Function at 0x14000fcac
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8b0
mov qword [r11 - 0x7f8], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1400f2008]
xor rax, rsp
mov qword [rsp + 0x8a0], rax
mov r13, rcx
mov r15d, 1
lock add dword [rcx + 0xcc], r15d
mov qword [r11 - 0x820], rcx
lea rdx, [r11 - 0x820]
lea rcx, [rsp + 0x58]
call fcn.140014680
nop
cmp dword [0x1400f2030], 5
jbe 0x14000fd3f
lea rax, [rsp + 0x260]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
lea rdx, [0x1400cc7ac]
lea rcx, [0x1400f2030]
call fcn.140001180
mov qword [rsp + 0xc8], r13
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x68]
call fcn.140014680
nop
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
call fcn.1400144a0
mov qword [rsp + 0x40], rax
lea rcx, [r13 + 0x38]
lea rdx, [rsp + 0x80]
call fcn.1400172d4
nop
lea rbx, [r13 + 0x40]
lea rax, [rsp + 0x40]
cmp rax, rbx
je 0x14000fe43
mov rdx, qword [rsp + 0x40]
mov rdx, qword [rdx + 8]
lea rcx, [rsp + 0x40]
call fcn.1400142a0
mov rax, qword [rsp + 0x40]
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x40]
mov qword [rax], rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x10], rax
mov qword [rsp + 0x48], r14
xor eax, eax
mov rdx, qword [rbx]
mov rdi, qword [rsp + 0x40]
mov r9b, al
mov r8, rdi
mov rdx, qword [rdx + 8]
lea rcx, [rsp + 0x40]
call fcn.14001518c
mov qword [rdi + 8], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x40]
mov rax, qword [rdx + 8]
cmp byte [rax + 0x19], r14b
jne 0x14000fe37
mov rcx, qword [rax]
jmp 0x14000fe0c
mov rax, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], r14b
je 0x14000fe06
mov qword [rdx], rax
mov rdx, qword [rsp + 0x40]
mov rax, qword [rdx + 8]
mov rcx, qword [rax + 0x10]
jmp 0x14000fe2b
mov rax, rcx
mov rcx, qword [rcx + 0x10]
cmp byte [rcx + 0x19], r14b
je 0x14000fe24
mov qword [rdx + 0x10], rax
jmp 0x14000fe43
mov qword [rdx], rdx
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x10], rax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14000fe56
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_ReleaseSRWLockShared]
mov ebx, r14d
mov esi, 7
or r12, 0xffffffffffffffff
mov dword [rsp + 0x80], ebx
mov word [rsp + 0x2a0], r14w
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rsp + 0x2a2]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x90], 0xff
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x2a0]
mov edx, ebx
mov rcx, qword [r13 + 0xc0]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
cmp edi, 0x80070103
jne 0x140010172
mov r8, qword [rsp + 0x40]
mov rbx, qword [r8]
cmp rbx, r8
je 0x1400100e3
lea r12, [r13 + 0x38]
lea rsi, [r13 + 0x40]
mov rdi, qword [rbx + 0x80]
mov qword [rsp + 0xe8], rdi
test rdi, rdi
je 0x14000ff25
mov rax, qword [rdi]
mov rsi, qword [rax + 8]
mov rcx, rsi
call qword [fcn.140009340]
mov rcx, rdi
call rsi
lea rsi, [r13 + 0x40]
lea rdx, [rsp + 0xa0]
mov rcx, r12
call fcn.140017258
nop
mov r12, qword [rsi]
mov rsi, qword [r12 + 8]
jmp 0x14000ff5d
lea rdx, [rsi + 0x20]
lea r8, [rbx + 0x20]
call fcn.140014334
test al, al
je 0x14000ff57
mov rsi, qword [rsi + 0x10]
jmp 0x14000ff5d
mov r12, rsi
mov rsi, qword [rsi]
cmp byte [rsi + 0x19], r14b
je 0x14000ff40
lea rsi, [r13 + 0x40]
cmp r12, qword [rsi]
je 0x14000ff7e
lea r8, [r12 + 0x20]
lea rdx, [rbx + 0x20]
call fcn.140014334
test al, al
je 0x14000ff81
mov r12, qword [rsi]
mov r8, r12
lea rdx, [rsp + 0xf8]
mov rcx, rsi
call fcn.1400137e8
nop
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14000ffb0
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_ReleaseSRWLockExclusive]
mov qword [rsp + 0xa0], r14
mov rcx, rdi
call fcn.1400262a4
mov ecx, r14d
test eax, eax
cmovs ecx, eax
test ecx, ecx
js 0x140010033
test rdi, rdi
je 0x14000ffe2
mov rax, qword [rdi]
mov rsi, qword [rax + 0x10]
mov rcx, rsi
call qword [fcn.140009340]
mov rcx, rdi
call rsi
lea rsi, [r13 + 0x40]
cmp byte [rbx + 0x19], r14b
jne 0x14001001c
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], r14b
jne 0x140010000
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r14b
je 0x14000fff2
jmp 0x14001001c
mov rax, qword [rbx + 8]
jmp 0x140010013
cmp rbx, qword [rax + 0x10]
jne 0x140010019
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], r14b
je 0x140010006
mov rbx, rax
