Function at 0x140008d00
Capabilities:
Query or enumerate registry value
Set current directory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x1e8
xor r14d, r14d
mov qword [rsp + 0x1e0], r12
mov rbp, rcx
mov dword [rsp + 0x220], r14d
cmp qword [rcx + 0x20], 8
jb 0x140008d37
lea rsi, [rcx + 8]
mov rcx, qword [rcx + 8]
jmp 0x140008d3e
lea rsi, [rcx + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
call fcn.140046f10
or rcx, 0xffffffffffffffff
mov r13, rax
xor eax, eax
lea rdi, str.type
repne scasb al, byte [rdi]
lea rdx, str.type
mov qword [rsp + 0x58], 0xf
not rcx
mov qword [rsp + 0x50], r14
mov byte [rsp + 0x40], r14b
lea r8, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.140003ca0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0xb0]
mov rcx, r13
mov ebx, 3
call fcn.140046f90
or rcx, 0xffffffffffffffff
lea rdi, str.nacl_broker
mov r11, rax
xor eax, eax
repne scasb al, byte [rdi]
mov rdi, qword [r11 + 0x18]
cmp rdi, rdi
not rcx
cmovb rdi, rdi
cmp qword [r11 + 0x20], 0x10
lea r12, [rcx - 1]
jb 0x140008dd1
mov rcx, qword [r11 + 8]
jmp 0x140008dd5
lea rcx, [r11 + 8]
mov r8, r12
cmp rdi, r12
lea rdx, str.nacl_broker
cmovb r8, rdi
call fcn.1400ac360
movsxd rcx, eax
test eax, eax
jne 0x140008e02
cmp rdi, r12
jb 0x140008e0a
mov eax, r14d
cmp rdi, r12
setne al
mov ecx, eax
test ecx, ecx
je 0x140008ec7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, str.type
repne scasb al, byte [rdi]
lea rdx, str.type
mov qword [rsp + 0x80], 0xf
not rcx
mov qword [rsp + 0x78], r14
mov byte [rsp + 0x68], r14b
lea r8, [rcx - 1]
lea rcx, [rsp + 0x60]
call fcn.140003ca0
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x88]
mov rcx, r13
mov ebx, 0xf
call fcn.140046f90
or rcx, 0xffffffffffffffff
lea rdi, str.nacl_loader
mov r11, rax
xor eax, eax
repne scasb al, byte [rdi]
mov rdi, qword [r11 + 0x18]
cmp rdi, rdi
not rcx
cmovb rdi, rdi
cmp qword [r11 + 0x20], 0x10
lea r12, [rcx - 1]
jb 0x140008e92
mov rcx, qword [r11 + 8]
jmp 0x140008e96
lea rcx, [r11 + 8]
mov r8, r12
cmp rdi, r12
lea rdx, str.nacl_loader
cmovb r8, rdi
call fcn.1400ac360
movsxd rcx, eax
test eax, eax
jne 0x140008ec3
cmp rdi, r12
jb 0x140008ecc
mov eax, r14d
cmp rdi, r12
setne al
mov ecx, eax
test ecx, ecx
jne 0x140008ecc
mov dil, 1
jmp 0x140008ecf
xor dil, dil
mov r12, qword [rsp + 0x1e0]
test bl, 8
je 0x140008f13
and ebx, 0xfffffff7
cmp qword [rsp + 0xa8], 0x10
jb 0x140008ef7
mov rcx, qword [rsp + 0x90]
call fcn.1400ab7f0
mov qword [rsp + 0xa8], 0xf
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
test bl, 4
je 0x140008f46
and ebx, 0xfffffffb
cmp qword [rsp + 0x80], 0x10
jb 0x140008f30
mov rcx, qword [rsp + 0x68]
call fcn.1400ab7f0
mov qword [rsp + 0x80], 0xf
mov qword [rsp + 0x78], r14
mov byte [rsp + 0x68], r14b
test bl, 2
je 0x140008f82
and ebx, 0xfffffffd
cmp qword [rsp + 0xd0], 0x10
jb 0x140008f66
mov rcx, qword [rsp + 0xb8]
call fcn.1400ab7f0
mov qword [rsp + 0xd0], 0xf
mov qword [rsp + 0xc8], r14
mov byte [rsp + 0xb8], r14b
test bl, 1
je 0x140008f9c
and ebx, 0xfffffffe
cmp qword [rsp + 0x58], 0x10
jb 0x140008f9c
mov rcx, qword [rsp + 0x40]
call fcn.1400ab7f0
test dil, dil
je 0x1400091dc
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, str.nacl64.dll
repne scasw ax, word [rdi]
lea rdx, str.nacl64.dll
not rcx
lea r8, [rcx - 1]
mov rcx, rbp
call fcn.1400045a0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, str.type
lea rdx, str.type
mov qword [rsp + 0x58], 0xf
repne scasb al, byte [rdi]
mov qword [rsp + 0x50], r14
mov byte [rsp + 0x40], r14b
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.140003ca0
lea rdx, [rsp + 0x38]
mov rcx, r13
call fcn.140044890
test al, al
sete dil
cmp qword [rsp + 0x58], 0x10
jb 0x14000902a
mov rcx, qword [rsp + 0x40]
call fcn.1400ab7f0
test dil, dil
je 0x1400091b3
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareGoogleChromeFrame
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x238], r14d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x230], 0x1000
mov dword [rsp + 0x228], 1
mov qword [rsp + 0x30], r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140009136
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x220]
lea rdx, str.PreReadSize
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x238]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x220], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x220]
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x230]
lea rdx, str.PreReadStepSize
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x220]
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x228]
lea rdx, str.PreRead
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x30], r14
cmp dword [rsp + 0x228], r14d
je 0x1400091b3
lea rdi, [0x1400e902d]
lea rcx, str.PreReadImage
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x28], 0xffffffffffffffff
mov qword [rsp + 0x20], rdi
call fcn.14004e240
cmp qword [rbp + 0x20], 8
jb 0x140009177
mov rcx, qword [rsi]
jmp 0x14000917a
mov rcx, rsi
mov r8d, dword [rsp + 0x230]
mov edx, dword [rsp + 0x238]
call fcn.140053f20
xor r9d, r9d
lea rcx, str.PreReadImage
lea r8d, [r9 + 1]
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x28], 0xffffffffffffffff
mov qword [rsp + 0x20], rdi
call fcn.14004e240
cmp qword [rbp + 0x20], 8
jb 0x1400091bd
mov rsi, qword [rsi]
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 8]
add rsp, 0x1e8
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [0x1401148b0], r14b
je 0x140009220
call fcn.14003e110
cmp eax, 3
jg 0x140009220
mov r9d, 3
lea rdx, str.._appclient_util.cc
lea rcx, [rsp + 0xd8]
lea r8d, [r9 + 0x67]
or ebx, 0x10
call fcn.1400403f0
lea rdx, str.Check_failed:_false.
lea rcx, [rax + 8]
call fcn.140005bd0
test bl, 0x10
je 0x140009232
lea rcx, [rsp + 0xd8]
call fcn.14003feb0
xor eax, eax
add rsp, 0x1e8
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret