Function at 0x14000abe0
Capabilities:
Get thread local storage value
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov qword [rbp + 8], 0xfffffffffffffffe
mov qword [rsp + 0x508], rbx
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov esi, r9d
mov dword [rsp + 0x60], r9d
mov r13, r8
mov qword [rbp - 0x80], r8
mov qword [rsp + 0x50], rdx
mov r14, rcx
mov qword [rbp - 0x58], rcx
mov ecx, 2
call fcn.1400a82f0
mov rdi, rax
mov qword [rsp + 0x58], rax
mov qword [rbp - 0x40], rax
xor r12d, r12d
mov word [rax], r12w
lea ecx, [r12 + 2]
call fcn.1400a82f0
mov rbx, rax
mov qword [rbp - 0x38], rax
mov word [rax], r12w
lea ecx, [r12 + 2]
call fcn.1400a82f0
mov r15, rax
mov qword [rbp], rax
mov word [rax], r12w
lea ecx, [r12 + 2]
call fcn.1400a82f0
mov qword [rbp - 0x30], rax
mov word [rax], r12w
lea r12, [0x1400d1428]
cmp esi, 0xffffffff
jne 0x14000ae65
mov rcx, r12
call fcn.1400a8238
mov r13, rax
mov rcx, r12
call fcn.1400a8238
mov qword [rsp + 0x40], rax
mov rcx, r12
call fcn.1400a8238
mov qword [rsp + 0x48], rax
mov rcx, r12
call fcn.1400a8238
mov qword [rsp + 0x68], rax
mov rcx, r12
call fcn.1400a8238
mov qword [rsp + 0x70], rax
mov rcx, r12
call fcn.1400a8238
mov qword [rbp - 0x78], rax
mov rcx, r12
call fcn.1400a8238
mov rdi, rax
mov qword [rbp - 0x50], rax
mov rcx, r12
mov rax, qword [rbp - 0x80]
test rax, rax
cmovne rcx, rax
call fcn.1400a8238
mov rsi, rax
mov qword [rsp + 0x60], rax
lea rcx, [0x1400d2938]
call fcn.1400a8238
mov r14, rax
mov qword [rbp - 0x60], rax
mov rcx, r12
mov rax, qword [rbp - 0x80]
test rax, rax
cmovne rcx, rax
call fcn.1400a8238
mov r12, rax
mov qword [rsp + 0x78], rax
lea r9, [rbp - 0x50]
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.140009060
nop
lea r9, [rbp - 0x60]
lea r8, [rsp + 0x78]
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp - 0x48]
call fcn.140009060
mov qword [rsp + 0x78], rax
mov ecx, dword [0x140126180]
test cl, 1
jne 0x14000adad
or ecx, 1
mov dword [0x140126180], ecx
mov ecx, 2
call fcn.1400a82f0
mov qword [0x140126178], rax
xor ecx, ecx
mov word [rax], cx
lea rcx, [0x1400cead0]
call fcn.1400a8ffc
mov rax, qword [0x140126178]
mov qword [rbp - 0x60], rax
mov rcx, qword [rsp + 0x78]
mov rcx, qword [rcx]
call fcn.1400a8238
mov qword [0x140126178], rax
mov rcx, qword [rbp - 0x60]
call fcn.1400a82b0
xor eax, eax
mov dword [rsp + 0x60], eax
mov rcx, qword [rbp - 0x48]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x70]
call fcn.1400a82b0
nop
mov rcx, r12
call fcn.1400a82b0
nop
mov rcx, r14
call fcn.1400a82b0
nop
mov rcx, rsi
call fcn.1400a82b0
nop
mov rcx, rdi
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x78]
call fcn.1400a82b0
nop
mov rcx, qword [rsp + 0x70]
call fcn.1400a82b0
nop
mov rcx, qword [rsp + 0x68]
call fcn.1400a82b0
nop
mov rcx, qword [rsp + 0x48]
call fcn.1400a82b0
nop
mov rcx, qword [rsp + 0x40]
call fcn.1400a82b0
nop
mov rcx, r13
call fcn.1400a82b0
lea r12, [0x1400d1428]
mov rdi, qword [rsp + 0x58]
mov r13, qword [rbp - 0x80]
mov r14, qword [rbp - 0x58]
mov ecx, dword [0x1401252dc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x20], rcx
mov r9d, eax
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rsp + 0x50]
call fcn.1400075c0
test eax, eax
jne 0x14000b43d
mov dword [rbp - 0x68], 0x320
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b432
cmp dword [rbp - 0x68], eax
je 0x14000b432
lea ecx, [rax + 2]
call fcn.1400a82f0
mov qword [rbp - 0x20], rax
xor ecx, ecx
mov word [rax], cx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rcx
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x20]
call fcn.140007b90
mov rsi, qword [rbp - 0x18]
test al, al
je 0x14000b3fb
mov rcx, qword [rsi]
mov qword [rbp - 0x50], rcx
movzx eax, word [rcx]
cmp ax, word [0x1400d28a8]
jne 0x14000af3e
movzx eax, word [rcx + 2]
cmp ax, word [0x1400d28aa]
jne 0x14000af3e
movzx eax, word [rcx + 4]
cmp ax, word [0x1400d28ac]
je 0x14000b3fb
xor r9d, r9d
lea r8, [rbp - 0x20]
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.1400058f0
mov rcx, qword [rax]
call fcn.1400a8238
mov qword [rbp - 0x40], rax
mov rcx, rdi
call fcn.1400a82b0
mov rcx, qword [rsp + 0x40]
call fcn.1400a82b0
lea rcx, [0x1400d2938]
call fcn.1400a8238
mov r14, rax
mov qword [rsp + 0x40], rax
mov rcx, r12
test r13, r13
cmovne rcx, r13
call fcn.1400a8238
mov rsi, rax
mov qword [rsp + 0x48], rax
mov rcx, r12
call fcn.1400a8238
mov rdi, rax
mov qword [rsp + 0x68], rax
mov rcx, r12
test r13, r13
cmovne rcx, r13
call fcn.1400a8238
mov rbx, rax
mov qword [rsp + 0x70], rax
mov rcx, r12
mov rax, qword [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call fcn.1400a8238
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.140009060
mov r12, rax
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp - 0x78]
call fcn.140009060
nop
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
mov r9, r12
mov r8, rax
lea rdx, [rsp + 0x58]
mov rcx, qword [rbp - 0x58]
call fcn.140004500
movzx r12d, al
mov rcx, qword [rbp - 0x78]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x70]
call fcn.1400a82b0
nop
mov rcx, qword [rsp + 0x58]
call fcn.1400a82b0
nop
mov rcx, rbx
call fcn.1400a82b0
nop
mov rcx, rdi
call fcn.1400a82b0
nop
mov rcx, rsi
call fcn.1400a82b0
nop
mov rcx, r14
call fcn.1400a82b0
test r12b, r12b
je 0x14000b3ea
cmp dword [rsp + 0x60], 0xffffffff
jne 0x14000b25a
lea r14, [0x1400d1428]
mov rcx, r14
call fcn.1400a8238
mov r12, rax
mov rcx, r14
call fcn.1400a8238
mov r13, rax
mov rcx, r14
call fcn.1400a8238
mov qword [rbp - 0x58], rax
mov rcx, r14
call fcn.1400a8238
mov qword [rbp - 0x60], rax
mov rcx, r14
call fcn.1400a8238
mov qword [rsp + 0x78], rax
mov rcx, r14
call fcn.1400a8238
mov qword [rbp - 0x48], rax
mov rcx, r14
call fcn.1400a8238
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rcx, r14
mov rax, qword [rbp - 0x80]
test rax, rax
cmovne rcx, rax
call fcn.1400a8238
mov rdi, rax
mov qword [rsp + 0x48], rax
lea rcx, [0x1400d2938]
call fcn.1400a8238
mov rsi, rax
mov qword [rsp + 0x68], rax
mov rcx, r14
mov rax, qword [rbp - 0x80]
test rax, rax
cmovne rcx, rax
call fcn.1400a8238
mov r14, rax
mov qword [rsp + 0x70], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.140009060
nop
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp - 0x78]
call fcn.140009060
mov qword [rsp + 0x40], rax
mov ecx, dword [0x140126180]
test cl, 1
jne 0x14000b1b4
or ecx, 1
mov dword [0x140126180], ecx
mov ecx, 2
call fcn.1400a82f0
mov qword [0x140126178], rax
xor ecx, ecx
mov word [rax], cx
lea rcx, [0x1400cead0]
call fcn.1400a8ffc
mov rax, qword [0x140126178]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call fcn.1400a8238
mov qword [0x140126178], rax
mov rcx, qword [rsp + 0x48]
call fcn.1400a82b0
xor eax, eax
mov dword [rsp + 0x60], eax
mov rcx, qword [rbp - 0x78]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x70]
call fcn.1400a82b0
nop
mov rcx, r14
call fcn.1400a82b0
nop
mov rcx, rsi
call fcn.1400a82b0
nop
mov rcx, rdi
call fcn.1400a82b0
nop
mov rcx, rbx
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x48]
call fcn.1400a82b0
nop
mov rcx, qword [rsp + 0x78]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x60]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x58]
call fcn.1400a82b0
nop
mov rcx, r13
call fcn.1400a82b0
nop
mov rcx, r12
call fcn.1400a82b0
mov r13, qword [rbp - 0x80]
lea rbx, [0x1400d1428]
mov rcx, rbx
call fcn.1400a8238
mov rsi, rax
mov qword [rbp - 0x78], rax
mov rcx, rbx
call fcn.1400a8238
mov r14, rax
mov qword [rbp - 0x70], rax
lea rcx, [0x1400d2938]
call fcn.1400a8238
mov r12, rax
mov qword [rsp + 0x40], rax
mov rcx, rbx
test r13, r13
cmovne rcx, r13
call fcn.1400a8238
mov r13, rax
mov qword [rsp + 0x48], rax
mov rax, qword [rbp - 0x50]
test rax, rax
cmovne rbx, rax
mov rcx, rbx
call fcn.1400a8238
mov rdi, rax
mov qword [rbp - 0x48], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.140009060
mov rbx, rax
mov edx, dword [0x140126180]
test dl, 1
jne 0x14000b316
or edx, 1
mov dword [0x140126180], edx
mov ecx, 2
call fcn.1400a82f0
mov qword [0x140126178], rax
xor ecx, ecx
mov word [rax], cx
lea rcx, [0x1400cead0]
call fcn.1400a8ffc
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x58], rax
cmp dword [rsp + 0x60], 0xffffffff
je 0x14000b392
mov ecx, 2
call fcn.1400a82f0
mov qword [rsp + 0x68], rax
xor ecx, ecx
mov word [rax], cx
mov rcx, qword [rbx]
call fcn.1400a8238
mov rbx, rax
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x68]
call fcn.1400a82b0
cmp dword [0x14012591c], 1
jne 0x14000b366
lea rcx, str.System
jmp 0x14000b382
mov rcx, qword [0x140125920]
test rcx, rcx
je 0x14000b37b
add rcx, 0x210
jmp 0x14000b382
lea rcx, str.Local_System
mov r8, rbx
mov rdx, qword [rsp + 0x58]
call fcn.140045300
nop
jmp 0x14000b3a8
mov rbx, qword [0x140126178]
mov rcx, rdi
call fcn.1400a8238
mov qword [0x140126178], rax
mov rcx, rbx
call fcn.1400a82b0
nop
mov rcx, qword [rsp + 0x70]
call fcn.1400a82b0
nop
mov rcx, rdi
call fcn.1400a82b0
nop
mov rcx, r13
call fcn.1400a82b0
nop
mov rcx, r12
call fcn.1400a82b0
nop
mov rcx, r14
call fcn.1400a82b0
nop
mov rcx, rsi
call fcn.1400a82b0
jmp 0x14000b3f3
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x58], rax
mov rsi, qword [rbp - 0x18]
mov rbx, qword [rbp - 0x38]
test rsi, rsi
je 0x14000b429
mov rdi, rsi
mov r14, qword [rbp - 0x10]
cmp rsi, r14
je 0x14000b421
nop dword [rax]
mov rcx, qword [rdi]
call fcn.1400a82b0
add rdi, 8
cmp rdi, r14
jne 0x14000b410
mov rcx, rsi
call fcn.1400a7cb8
mov rcx, qword [rbp - 0x20]
call fcn.1400a82b0
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp - 0x30]
call fcn.1400a82b0
nop
mov rcx, r15
call fcn.1400a82b0
nop
mov rcx, rbx
call fcn.1400a82b0
nop
mov rcx, qword [rsp + 0x58]
call fcn.1400a82b0
mov eax, dword [rsp + 0x60]
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1400ab140
mov rbx, qword [rsp + 0x508]
add rsp, 0x4b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret