Function at 0x140023fc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x140108020]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
mov dword [rsp + 0x30], esi
xorps xmm0, xmm0
movups xmmword [rsp + 0x1f8], xmm0
mov qword [rsp + 0x208], rsi
mov qword [rsp + 0x210], SafeArrayUnaccessData
mov byte [rsp + 0x1f8], sil
lea rcx, [rsp + 0x1d0]
call fcn.140022e70
mov rbx, rax
lea rax, [rsp + 0x1f8]
cmp rax, rbx
je 0x1400240c9
mov rdx, qword [rsp + 0x210]
cmp rdx, 0x10
jb 0x140024087
inc rdx
mov rcx, qword [rsp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024082
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024c35
call fcn.140055894
mov qword [rsp + 0x208], rsi
mov qword [rsp + 0x210], SafeArrayUnaccessData
mov byte [rsp + 0x1f8], 0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x1f8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x208], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rsp + 0x1e8]
cmp rdx, 0x10
jb 0x14002410d
inc rdx
mov rcx, qword [rsp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024107
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024c35
call fcn.140055894
nop
jmp 0x140024116
mov dword [rsp + 0x218], 0x200
xorps xmm0, xmm0
movups xmmword [rsp + 0x220], xmm0
mov qword [rsp + 0x230], rsi
mov qword [rsp + 0x238], rsi
mov r8d, 0x59
lea rdx, str.REE1RSkdGkbGpwQSTA28bkE5Oc3RyaBXp3TdFxayXXkE9Bl5srCUZ0bcRh6Jd3ZaaR0B5GAAFeJcQlLKdHEFycw
lea rcx, [rsp + 0x220]
call fcn.140010020
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x150]
call fcn.140028b40
mov rdx, rax
mov edi, 1
mov dword [rsp + 0x30], edi
cmp qword [rax + 0x18], 0x10
jb 0x140024181
mov rdx, qword [rax]
mov r12, 0xffffffffffffffff
mov rax, r12
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x140024190
lea rcx, [rsp + 0x1f8]
cmp qword [rsp + 0x210], 0x10
cmovae rcx, qword [rsp + 0x1f8]
mov rbx, qword [rsp + 0x208]
cmp rbx, rax
jne 0x1400241d0
mov r8, rbx
call fcn.140058520
test eax, eax
je 0x1400243b7
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xe8], rsi
mov r8d, 0x59
lea rdx, str.bWlEYOVRY5U1lxETGxG3cmhYjSlxbpdw1hlbmRheXH1eZdUZFSbXxa1UWkAmZBkRXdDIIhKAM3qLhkLNLysHQeg
lea rcx, [rsp + 0xd0]
call fcn.140010020
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x1b0]
call fcn.140028b40
mov rdx, rax
mov edi, 3
mov dword [rsp + 0x30], edi
cmp qword [rax + 0x18], 0x10
jb 0x140024230
mov rdx, qword [rax]
mov rax, r12
inc rax
cmp byte [rdx + rax], 0
jne 0x140024233
lea rcx, [rsp + 0x1f8]
cmp qword [rsp + 0x210], 0x10
cmovae rcx, qword [rsp + 0x1f8]
mov rbx, qword [rsp + 0x208]
cmp rbx, rax
jne 0x140024273
mov r8, rbx
call fcn.140058520
test eax, eax
je 0x1400243b7
xorps xmm0, xmm0
movups xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x108], rsi
mov r8d, 0x59
lea rdx, str.OGxCqUGtSiMjV5RM2o0NMHBNnYQhckcmBb5YgIFZVANayBABddfVEI2XG9gRW2ICWGEkDIWgQAdQH1RbCFxyjYA
lea rcx, [rsp + 0xf0]
call fcn.140010020
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x190]
call fcn.140028b40
mov rdx, rax
mov edi, 7
mov dword [rsp + 0x30], edi
cmp qword [rax + 0x18], 0x10
jb 0x1400242d3
mov rdx, qword [rax]
mov rax, r12
inc rax
cmp byte [rdx + rax], 0
jne 0x1400242d6
lea rcx, [rsp + 0x1f8]
cmp qword [rsp + 0x210], 0x10
cmovae rcx, qword [rsp + 0x1f8]
mov rbx, qword [rsp + 0x208]
cmp rbx, rax
jne 0x140024316
mov r8, rbx
call fcn.140058520
test eax, eax
je 0x1400243b7
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov r8d, 0x59
lea rdx, str.bmJjvVWFWAaDg2ATGkzxR3JIqTigknJRMnqEC5VGwovTdQFfHDggobJE4T2JxAujFXAKUL3UBINA4IpKCQl3Ew
lea rcx, [rsp + 0x70]
call fcn.140010020
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x170]
call fcn.140028b40
mov rdx, rax
mov edi, 0xf
mov dword [rsp + 0x30], edi
cmp qword [rax + 0x18], 0x10
jb 0x14002436d
mov rdx, qword [rax]
mov rax, r12
inc rax
cmp byte [rdx + rax], 0
jne 0x140024370
lea rcx, [rsp + 0x1f8]
cmp qword [rsp + 0x210], 0x10
cmovae rcx, qword [rsp + 0x1f8]
mov rbx, qword [rsp + 0x208]
cmp rbx, rax
jne 0x1400243ac
mov r8, rbx
call fcn.140058520
test eax, eax
je 0x1400243b7
cmp rbx, 0x24
jne 0x1400243b7
xor r14b, r14b
jmp 0x1400243ba
mov r14b, 1
test dil, 8
je 0x14002442b
and edi, 0xfffffff7
mov dword [rsp + 0x30], edi
mov rdx, qword [rsp + 0x188]
cmp rdx, 0x10
jb 0x140024412
inc rdx
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024405
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024c3b
call fcn.140055894
mov rbx, qword [rsp + 0x208]
movdqa xmm0, xmmword [0x1400fa040]
movdqu xmmword [rsp + 0x180], xmm0
mov byte [rsp + 0x170], 0
test dil, 4
je 0x14002449c
and edi, 0xfffffffb
mov dword [rsp + 0x30], edi
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 0x10
jb 0x140024483
inc rdx
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024476
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024c41
call fcn.140055894
mov rbx, qword [rsp + 0x208]
movdqa xmm0, xmmword [0x1400fa040]
movdqu xmmword [rsp + 0x1a0], xmm0
mov byte [rsp + 0x190], 0
test dil, 2
je 0x14002450d
and edi, 0xfffffffd
mov dword [rsp + 0x30], edi
mov rdx, qword [rsp + 0x1c8]
cmp rdx, 0x10
jb 0x1400244f4
inc rdx
mov rcx, qword [rsp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400244e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024c47
call fcn.140055894
mov rbx, qword [rsp + 0x208]
movdqa xmm0, xmmword [0x1400fa040]
movdqu xmmword [rsp + 0x1c0], xmm0
mov byte [rsp + 0x1b0], 0
test dil, 1
je 0x14002455e
mov rdx, qword [rsp + 0x168]
cmp rdx, 0x10
jb 0x14002455e
inc rdx
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024551
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024c4d
call fcn.140055894
mov rbx, qword [rsp + 0x208]
test r14b, r14b
je 0x140024999
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
mov qword [rsp + 0x120], rsi
mov qword [rsp + 0x128], rsi
mov r8d, 0x4f
lea rdx, str.MmVJcT0pRBRWVZfUGhLJdFlZCMGEqZDxsd3EBcgrBR0BMKAY26Kl9U2ERUMsOCg1dETY3ZGioEqMSA
lea rcx, [rsp + 0x110]
call fcn.14000fb50
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x60]
call fcn.140028fb0
nop
mov rdx, qword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xa0], xmm1
mov r8, r12
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400245d0
lea rcx, [rsp + 0x90]
call fcn.14000fb50
lea rdx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae rdx, qword [rsp + 0x90]
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x14002466d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024668
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024c53
call fcn.140055894
movdqa xmm0, xmmword [0x1400fa030]
movdqu xmmword [rsp + 0xa0], xmm0
mov word [rsp + 0x90], si
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400246a5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0x148], rsi
mov r8d, 0x2c
lea rdx, str.MWp4TcVRQ2azd0db1VnvYWpElOXwL4Gxk92Pg5wUAQYx
lea rcx, [rsp + 0x130]
call fcn.14000fb50
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x38]
call fcn.140028fb0
nop
mov rdx, qword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xc0], xmm1
mov r8, r12
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140024710
lea rcx, [rsp + 0xb0]
call fcn.14000fb50
lea rdx, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 8
cmovae rdx, qword [rsp + 0xb0]
lea rax, [rsp + 0x218]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x240]
xor r8d, r8d
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rdx, qword [rsp + 0xc8]
cmp rdx, 8
jb 0x1400247bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400247ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024c59
call fcn.140055894
movdqa xmm0, xmmword [0x1400fa030]
movdqu xmmword [rsp + 0xc0], xmm0
mov word [rsp + 0xb0], si
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400247f7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xorps xmm0, xmm0
test ebx, ebx
je 0x1400248b6
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov r8d, 0x59
lea rdx, str.NGlrId3ZOyZWdMaR2dSFemxY2cQRZMW0dGzflVXVYXdX2YkpB5aEEEhWUZHrRn5VtSnx3JV2JKbXGhBmBFlbORy4
lea rcx, [rsp + 0x70]
call fcn.140010020
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x150]
call fcn.140028b40
nop
cmp qword [rax + 0x18], 0x10
jb 0x14002484b
mov rax, qword [rax]
