Function at 0x1400310b0
Capabilities:
Get thread local storage value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6c0]
sub rsp, 0x7d0
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rbp + 0x6b0], rax
mov r12, rdx
mov r13, rcx
mov qword [rbp + 0x108], rdx
xor r15d, r15d
mov dword [rbp - 0x68], r15d
lea ecx, [r15 + 2]
call fcn.1400e8270
mov qword [rbp - 0x70], rax
mov word [rax], r15w
lea ecx, [r15 + 2]
call fcn.1400e8270
mov rbx, rax
mov qword [rbp + 0xe8], rax
mov word [rax], r15w
lea ecx, [r15 + 2]
call fcn.1400e8270
mov rdi, rax
mov qword [rbp + 0xf0], rax
mov word [rax], r15w
lea ecx, [r15 + 2]
call fcn.1400e8270
mov qword [rbp - 0x60], rax
mov word [rax], r15w
lea ecx, [r15 + 2]
call fcn.1400e8270
mov qword [rbp - 0x50], rax
mov word [rax], r15w
lea ecx, [r15 + 2]
call fcn.1400e8270
mov qword [rbp - 0x58], rax
mov word [rax], r15w
lea ecx, [r15 + 2]
call fcn.1400e8270
mov rsi, rax
mov qword [rbp + 0xf8], rax
mov word [rax], r15w
lea ecx, [r15 + 2]
call fcn.1400e8270
mov r14, rax
mov qword [rbp + 0x100], rax
mov word [rax], r15w
mov qword [rbp + 0x10], r15
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x10], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp + 8], r15
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 8], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp], r15
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 8], r15
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 8], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x10], r15
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x10], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x18], r15
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x18], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x20], r15
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x20], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rbp - 0x20]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x98]
call fcn.14000b540
mov r15, rax
xor ecx, ecx
mov qword [rbp - 0x28], rcx
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x28], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rbp - 0x28]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x90]
call fcn.14000b540
nop
mov dword [rsp + 0x80], 0xffffffff
xor edx, edx
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x70], rdx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x58], rdx
lea rcx, [rbp + 8]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 8]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rdx - 1]
mov rcx, r13
call fcn.140005d90
mov r15d, eax
mov rcx, qword [rbp + 0x90]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x28]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x98]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x20]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x18]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x10]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 8]
call fcn.1400e825c
nop
mov rcx, qword [rbp]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 8]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x10]
call fcn.1400e825c
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, qword [0x14016aa18]
call fcn.140009290
test eax, eax
jne 0x140031b4a
lea ecx, [rax + 2]
call fcn.1400e8270
mov qword [rbp - 0x80], rax
xor ecx, ecx
mov word [rax], cx
lea r8, [rbp - 0x80]
xor edx, edx
mov rcx, qword [rbp - 0x40]
call fcn.140018f50
test eax, eax
jne 0x140031b35
nop
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, eax
xor r8d, r8d
mov rdx, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x40]
call fcn.140009290
test eax, eax
jne 0x140031afa
mov dword [rbp - 0x38], 0x378
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.PackedCatalogItem
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140031af0
lea ecx, [rax + 0x18]
call fcn.1400e1108
mov rbx, rax
mov qword [rbp + 0x110], rax
xor edi, edi
test rax, rax
je 0x140031485
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, [rbp + 0x120]
call fcn.1400e0e20
mov qword [rbx], rax
jmp 0x140031488
mov rbx, rdi
test rbx, rbx
je 0x140031bcf
mov rax, qword [rbx]
mov qword [rbp - 0x48], rdi
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rbp - 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400314f6
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400314d7
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rdi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400314e9
call fcn.1400e0fb8
mov qword [rbx + 8], rdi
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1400e0fb8
mov ecx, 2
call fcn.1400e8270
mov qword [rbp + 0x68], rax
mov word [rax], di
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rdi
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp - 0x48]
call fcn.14000a050
xor r9d, r9d
lea r8, [rbp + 0x68]
mov rdx, r13
lea rcx, [rbp + 0xa0]
call fcn.140007340
mov rdx, qword [rax]
mov rbx, qword [rbp - 0x70]
lea rcx, [0x14011eaa0]
test rdx, rdx
cmovne rcx, rdx
call fcn.1400e81d8
mov qword [rbp - 0x70], rax
mov rcx, rbx
call fcn.1400e825c
mov rcx, qword [rbp + 0xa0]
call fcn.1400e825c
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x60]
mov rdx, qword [rbp - 0x70]
mov rcx, r13
call fcn.140007330
mov r14d, eax
mov qword [rbp - 0x78], rdi
mov rdx, qword [rbp - 0x80]
lea rcx, [0x14011eaa0]
test rdx, rdx
cmovne rcx, rdx
call fcn.1400e81d8
mov qword [rbp - 0x78], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProtocolName
mov rcx, qword [rbp - 0x30]
call fcn.140019160
test eax, eax
jne 0x1400316d0
mov rcx, qword [rbp - 0x78]
cmp word [rcx], 0x40
jne 0x1400316d0
call fcn.1400e81d8
mov rsi, rax
mov qword [rbp + 0xa8], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov edx, 0x2c
mov rcx, rsi
call fcn.1400e3bac
test rax, rax
je 0x140031629
mov edx, 0x2c
mov rcx, rsi
call fcn.1400e3bac
xor ecx, ecx
mov word [rax], cx
lea rcx, [rax + 2]
call fcn.1400f7970
