Function at 0x14004c1bc
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a0
movaps xmmword [rsp + 0x290], xmm6
mov rdi, r9
mov rsi, rcx
lea rdx, [0x14022b7e0]
lea rbx, [rsp + 0x30]
mov rcx, rbx
call fcn.14003b270
cmp byte [rbx + 0x17], 0
jns 0x14004c1fa
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov rdx, rbx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14004c32b
xorps xmm6, xmm6
cmp eax, 2
jne 0x14004c3b2
lea rbx, [rsp + 0xb0]
movaps xmmword [rbx], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmm0, xmmword [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x30], rax
movaps xmmword [rsp + 0x30], xmm6
and qword [rsp + 0x40], 0
mov rax, qword [rdi + 0x10]
mov qword [rbx + 0x48], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbx + 0x38], xmm0
movups xmmword [rdi], xmm6
and qword [rdi + 0x10], 0
lea r8, [rsp + 0x80]
mov byte [r8 + 0x10], 1
lea rax, [0x14022b7ea]
mov qword [r8], rax
mov qword [r8 + 8], 0xb0
lea r14, [rsp + 0x150]
mov rcx, r14
mov rdx, rbx
call fcn.14004c8d8
mov rax, qword [r14 + 0x10]
lea rdi, [rsp + 0x1f0]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [r14]
and qword [r14 + 0x10], 0
movaps xmmword [rdi], xmm0
movaps xmmword [r14], xmm6
mov al, byte [r14 + 0x18]
mov byte [rdi + 0x18], al
movaps xmm0, xmmword [r14 + 0x20]
movaps xmmword [rdi + 0x20], xmm0
mov rax, qword [r14 + 0x30]
mov qword [rdi + 0x30], rax
movaps xmmword [r14 + 0x20], xmm6
and qword [r14 + 0x30], 0
movups xmm0, xmmword [r14 + 0x38]
movups xmmword [rdi + 0x38], xmm0
mov rax, qword [r14 + 0x48]
mov qword [rdi + 0x48], rax
movups xmmword [r14 + 0x38], xmm6
and qword [r14 + 0x48], 0
mov rcx, r14
call fcn.14004c964
mov rcx, rbx
call fcn.14004c964
mov rcx, rsi
mov rdx, rdi
call fcn.14004c994
mov rcx, rdi
call fcn.14004c964
jmp 0x14004c8ad
lea rbx, [rsp + 0x60]
and qword [rbx + 0x10], 0
xorps xmm0, xmm0
movaps xmmword [rbx], xmm0
xor eax, eax
lea r15, [rsp + 0x50]
lea r14, [rsp + 0x54]
mov r12, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
xor edx, edx
and dword [rsp + 0x54], 0
test dl, dl
movzx edx, dl
cmovs edx, ecx
mov dword [rsp + 0x50], edx
cmovns rax, rbx
mov rcx, qword [rsp + 0x58]
cmp byte [rdi + 0x17], 0
mov rdx, rdi
jns 0x14004c378
mov rdx, qword [rdi]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov r9, r14
call r12
cmp eax, 0xea
jne 0x14004c49e
mov edx, dword [rsp + 0x50]
mov rcx, rbx
call fcn.14001ee7e
mov dl, byte [rsp + 0x77]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
jmp 0x14004c352
lea rbx, [rsp + 0xd8]
movaps xmmword [rbx - 0x28], xmm6
movaps xmmword [rbx - 0x18], xmm6
mov dword [rbx - 8], eax
mov bpl, 1
lea rdx, [rsp + 0x80]
mov byte [rdx + 0x10], bpl
lea rax, [0x14022b89a]
mov qword [rdx], rax
mov qword [rdx + 8], 0x30
mov rcx, rbx
call fcn.140039a7c
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x30], rax
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x20], xmm0
movaps xmmword [rsp + 0x30], xmm6
and qword [rsp + 0x40], 0
mov rax, qword [rdi + 0x10]
mov qword [rbx + 0x48], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rbx + 0x38], xmm0
movups xmmword [rdi], xmm6
and qword [rdi + 0x10], 0
xor eax, eax
mov byte [rbx + 0x50], al
mov byte [rbx + 0x68], al
lea r8, [rsp + 0x98]
mov byte [r8 + 0x10], bpl
lea rax, [0x14022b8ca]
mov qword [r8], rax
mov qword [r8 + 8], 0xb0
lea rdi, [rsp + 0x150]
lea rbx, [rsp + 0xb0]
mov rcx, rdi
mov rdx, rbx
call fcn.14004c9f6
lea r14, [rsp + 0x1f0]
mov rcx, r14
mov rdx, rdi
call fcn.14004ca3e
mov rcx, rdi
call fcn.14004caf2
mov rcx, rbx
call fcn.14004caf2
mov rcx, rsi
mov rdx, r14
call fcn.14004cb38
mov rcx, r14
call fcn.14004caf2
jmp 0x14004c8ad
mov ebp, eax
test eax, eax
jne 0x14004c4e9
cmp dword [rsp + 0x54], 3
jne 0x14004c5fa
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rsi + 0xa0], 1
mov rax, qword [rsp + 0x70]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi], xmm0
and qword [rsp + 0x70], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
xor edx, edx
xor ecx, ecx
jmp 0x14004c8a8
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm6, xmm6
cmp ebp, 2
jne 0x14004c7b8
lea rbx, [rsp + 0xb0]
movaps xmmword [rbx], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmm0, xmmword [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x30], rax
movaps xmmword [rsp + 0x30], xmm6
and qword [rsp + 0x40], 0
mov rax, qword [rdi + 0x10]
mov qword [rbx + 0x48], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbx + 0x38], xmm0
movups xmmword [rdi], xmm6
and qword [rdi + 0x10], 0
lea r8, [rsp + 0x80]
mov byte [r8 + 0x10], 1
lea rax, [0x14022b97a]
mov qword [r8], rax
mov qword [r8 + 8], 0xb0
lea r14, [rsp + 0x150]
mov rcx, r14
mov rdx, rbx
call fcn.14004c8d8
mov rax, qword [r14 + 0x10]
lea rdi, [rsp + 0x1f0]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [r14]
and qword [r14 + 0x10], 0
movaps xmmword [rdi], xmm0
movaps xmmword [r14], xmm6
mov al, byte [r14 + 0x18]
mov byte [rdi + 0x18], al
movaps xmm0, xmmword [r14 + 0x20]
movaps xmmword [rdi + 0x20], xmm0
mov rax, qword [r14 + 0x30]
mov qword [rdi + 0x30], rax
movaps xmmword [r14 + 0x20], xmm6
and qword [r14 + 0x30], 0
movups xmm0, xmmword [r14 + 0x38]
movups xmmword [rdi + 0x38], xmm0
mov rax, qword [r14 + 0x48]
mov qword [rdi + 0x48], rax
movups xmmword [r14 + 0x38], xmm6
and qword [r14 + 0x48], 0
mov rcx, r14
call fcn.14004c964
mov rcx, rbx
call fcn.14004c964
mov rcx, rsi
mov rdx, rdi
call fcn.14004c994
mov rcx, rdi
call fcn.14004c964
jmp 0x14004c89f
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm6, xmm6
lea rbx, [rsp + 0xb0]
movaps xmmword [rbx], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmm0, xmmword [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x30], rax
movaps xmmword [rsp + 0x30], xmm6
and qword [rsp + 0x40], 0
mov rax, qword [rdi + 0x10]
mov qword [rbx + 0x48], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbx + 0x38], xmm0
movups xmmword [rdi], xmm6
and qword [rdi + 0x10], 0
lea rdx, [rsp + 0x80]
mov byte [rdx + 0x10], 1
lea rax, [0x14022bb0a]
mov qword [rdx], rax
mov qword [rdx + 8], 0xb0
lea rdi, [rsp + 0x150]
mov rcx, rdi
call fcn.140039a7c
mov rcx, rbx
mov rdx, rdi
call fcn.14004b3c8
mov rcx, qword [rdi]
mov dl, byte [rdi + 0x17]
call fcn.1400223ae
movaps xmm0, xmmword [rbx]
movaps xmmword [rdi], xmm0
mov rax, qword [rbx + 0x10]
mov qword [rdi + 0x10], rax
movaps xmmword [rbx], xmm6
