Function at 0x14000fe90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x3e0
mov rax, qword [0x1400ee020]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
mov r15, rcx
mov qword [rsp + 0x38], rcx
xor esi, esi
mov dword [rsp + 0x30], esi
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400f22b8], eax
jle 0x14000ff32
lea rcx, [0x1400f22b8]
call fcn.14003fa4c
cmp dword [0x1400f22b8], 0xffffffff
jne 0x14000ff32
xorps xmm0, xmm0
movups xmmword [0x1400f22c8], xmm0
mov qword [0x1400f22d8], rsi
mov qword [0x1400f22e0], 0xf
mov byte [0x1400f22c8], sil
lea rcx, [0x1400686a0]
call fcn.14003fcfc
lea rcx, [0x1400f22b8]
call fcn.14003f9e0
cmp qword [0x1400f22d8], rsi
je 0x14000ff4f
lea rdx, [0x1400f22c8]
mov rcx, r15
call fcn.140006160
jmp 0x1400108c5
xorps xmm0, xmm0
movups xmmword [rsp + 0x188], xmm0
mov qword [rsp + 0x198], rsi
mov qword [rsp + 0x1a0], 0xf
mov byte [rsp + 0x188], sil
lea rcx, [rsp + 0x160]
call fcn.14000f860
mov rbx, rax
lea rax, [rsp + 0x188]
cmp rax, rbx
je 0x14001001c
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0x10
jb 0x14000ffda
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ffd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400108f1
call fcn.14003fd14
mov qword [rsp + 0x198], rsi
mov qword [rsp + 0x1a0], 0xf
mov byte [rsp + 0x188], 0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x198], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rsp + 0x178]
cmp rdx, 0x10
jb 0x140010060
inc rdx
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001005a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400108f1
call fcn.14003fd14
nop
jmp 0x140010069
mov dword [rsp + 0x1c8], 0x200
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rsi
mov r8d, 0x59
lea rdx, str.UWk2oVkRDNSE5t0UmdlfcjJHAUmFaQBmZ0scXhVQGJTFVUIfAd2dhZWRtmBdHNTY11iXV1JCDAndq0YVkGWbw
lea rcx, [rsp + 0x80]
call fcn.140009770
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x60]
call fcn.1400139b0
mov rdx, rax
mov edi, 2
mov dword [rsp + 0x30], edi
cmp qword [rax + 0x18], 0x10
jb 0x1400100d1
mov rdx, qword [rax]
mov rbx, 0xffffffffffffffff
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x1400100e0
lea rcx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0x10
cmovae rcx, qword [rsp + 0x188]
mov r8, qword [rsp + 0x198]
cmp r8, rax
jne 0x14001011d
call fcn.140042790
test eax, eax
je 0x140010307
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], rsi
mov r8d, 0x59
lea rdx, str.S1hShYWwx3QWdsBcmFuWekYyMV3pqxYVVZKB3ZftQUNTwXU5rQB2F8oYH9YGXHADaSi82sJSs_9AHMW2CRoRVIg
lea rcx, [rsp + 0xa0]
call fcn.140009770
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x140]
call fcn.1400139b0
mov rdx, rax
mov edi, 6
mov dword [rsp + 0x30], edi
cmp qword [rax + 0x18], 0x10
jb 0x14001017d
mov rdx, qword [rax]
mov rax, rbx
inc rax
cmp byte [rdx + rax], 0
jne 0x140010180
lea rcx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0x10
cmovae rcx, qword [rsp + 0x188]
mov r8, qword [rsp + 0x198]
cmp r8, rax
jne 0x1400101bd
call fcn.140042790
test eax, eax
je 0x140010307
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xd8], rsi
mov r8d, 0x59
lea rdx, str.YnFFBSEJ6bYTZMMR0RDjZGJIMb1JBGdXhyfSlEGoYXd0bc1RPgeF9S7QWh4yckpRcG3x3jdHNUFUnhftUkF11eA
lea rcx, [rsp + 0xc0]
call fcn.140009770
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x120]
call fcn.1400139b0
mov rdx, rax
mov edi, 0xe
mov dword [rsp + 0x30], edi
cmp qword [rax + 0x18], 0x10
jb 0x14001021d
mov rdx, qword [rax]
mov rax, rbx
inc rax
cmp byte [rdx + rax], 0
jne 0x140010220
lea rcx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0x10
cmovae rcx, qword [rsp + 0x188]
mov r8, qword [rsp + 0x198]
cmp r8, rax
jne 0x14001025d
call fcn.140042790
test eax, eax
je 0x140010307
xorps xmm0, xmm0
movups xmmword [rsp + 0xe0], xmm0
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xf8], rsi
mov r8d, 0x59
lea rdx, str.WGRqlZDNjdcXZaENGdkHVjVkeNh4idLCJ1cJTcwdd3IhHIhAYIInAetIkcigdSU3VWxxywISIQocyJwBHiIsiIg
lea rcx, [rsp + 0xe0]
call fcn.140009770
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x100]
call fcn.1400139b0
mov rdx, rax
mov edi, 0x1e
mov dword [rsp + 0x30], edi
cmp qword [rax + 0x18], 0x10
jb 0x1400102bd
mov rdx, qword [rax]
mov rax, rbx
inc rax
cmp byte [rdx + rax], 0
jne 0x1400102c0
lea rcx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0x10
cmovae rcx, qword [rsp + 0x188]
mov r14, qword [rsp + 0x198]
cmp r14, rax
jne 0x1400102fc
mov r8, r14
call fcn.140042790
test eax, eax
je 0x140010307
cmp r14, 0x24
jne 0x140010307
xor r14b, r14b
jmp 0x14001030a
mov r14b, 1
test dil, 0x10
je 0x140010373
and edi, 0xffffffef
mov dword [rsp + 0x30], edi
mov rdx, qword [rsp + 0x118]
cmp rdx, 0x10
jb 0x14001035a
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010355
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400108f7
call fcn.14003fd14
movdqa xmm0, xmmword [0x1400e2e60]
movdqu xmmword [rsp + 0x110], xmm0
mov byte [rsp + 0x100], 0
test dil, 8
je 0x1400103dc
and edi, 0xfffffff7
mov dword [rsp + 0x30], edi
mov rdx, qword [rsp + 0x138]