mov r8, qword [rsp + 0x40]
cmp rbx, r8
lea r12, [r13 + 0x38]
jne 0x14000fef8
jmp 0x1400100e3
mov rcx, qword [0x1400f3e00]
test rcx, rcx
je 0x140010048
mov edx, r15d
call fcn.14000b6e0
nop
test rdi, rdi
je 0x140010063
mov rax, qword [rdi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [fcn.140009340]
mov rcx, rdi
call rbx
nop
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x108]
mov r9, r8
mov r8, qword [r8]
lea rcx, [rsp + 0x40]
call fcn.1400141c8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop
cmp byte [rsp + 0x70], r14b
je 0x1400100cb
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rbx + 0xb0]
call fcn.140039258
test eax, eax
js 0x1400100cb
mov dword [rsp + 0x20], r15d
mov r9, qword [rbx + 0xa8]
mov r8d, 0x1000000f
mov edx, r15d
mov rcx, qword [rbx + 0xc0]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegNotifyChangeKeyValue]
nop
cmp byte [rsp + 0x60], r14b
je 0x1400100dc
mov rcx, qword [rsp + 0x58]
call fcn.14001368c
xor eax, eax
jmp 0x14001086d
cmp byte [r13 + 0x50], r14b
jne 0x14001012f
lea rcx, [r13 + 0x38]
lea rdx, [rsp + 0xc0]
call fcn.1400172d4
mov rax, qword [r13 + 0x48]
mov qword [rsp + 0xb0], rax
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x140010119
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_ReleaseSRWLockShared]
lea rcx, [rsp + 0xb0]
call fcn.140014da8
mov byte [r13 + 0x50], r15b
mov r8, qword [rsp + 0x40]
cmp dword [0x1400f2030], 5
jbe 0x140010165
lea rax, [rsp + 0x280]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
lea rdx, [0x1400cc78e]
lea rcx, [0x1400f2030]
call fcn.140001180
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0xd0]
jmp 0x140010070
test edi, edi
jns 0x1400101fa
mov r8, qword [rsp + 0x40]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x40]
call fcn.1400141c8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop
cmp byte [rsp + 0x70], r14b
je 0x1400101e2
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rbx + 0xb0]
call fcn.140039258
test eax, eax
js 0x1400101e2
mov dword [rsp + 0x20], r15d
mov r9, qword [rbx + 0xa8]
mov r8d, 0x1000000f
mov edx, r15d
mov rcx, qword [rbx + 0xc0]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegNotifyChangeKeyValue]
nop
cmp byte [rsp + 0x60], r14b
je 0x1400101f3
mov rcx, qword [rsp + 0x58]
call fcn.14001368c
mov eax, edi
jmp 0x14001086d
mov word [rsp + 0x6a0], r14w
mov edi, 0x1fc
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x6a2]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x8c], 0x1fe
mov word [rsp + 0x4a0], r14w
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x4a2]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x88], 0x1fe
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x6a0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r9d, 6
lea r8, str.ModulePath
lea rdx, [rsp + 0x2a0]
mov rcx, qword [r13 + 0xc0]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
movzx ecx, ax
mov edi, 0x80070000
or ecx, edi
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x1400107cb
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x4a0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r9d, 2
lea r8, str.ActivatableClass
lea rdx, [rsp + 0x2a0]
mov rcx, qword [r13 + 0xc0]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
movzx ecx, ax
or ecx, edi
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x1400107cb
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x178], r14
mov word [rsp + 0x168], r14w
cmp word [rsp + 0x4a0], r14w
jne 0x14001031f
mov r8, r14
jmp 0x140010334
lea rax, [rsp + 0x4a0]
mov r8, r12
inc r8
cmp word [rax + r8*2], r14w
jne 0x14001032a
lea rdx, [rsp + 0x4a0]
lea rcx, [rsp + 0x168]
call fcn.1400170e0
nop
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x158], r14
mov word [rsp + 0x148], r14w
cmp word [rsp + 0x6a0], r14w
jne 0x140010373
mov r8, r14
jmp 0x140010388
lea rax, [rsp + 0x6a0]
mov r8, r12
inc r8
cmp word [rax + r8*2], r14w
jne 0x14001037e
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x148]
call fcn.1400170e0
nop
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0x138], r14
mov word [rsp + 0x128], r14w
cmp word [rsp + 0x2a0], r14w
jne 0x1400103c7
mov r8, r14
jmp 0x1400103dc
lea rax, [rsp + 0x2a0]
mov r8, r12
inc r8
cmp word [rax + r8*2], r14w
jne 0x1400103d2