cdq
mov edi, eax
xor edi, edx
sub edi, edx
lea rdx, [rsi + 2]
lea rcx, [rbp + 0xb0]
call fcn.140018990
mov rdx, qword [rax]
lea rcx, [0x14011eaa0]
test rdx, rdx
cmovne rcx, rdx
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0xa8], rax
mov rcx, rsi
call fcn.1400e825c
mov rcx, qword [rbp + 0xb0]
call fcn.1400e825c
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
je 0x1400316c6
mov r9d, 0x104
lea r8, [rbp + 0x4a0]
mov edx, edi
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1400316bc
mov rdi, qword [rbp - 0x78]
lea rcx, [rbp + 0x4a0]
call fcn.1400e81d8
mov qword [rbp - 0x78], rax
mov rcx, rdi
call fcn.1400e825c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rcx, rbx
call fcn.1400e825c
xor edi, edi
lea r9, [rbp - 0x80]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xc0]
call fcn.14000b540
mov rbx, rax
mov qword [rbp + 0x18], rdi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x18], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rbp + 0x18]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xb8]
call fcn.14000b540
nop
lea rcx, [rbp + 0xd8]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x20], rcx
mov r9, rbx
mov r8, rax
lea rdx, [rbp - 0x80]
mov rcx, r13
call fcn.1400058c0
movzx ebx, al
mov rcx, qword [rbp + 0xb8]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x18]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0xc0]
call fcn.1400e825c
test bl, bl
je 0x140031a58
cmp r15d, 0xffffffff
jne 0x140031988
mov qword [rbp + 0x58], rdi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x58], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp + 0x50], rdi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x50], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp + 0x48], rdi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp + 0x40], rdi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp + 0x38], rdi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x38], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp + 0x30], rdi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x30], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp + 0x28], rdi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x28], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rbp + 0x28]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xd0]
call fcn.14000b540
mov rbx, rax
mov qword [rbp + 0x20], rdi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x20], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rbp + 0x20]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xc8]
call fcn.14000b540
nop
mov dword [rsp + 0x80], r15d
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
lea rcx, [rbp + 0x58]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x58], rdi
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0x48]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x38]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
mov r8d, r15d
mov rcx, r13
call fcn.140005d90
mov r15d, eax
mov rcx, qword [rbp + 0xc8]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x20]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0xd0]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x28]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x30]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x38]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x40]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x50]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x58]
call fcn.1400e825c
mov qword [rbp + 0x60], rdi
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x60], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rbx, qword [rbp + 0xd8]
lea r9, [rbp - 0x80]
mov r8, r12
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xe0]
call fcn.14000b540
nop
mov dword [rsp + 0x80], 0xffffffff
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
lea rcx, [rbp + 0x60]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x58], rbx
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, ntohs
mov r8d, r15d
mov edx, r14d
mov rcx, r13
call fcn.140005d90
nop
mov rcx, qword [rbp + 0xe0]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x60]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x78]
call fcn.1400e825c
nop
mov rbx, qword [rbp + 0x70]
test rbx, rbx
je 0x140031add
mov rdi, qword [rbp + 0x78]
cmp rbx, rdi
je 0x140031a89
mov rcx, qword [rbx]
call fcn.1400e825c
add rbx, 8
cmp rbx, rdi
jne 0x140031a74
mov rbx, qword [rbp + 0x70]
mov rax, qword [rbp + 0x80]
sub rax, rbx
sar rax, 3
lea rdx, [rax*8]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140031ac4
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031bc9
mov rcx, rbx
call fcn.1400e0fb8
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x70], xmm0
xor ecx, ecx
mov qword [rbp + 0x80], rcx
mov rcx, qword [rbp + 0x68]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x48]
call fcn.1400e825c
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp - 0x68]
inc eax
mov dword [rbp - 0x68], eax
lea r8, [rbp - 0x80]
mov edx, eax
mov rcx, qword [rbp - 0x40]
call fcn.140018f50
test eax, eax
je 0x1400313e0
mov rbx, qword [rbp + 0xe8]
mov rdi, qword [rbp + 0xf0]
mov rsi, qword [rbp + 0xf8]
mov r14, qword [rbp + 0x100]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp - 0x80]
call fcn.1400e825c
nop
mov rcx, r14
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x58]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x50]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x60]
call fcn.1400e825c
nop
mov rcx, rdi
call fcn.1400e825c
nop
mov rcx, rbx
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x70]
call fcn.1400e825c
nop
mov rcx, qword [r12]
call fcn.1400e825c
mov rcx, qword [rbp + 0x6b0]
xor rcx, rsp
call fcn.1400e17a0
mov rbx, qword [rsp + 0x820]
add rsp, 0x7d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400e8160
nop
mov ecx, 0x8007000e
call fcn.1400e0b70
int3