mov r8, r12
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140024850
mov rdx, rax
lea rcx, [rsp + 0x1f8]
call fcn.14000f110
nop
mov rdx, qword [rsp + 0x168]
cmp rdx, 0x10
jb 0x140024983
inc rdx
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002497e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024c5f
jmp 0x14002497e
movups xmmword [rsp + 0x220], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x230], xmm1
lea rax, [rsp + 0x270]
mov r8, r12
inc r8
cmp word [rax + r8*2], 0
jne 0x1400248d5
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x220]
call fcn.14000fb50
nop
lea rdx, [rsp + 0x220]
cmp qword [rsp + 0x238], 8
cmovae rdx, qword [rsp + 0x220]
mov rax, qword [rsp + 0x230]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x220]
cmovae rdx, qword [rsp + 0x220]
lea rcx, [rsp + 0x1f8]
call fcn.14002cfe0
nop
mov rdx, qword [rsp + 0x238]
cmp rdx, 8
jb 0x140024983
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002497e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024c65
call fcn.140055894
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x208]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea r14, [rsp + 0x1f8]
cmp qword [rsp + 0x210], 0x10
cmovae r14, qword [rsp + 0x1f8]
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x140024c6b
cmp rbx, 0x10
jae 0x1400249fb
mov qword [rsp + 0x50], rbx
mov edx, 0xf
mov qword [rsp + 0x58], rdx
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x40], xmm0
jmp 0x140024a9e
mov qword [rsp + 0x58], SafeArrayUnaccessData
mov rax, rbx
or rax, 0xf
cmp rax, rdi
ja 0x140024a1f
mov rdi, rax
mov ecx, SafeArrayUnaccessData
cmp rax, rcx
cmovb rdi, rcx
mov rcx, rdi
add rcx, 1
cmovb rcx, r12
cmp rcx, 0x1000
jb 0x140024a62
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140024c71
mov rcx, rax
call fcn.1400558c8
mov rcx, rax
test rax, rax
je 0x140024c77
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140024a71
test rcx, rcx
je 0x140024a6e
call fcn.1400558c8
jmp 0x140024a71
mov rax, rsi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
lea r8, [rbx + 1]
mov rdx, r14
mov rcx, rax
call fcn.140057a20
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
movups xmm0, xmmword [rsp + 0x40]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x68], rax
lea rdi, [rsp + 0x40]
movq rcx, xmm0
cmp rdx, 0x10
cmovae rdi, rcx
lea r14, [rsp + 0x40]
cmovae r14, rcx
add r14, rbx
lea rbx, [rsp + 0x40]
cmp rdx, 0x10
cmovae rbx, rcx
cmp rbx, r14
je 0x140024af8
sub rdi, rbx
nop dword [rax + rax]
movsx ecx, byte [rbx]
call fcn.14005fdf8
mov byte [rbx + rdi], al
inc rbx
cmp rbx, r14
jne 0x140024ae0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsp + 0x248], xmm0
movups xmm1, xmmword [rsp + 0x50]
movdqu xmmword [rsp + 0x258], xmm1
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], SafeArrayUnaccessData
mov byte [rsp + 0x40], 0
lea r8, [rsp + 0x248]
movq r9, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rcx, xmm0
cmp rcx, 0x10
cmovae r8, r9
movq rax, xmm1
add r8, rax
lea rdx, [rsp + 0x248]
cmp rcx, 0x10
cmovae rdx, r9
mov rcx, r15
call fcn.14000f690
nop
mov rdx, qword [rsp + 0x260]
cmp rdx, 0x10
jb 0x140024ba8
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024ba3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024c7d
call fcn.140055894
movdqa xmm0, xmmword [0x1400fa040]
movdqu xmmword [rsp + 0x258], xmm0
mov byte [rsp + 0x248], 0
mov rdx, qword [rsp + 0x210]
cmp rdx, 0x10
jb 0x140024c04
inc rdx
mov rcx, qword [rsp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024bff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024c83
call fcn.140055894
mov rax, r15
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140055540
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
call fcn.14005c3e8
nop
call fcn.14005c3e8
nop
call fcn.14005c3e8
nop
call fcn.14005c3e8
nop
call fcn.14005c3e8
nop
call fcn.14005c3e8
nop
call fcn.14005c3e8
nop
call fcn.14005c3e8
int3
call fcn.14005c3e8
int3
call fcn.1400025b0
int3
call fcn.140002510
int3
call fcn.14005c3e8
int3
call fcn.14005c3e8
nop
call fcn.14005c3e8
int3