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x128]
call fcn.1400170e0
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x190]
call fcn.140016bfc
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x1b0]
call fcn.140016bfc
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x1d0]
call fcn.140016bfc
nop
cmp qword [rsp + 0x140], 8
jb 0x14001044a
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0x138], r14
mov word [rsp + 0x128], r14w
cmp qword [rsp + 0x160], 8
jb 0x14001047c
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x158], r14
mov word [rsp + 0x148], r14w
cmp qword [rsp + 0x180], 8
jb 0x1400104ae
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x178], r14
mov word [rsp + 0x168], r14w
lea rcx, [r13 + 0x38]
lea rdx, [rsp + 0x98]
call fcn.1400172d4
lea r12, [r13 + 0x40]
mov rbx, qword [r12]
mov rsi, rbx
mov rdi, qword [rbx + 8]
jmp 0x14001050a
lea rdx, [rdi + 0x20]
lea r8, [rsp + 0x190]
call fcn.140014334
test al, al
je 0x140010504
mov rdi, qword [rdi + 0x10]
jmp 0x14001050a
mov rsi, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], r14b
je 0x1400104e9
cmp rsi, qword [r12]
je 0x14001052b
lea r8, [rsi + 0x20]
lea rdx, [rsp + 0x190]
call fcn.140014334
test al, al
je 0x14001052f
mov rsi, qword [r12]
cmp rsi, rbx
setne bl
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140010550
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_ReleaseSRWLockShared]
mov qword [rsp + 0x98], r14
test bl, bl
jne 0x14001079b
mov qword [rsp + 0x50], r14
mov qword [rsp + 0xa8], r13
lea rax, [rsp + 0x4a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6a0]
lea r8, [rsp + 0x2a0]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x50]
call fcn.140014b60
test eax, eax
js 0x140010775
lea rdx, [rsp + 0x78]
lea rcx, [r13 + 0x38]
call fcn.140017258
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x1f0]
call fcn.140014c84
nop
mov rdx, rax
mov rcx, r12
call fcn.140014f68
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x118]
mov rcx, r12
call fcn.140014ffc
mov sil, byte [rax + 8]
mov rdi, qword [rsp + 0x250]
test rdi, rdi
je 0x140010618
mov qword [rsp + 0x250], r14
mov rax, qword [rdi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [fcn.140009340]
mov rcx, rdi
call rbx
lea rcx, [rsp + 0x1f0]
call fcn.1400108a0
test sil, sil
jne 0x140010703
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140010643
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_ReleaseSRWLockExclusive]
mov qword [rsp + 0x78], r14
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x140010668
mov qword [rsp + 0x50], r14
mov rax, qword [rdi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [fcn.140009340]
mov rcx, rdi
call rbx
nop
lea rcx, [rsp + 0x190]
call fcn.1400108a0
nop
mov r8, qword [rsp + 0x40]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x40]
call fcn.1400141c8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop
cmp byte [rsp + 0x70], r14b
je 0x1400106e3
mov byte [rsp + 0x70], r14b
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rbx + 0xb0]
call fcn.140039258
test eax, eax
js 0x1400106e3
mov dword [rsp + 0x20], r15d
mov r9, qword [rbx + 0xa8]
mov r8d, 0x1000000f
mov edx, r15d
mov rcx, qword [rbx + 0xc0]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegNotifyChangeKeyValue]
nop
cmp byte [rsp + 0x60], r14b
je 0x1400106f9
mov byte [rsp + 0x60], r14b
mov rcx, qword [rsp + 0x58]
call fcn.14001368c
mov eax, 0x8000ffff
jmp 0x14001086d
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140010718
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_ReleaseSRWLockExclusive]
mov qword [rsp + 0x78], r14
mov rcx, qword [rsp + 0x50]
call fcn.1400261c0
jmp 0x140010775
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x1400107ae
mov qword [rsp + 0x50], r14
mov rax, qword [rdi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [fcn.140009340]
mov rcx, rdi
call rbx
jmp 0x1400107ae
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x40]
call fcn.140013cbc
nop
lea rcx, [rsp + 0x190]
call fcn.1400108a0
mov ebx, dword [rsp + 0x80]
mov esi, 7
or r12, 0xffffffffffffffff
inc ebx
jmp 0x14000fe62
mov rcx, qword [rsp + 0x8a0]
xor rcx, rsp
call fcn.1400aa790
lea r11, [rsp + 0x8b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret