Function at 0x14003b310
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
cmp rbx, rdi
je 0x14003b377
add rbx, 0xffffffffffffffd0
jmp 0x14003b366
mov rcx, qword [rbx + 0x18]
call fcn.1401ae9b8
cmp byte [rbx + 0x17], 0
jns 0x14003b35a
mov rcx, qword [rbx]
call fcn.1401ae9b8
lea rax, [rbx - 0x30]
cmp rbx, rdi
mov rbx, rax
je 0x14003b377
test rbx, rbx
je 0x14003b47d
cmp byte [rbx + 0x2f], 0
jns 0x14003b34c
jmp 0x14003b343
mov qword [rsi + 8], rdi
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x60]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1402eb060]
movaps xmmword [rdi], xmm0
lea r8, str.SYSTEMCurrentControlSetControlSession_Manager
mov rcx, rdi
mov rdx, 0xffffffff80000002
mov r9d, 1
call fcn.14005f5f0
mov rdi, qword [rdi]
test rdi, rdi
je 0x14003b490
mov dword [rsp + 0x5c], 0
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov edx, 1
mov rcx, rbx
call fcn.14003bc40
mov dword [rsp + 0x3c], 0xaaaaaaaa
mov rax, qword [rbx]
cmp qword [rbx + 8], rax
je 0x14003b53b
lea r14, [rsp + 0x5c]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x3c]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x14003b447
cmp eax, 0xea
jne 0x14003b44e
mov ebx, 0x8000ffff
cmp dword [rsp + 0x3c], 7
jne 0x14003b45c
mov ecx, dword [rsp + 0x5c]
test cl, 1
jne 0x14003b45c
jmp 0x14003b4be
mov ebx, 0x80070002
jmp 0x14003b45c
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003b495
mov rax, qword [rsp + 0x48]
mov rdx, rax
sub rdx, rcx
dec rax
cmp rdx, rax
jbe 0x14003b54e
lea rcx, [0x1402f4f7c]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
call fcn.1401ec0b0
mov ebx, 0x80070002
lea rcx, [rsp + 0x60]
call fcn.14005f890
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401b0080
mov eax, ebx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rax, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov r9, r8
sub r9, rax
mov rdx, rcx
sub rdx, r9
jbe 0x14003b55d
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.14003bc40
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
cmp rcx, rax
je 0x14003b53b
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x3c]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003b44e
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
sub rdx, rcx
je 0x14003b53b
mov r8, rsi
call fcn.14003b060
mov ebx, eax
jmp 0x14003b45c
lea rcx, [0x1402f4f7c]
lea rdx, str....._third_partylibc_srcinclude_vector:1411:_assertion___n___size___failed:_vector___index_out_of_bounds_n
call fcn.1401ec0b0
mov qword [rsp + 0x48], rcx
call fcn.1401ae9b8
jmp 0x14003b495
jb 0x14003b564
mov rcx, r8
jmp 0x14003b4ee
add rcx, rax
mov rdx, r8
sub rdx, rcx
dec r8
cmp rdx, r8
ja 0x14003b47d
mov qword [rsp + 0x48], rcx
jmp 0x14003b4ee