and qword [rbx + 0x10], 0
mov bpl, byte [rbx + 0x18]
mov byte [rdi + 0x18], bpl
movaps xmm0, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm0
mov rax, qword [rbx + 0x30]
and qword [rbx + 0x30], 0
mov qword [rdi + 0x30], rax
movaps xmmword [rbx + 0x20], xmm6
movups xmm0, xmmword [rbx + 0x38]
movups xmmword [rdi + 0x38], xmm0
mov rax, qword [rbx + 0x48]
and qword [rbx + 0x48], 0
mov qword [rdi + 0x48], rax
movups xmmword [rbx + 0x38], xmm6
mov rax, qword [rdi + 0x10]
lea r14, [rsp + 0x1f0]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [rdi]
movaps xmmword [r14], xmm0
movaps xmmword [rdi], xmm6
and qword [rdi + 0x10], 0
mov byte [r14 + 0x18], bpl
mov rax, qword [rdi + 0x30]
mov qword [r14 + 0x30], rax
movaps xmm0, xmmword [rdi + 0x20]
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [rdi + 0x20], xmm6
and qword [rdi + 0x30], 0
mov rax, qword [rdi + 0x48]
mov qword [r14 + 0x48], rax
movups xmm0, xmmword [rdi + 0x38]
movups xmmword [r14 + 0x38], xmm0
movups xmmword [rdi + 0x38], xmm6
and qword [rdi + 0x48], 0
lea rcx, [rsp + 0x150]
call fcn.14004cb44
mov rcx, rbx
call fcn.14004cb44
mov byte [rsi + 0xa0], 0
mov rax, qword [r14 + 0x10]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [r14]
and qword [r14 + 0x10], 0
movups xmmword [rsi], xmm0
movaps xmmword [r14], xmm6
mov byte [rsi + 0x18], bpl
mov rax, qword [r14 + 0x30]
mov qword [rsi + 0x30], rax
movaps xmm0, xmmword [r14 + 0x20]
movups xmmword [rsi + 0x20], xmm0
movaps xmmword [r14 + 0x20], xmm6
and qword [r14 + 0x30], 0
mov rax, qword [r14 + 0x48]
mov qword [rsi + 0x48], rax
movups xmm0, xmmword [r14 + 0x38]
movups xmmword [rsi + 0x38], xmm0
movups xmmword [r14 + 0x38], xmm6
and qword [r14 + 0x48], 0
mov byte [rsi + 0x98], 3
mov rcx, r14
call fcn.14004cb44
jmp 0x14004c89f
lea rbx, [rsp + 0xd8]
movaps xmmword [rbx - 0x28], xmm6
movaps xmmword [rbx - 0x18], xmm6
mov dword [rbx - 8], ebp
mov bpl, 1
lea rdx, [rsp + 0x80]
mov byte [rdx + 0x10], bpl
lea rax, [0x14022ba2a]
mov qword [rdx], rax
mov qword [rdx + 8], 0x30
mov rcx, rbx
call fcn.140039a7c
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x30], rax
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x20], xmm0
movaps xmmword [rsp + 0x30], xmm6
and qword [rsp + 0x40], 0
mov rax, qword [rdi + 0x10]
mov qword [rbx + 0x48], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rbx + 0x38], xmm0
movups xmmword [rdi], xmm6
and qword [rdi + 0x10], 0
xor eax, eax
mov byte [rbx + 0x50], al
mov byte [rbx + 0x68], al
lea r8, [rsp + 0x98]
mov byte [r8 + 0x10], bpl
lea rax, [0x14022ba5a]
mov qword [r8], rax
mov qword [r8 + 8], 0xb0
lea rdi, [rsp + 0x150]
lea rbx, [rsp + 0xb0]
mov rcx, rdi
mov rdx, rbx
call fcn.14004c9f6
lea r14, [rsp + 0x1f0]
mov rcx, r14
mov rdx, rdi
call fcn.14004ca3e
mov rcx, rdi
call fcn.14004caf2
mov rcx, rbx
call fcn.14004caf2
mov rcx, rsi
mov rdx, r14
call fcn.14004cb38
mov rcx, r14
call fcn.14004caf2
mov rcx, qword [rsp + 0x60]
mov dl, byte [rsp + 0x77]
call fcn.14003a7a0
mov rcx, qword [rsp + 0x30]
mov dl, byte [rsp + 0x47]
call fcn.14003a7a0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x290]
add rsp, 0x2a0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret