Function at 0x140042cc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r14
sub rsp, 0x308
movabs rax, 0x79aca0a7efa02616
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x330], rax
movabs rsi, 0x79d8a0c1efcf2645
mov rax, qword [rsp + 0x330]
movabs r14, 0x225d3d90ec140ee6
mov qword [rsp + 0x60], rax
movabs rbx, 0x7f208cffb76bbd7
movabs rax, 0x22383de2ec750e91
movabs rdi, 0x642883de81de1428
mov qword [rsp + 0x330], rax
mov r9d, 0x20019
mov rax, qword [rsp + 0x330]
xor r8d, r8d
mov qword [rsp + 0x68], rax
mov rcx, 0xffffffff80000001
movabs rax, 0x7b30884fb33bb8b
mov qword [rsp + 0x330], rax
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x70], rax
movabs rax, 0x642883de81de1472
mov qword [rsp + 0x330], rax
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x330], rsi
mov rax, qword [rsp + 0x330]
mov qword [r11 - 0x2a8], rax
mov qword [rsp + 0x330], r14
mov rax, qword [rsp + 0x330]
mov qword [r11 - 0x2a0], rax
mov qword [rsp + 0x330], rbx
mov rax, qword [rsp + 0x330]
mov qword [r11 - 0x298], rax
mov qword [rsp + 0x330], rdi
mov rax, qword [rsp + 0x330]
mov qword [r11 - 0x290], rax
lea rax, [r11 + 0x18]
vmovdqu ymm0, ymmword [rsp + 0x80]
vpxor ymm1, ymm0, ymmword [rsp + 0x60]
vmovdqu ymmword [rsp + 0x60], ymm1
mov qword [rsp + 0x20], rax
vzeroupper
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004313c
mov dword [rsp + 0x330], 4
lea r9, [rsp + 0x338]
movabs rax, 0x79bda0acefaa2617
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x348], rax
xor r8d, r8d
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x40], rax
movabs rax, 0x222f3df5ec760e8b
mov qword [rsp + 0x348], rax
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x48], rax
movabs rax, 0x79b08a8fb19bb9b
mov qword [rsp + 0x348], rax
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x50], rax
movabs rax, 0x642883de81de1446
mov qword [rsp + 0x348], rax
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x348], rsi
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x348], r14
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x348], rbx
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x348], rdi
mov rax, qword [rsp + 0x348]
mov rcx, qword [rsp + 0x340]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x330]
vmovdqu ymm0, ymmword [rsp + 0xa0]
vpxor ymm1, ymm0, ymmword [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400a5d94]
mov qword [rsp + 0x20], rax
vmovdqu ymmword [rsp + 0x40], ymm1
vzeroupper
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140042f57
cmp dword [rsp + 0x338], 4
je 0x140042f5e
mov byte [0x1400a5d94], 0
mov dword [rsp + 0x330], 0x14
lea r9, [rsp + 0x338]
movabs rax, 0x79b1a0a6efa02609
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x348], rax
xor r8d, r8d
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x40], rax
movabs rax, 0x22243df5ec5f0e88
mov qword [rsp + 0x348], rax
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x348], rbx
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x348], rdi
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x348], rsi
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x348], r14
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x348], rbx
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x348], rdi
mov rax, qword [rsp + 0x348]
mov rcx, qword [rsp + 0x340]
mov qword [rsp + 0xd8], rax
lea rax, [rsp + 0x330]
vmovdqu ymm0, ymmword [rsp + 0xc0]
vpxor ymm1, ymm0, ymmword [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
vmovdqu ymmword [rsp + 0x40], ymm1
vzeroupper
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140043127
cmp dword [rsp + 0x338], 3
jne 0x140043127
xor edx, edx
mov eax, edx
nop dword [rax + rax]
movq xmm1, qword [rsp + rax + 0xe0]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
movdqu xmmword [rsp + rax*2 + 0x100], xmm1
add rax, 8
cmp rax, 0x10
jl 0x1400430a0
mov eax, 0x10
nop dword [rax + rax]
movzx ecx, byte [rsp + rax + 0xe0]
mov word [rsp + rax*2 + 0x100], cx
inc rax
cmp rax, 0x14
jl 0x1400430d0
mov qword [rsp + 0x38], rdx
lea rax, [0x1400a7300]
mov qword [rsp + 0x30], rdx
lea r8, [rsp + 0x100]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov r9d, 0xffffffff
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov word [rsp + 0x128], dx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x14004312e
mov byte [0x1400a7300], 0
mov rcx, qword [rsp + 0x340]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x308
pop r14
pop rdi
pop rsi
pop rbx
ret