn.1401338b0
mov r9d, dword [rsp + 0xc4]
mov r8, rdi
mov rdx, r14
lea rcx, [rsp + 0xc8]
call fcn.140134c10
nop
lea rbx, vtable.RegistryHandle.0
mov qword [rsp + 0xc8], rbx
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x14010712a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xd0], rsi
mov rdx, qword [rsp + 0x128]
cmp rdx, 8
jb 0x140107172
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010716d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401072b9
call fcn.1401853a0
mov qword [rsp + 0x120], rsi
mov qword [rsp + 0x128], 7
mov word [rsp + 0x110], si
mov qword [rsp + 0xd8], rbx
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x1401071b1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xe0], rsi
mov rdx, qword [rsp + 0x108]
cmp rdx, 8
jb 0x1401071f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401071f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401072bf
call fcn.1401853a0
mov rax, r14
jmp 0x140107203
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140185380
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.140008810
call fcn.140008770
nop
lea rdx, str.Failed_to_open_registry_key
lea rcx, [rsp + 0x40]
call fcn.140010040
nop
lea rdx, [rsp + 0x40]
mov ecx, ebx
call fcn.140030620
nop
lea rdx, str.Failed_to_get_registry_value_length
lea rcx, [rsp + 0x60]
call fcn.140010040
nop
lea rdx, [rsp + 0x60]
mov ecx, ebx
call fcn.140030620
nop
lea rdx, str.Failed_to_open_registry_key
lea rcx, [rsp + 0x80]
call fcn.140010040
nop
lea rdx, [rsp + 0x80]
mov ecx, ebx
call fcn.140030620
nop
lea rdx, str.Failed_to_get_registry_value_length
lea rcx, [rsp + 0xa0]
call fcn.140010040
nop
lea rdx, [rsp + 0xa0]
mov ecx, ebx
call fcn.140030620
nop
call fcn.1401b3c00
nop
call fcn.1401b3c00
int3