Function at 0x18006e970
Capabilities:
Query or enumerate registry value
Reference absolute stream path on windows

Disassembly:
push rbp
push rbx
push rsi
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x18011c010]
xor rax, rsp
mov qword [rbp + 0x80], rax
xor esi, esi
mov r15, rdx
mov qword [rdx], rsi
test rcx, rcx
jne 0x18006ea90
lea rax, [rsp + 0x50]
xor r8d, r8d
lea r9d, [rsi + 1]
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlTimeZoneInformation
mov rcx, 0xffffffff80000002
mov r14d, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18006ea98
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.TimeZoneKeyName
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov dword [rsp + 0x40], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18006ea83
movsxd rbx, dword [rsp + 0x40]
test rbx, rbx
je 0x18006ea47
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
jne 0x18006ea47
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rbx
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rsi + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18006ea45
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.TimeZoneKeyName
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x18006ea83
test r14, r14
je 0x18006ea80
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r14, rsi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18006ea98
call sym.glib_2.0.dll_g_strdup
mov r14, rax
mov qword [rsp + 0x198], r12
test r14, r14
je 0x18006eecd
xor r8d, r8d
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionTime_Zones_
mov rdx, r14
call sym.glib_2.0.dll_g_strconcat
xor r8d, r8d
lea rdx, str.Dynamic_DST
mov rcx, rax
mov r12, rax
call sym.glib_2.0.dll_g_strconcat
mov rbx, rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r12
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18006eecd
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x1800fa030]
lea rax, [rbp - 0x2c]
mov dword [rsp + 0x30], 0x40
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18006ee5a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x1800fa034]
lea rax, [rbp + 0x28]
mov dword [rsp + 0x30], 0x40
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18006ee5a
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18006eda7
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.FirstEntry
lea rax, [rsp + 0x44]
mov dword [rsp + 0x30], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18006ee5a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.LastEntry
lea rax, [rsp + 0x48]
mov dword [rsp + 0x30], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18006ee5a
mov eax, dword [rsp + 0x48]
mov edx, 0x90
sub eax, dword [rsp + 0x44]
add eax, 2
mov qword [rsp + 0x190], r13
movsxd rcx, eax
call sym.glib_2.0.dll_g_malloc0_n
mov ebx, dword [rsp + 0x44]
mov r13d, esi
mov qword [r15], rax
cmp ebx, dword [rsp + 0x48]
ja 0x18006ed91
mov qword [rsp + 0x1e0], rdi
mov qword [rsp + 0x58], rsi
nop dword [rax + rax]
mov edx, ebx
lea rcx, [0x1800f1604]
call sym.glib_2.0.dll_g_strdup_printf
mov rcx, qword [rsp + 0x38]
mov rdi, rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x2c
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x68]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18006ed78
test rdi, rdi
je 0x18006ecc7
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp ebx, dword [rsp + 0x44]
jbe 0x18006ece9
mov r8d, 0x2c
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x68]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18006ed6a
movups xmm2, xmmword [rsp + 0x68]
mov eax, dword [rbp - 0x70]
lea rdx, [rbp + 0x14]
movups xmm0, xmmword [rsp + 0x78]
lea rcx, [rsp + 0x74]
mov dword [rbp - 0x40], eax
movsd xmm1, qword [rbp - 0x78]
movups xmmword [rbp - 0x68], xmm2
movups xmmword [rbp - 0x58], xmm0
movd dword [rbp - 0x30], xmm2
movsd qword [rbp - 0x48], xmm1
call fcn.18006e8e0
mov eax, dword [rsp + 0x6c]
lea rdx, [rbp + 0x68]
lea rcx, [rbp - 0x7c]
mov dword [rbp + 0x24], eax
call fcn.18006e8e0
mov eax, dword [rsp + 0x70]
lea rdx, [rbp - 0x30]
mov dword [rbp + 0x78], eax
movsxd rax, r13d
lea rcx, [rax + rax*8]
shl rcx, 4
add rcx, qword [r15]
call fcn.18006e7b0
mov rcx, qword [rsp + 0x58]
inc r13d
mov rax, qword [r15]
mov dword [rcx + rax], ebx
add rcx, 0x90
mov qword [rsp + 0x58], rcx
inc ebx
cmp ebx, dword [rsp + 0x48]
jbe 0x18006ec70
jmp 0x18006ed89
mov rcx, qword [r15]
test rcx, rcx
je 0x18006ed86
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r15], rsi
mov rdi, qword [rsp + 0x1e0]
mov rbx, qword [rsp + 0x60]
lea esi, [r13 + 1]
mov r13, qword [rsp + 0x190]
jmp 0x18006ee5a
lea rax, [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r12
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18006ee65
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x1800fa054]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x30], 0x2c
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18006ee5a
mov esi, 2
mov edx, 0x90
mov ecx, esi
call sym.glib_2.0.dll_g_malloc0_n
mov qword [r15], rax
lea rdx, [rbp + 0x14]
mov eax, dword [rsp + 0x68]
lea rcx, [rsp + 0x74]
mov dword [rbp - 0x30], eax
call fcn.18006e8e0
mov eax, dword [rsp + 0x6c]
lea rdx, [rbp + 0x68]
lea rcx, [rbp - 0x7c]
mov dword [rbp + 0x24], eax
call fcn.18006e8e0
mov eax, dword [rsp + 0x70]
lea rdx, [rbp - 0x30]
mov rcx, qword [r15]
mov dword [rbp + 0x78], eax
call fcn.18006e7b0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x18006ee73
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test r12, r12
je 0x18006ee81
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [r15]
test rax, rax
je 0x18006eecd
mov dword [rax], 0x77c
mov rdx, qword [r15]
movsxd rcx, esi
lea rax, [rcx - 2]
lea rax, [rax + rax*8]
add rax, rax
lea rcx, [rcx + rcx*8]
add rcx, rcx
mov r8d, dword [rdx + rax*8]
mov eax, 0xbb7
cmp r8d, eax
jl 0x18006eec2
lea eax, [r8 + 1]
mov dword [rdx + rcx*8 - 0x90], eax
mov eax, esi
jmp 0x18006eecf
xor eax, eax
mov r12, qword [rsp + 0x198]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1800989b0
add rsp, 0x1a0
pop r15
pop r14
pop rsi
pop rbx
pop rbp
ret