cmp rdx, 0x10
jb 0x1400103c3
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400103be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400108fd
call fcn.14003fd14
movdqa xmm0, xmmword [0x1400e2e60]
movdqu xmmword [rsp + 0x130], xmm0
mov byte [rsp + 0x120], 0
test dil, 4
je 0x140010445
and edi, 0xfffffffb
mov dword [rsp + 0x30], edi
mov rdx, qword [rsp + 0x158]
cmp rdx, 0x10
jb 0x14001042c
inc rdx
mov rcx, qword [rsp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010427
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010903
call fcn.14003fd14
movdqa xmm0, xmmword [0x1400e2e60]
movdqu xmmword [rsp + 0x150], xmm0
mov byte [rsp + 0x140], 0
test dil, 2
je 0x140010488
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140010488
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010483
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010909
call fcn.14003fd14
test r14b, r14b
je 0x14001078e
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
mov r8d, 0x4f
lea rdx, str.d3JIRRkdaDT1VZsSHo2BQ0hrOcCQ9KDhIQZGx0QfBQUT3VTEn1GB8RCBhQFMNSM_wITYvACFczPIBI
lea rcx, [rsp + 0x40]
call fcn.1400092a0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.140013e20
nop
mov rdx, qword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x1a8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1b8], xmm1
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400104f0
lea rcx, [rsp + 0x1a8]
call fcn.1400092a0
lea rdx, [rsp + 0x1a8]
cmp qword [rsp + 0x1c0], 8
cmovae rdx, qword [rsp + 0x1a8]
lea rax, [rsp + 0x180]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdx, qword [rsp + 0x1c0]
cmp rdx, 8
jb 0x14001058d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010588
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001090f
call fcn.14003fd14
movdqa xmm0, xmmword [0x1400e2e50]
movdqu xmmword [rsp + 0x1b8], xmm0
mov word [rsp + 0x1a8], si
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400105c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1cc]
xor r8d, r8d
lea rdx, str.MachineGuid
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xorps xmm0, xmm0
test eax, eax
je 0x1400106b2
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
mov r8d, 0x59
lea rdx, str.Z0N0eWUw5LbDZJJQVJoIUDQ5ibFdzFRGl8mCVwGRZHFitWGAZ6CVxXSc1lpNfAlcQG3lxgYlhglBAlcWV3NEeaRQ
lea rcx, [rsp + 0x40]
call fcn.140009770
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1400139b0
nop
cmp qword [rax + 0x18], 0x10
jb 0x140010650
mov rax, qword [rax]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140010650
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x188]
call fcn.140008950
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140010780
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001077b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010915
jmp 0x14001077b
movups xmmword [rsp + 0x1a8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1b8], xmm1
lea rax, [rsp + 0x1d0]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400106d0
mov r8, rbx
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x1a8]
call fcn.1400092a0
nop
lea rdx, [rsp + 0x1a8]
cmp qword [rsp + 0x1c0], 8
cmovae rdx, qword [rsp + 0x1a8]
mov rax, qword [rsp + 0x1b8]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x1a8]
cmovae rdx, qword [rsp + 0x1a8]
lea rcx, [rsp + 0x188]
call fcn.140017b00
nop
mov rdx, qword [rsp + 0x1c0]
cmp rdx, 8
jb 0x140010780
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001077b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001091b
call fcn.14003fd14
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x160]
call fcn.140006160
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14000fdc0
mov rbx, rax
lea rdi, [0x1400f22c8]
cmp rdi, rax
je 0x14001083d
mov rdx, qword [0x1400f22e0]
cmp rdx, 0x10
jb 0x140010800
inc rdx
mov rcx, qword [0x1400f22c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400107fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010921
call fcn.14003fd14
mov qword [0x1400f22d8], rsi
mov qword [0x1400f22e0], 0xf
mov byte [0x1400f22c8], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x1400f22c8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1400f22d8], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14001087a
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010875
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010921
call fcn.14003fd14
mov rdx, rdi
mov rcx, r15
call fcn.140006160
nop
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0x10
jb 0x1400108c5
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400108c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010927
call fcn.14003fd14
mov rax, r15
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.14003f9c0
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.140046658
nop
call fcn.140046658
nop
call fcn.140046658
nop
call fcn.140046658
nop
call fcn.140046658
nop
call fcn.140046658
nop
call fcn.140046658
int3
call fcn.140046658
int3
call fcn.140046658
nop
call fcn.140046658
int3