Function at 0x1400f9d70
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x140214ba0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r15, rdx
mov r12, rcx
mov qword [rsp + 0x60], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [r11 - 0x78], xmm0
movups xmmword [r11 - 0x68], xmm0
movups xmmword [r11 - 0x58], xmm0
movss dword [rsp + 0xe0], xmm0
xor esi, esi
mov qword [r11 - 0x80], rsi
mov qword [r11 - 0x78], rsi
lea ecx, [rsi + 0x50]
call fcn.14014f910
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf8], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x118], 8
movss xmm0, dword [0x1401efb6c]
movss dword [rsp + 0xe0], xmm0
mov r8, rax
lea edx, [rsi + 0x10]
lea rcx, [rsp + 0xf8]
call fcn.140052b40
nop
mov dword [rsp + 0xd0], esi
mov dword [rsp + 0xc8], esi
mov dword [rsp + 0xcc], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0xcc]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x1400f9f4f
lea rdx, [rsp + 0xe0]
mov rcx, r15
call fcn.1400f8c50
nop
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf8]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov r8, rcx
cmp rdx, 0x1000
jb 0x1400f9ef9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x1400fa23c
call fcn.14014f900
xorps xmm0, xmm0
mov qword [rsp + 0xf8], rsi
movdqa xmmword [rsp + 0x100], xmm0
lea rcx, [rsp + 0xe8]
call fcn.140052360
mov rax, r15
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14014f8e0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
inc dword [rsp + 0xcc]
inc dword [rsp + 0xc8]
mov ecx, dword [rsp + 0xcc]
mov eax, 2
mul rcx
mov rbx, rax
mov r13, 0xffffffffffffffff
cmovo rbx, r13
mov rcx, rbx
call fcn.14014ff50
mov rdi, rax
test rax, rax
je 0x1400f9f99
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.140152110
jmp 0x1400f9f9c
mov rdi, rsi
mov qword [rsp + 0x120], rdi
mov ecx, dword [rsp + 0xc8]
mov eax, 2
mul rcx
mov r14, rax
cmovo r14, r13
mov rcx, r14
call fcn.14014ff50
mov rbx, rax
test rax, rax
je 0x1400f9fd9
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.140152110
jmp 0x1400f9fdc
mov rbx, rsi
mov qword [rsp + 0x128], rbx
mov r14d, esi
nop word [rax + rax]
cmp r14d, dword [rsp + 0xd0]
jae 0x1400fa1c6
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0xdc], eax
mov eax, dword [rsp + 0xcc]
mov dword [rsp + 0xd8], eax
mov dword [rsp + 0xd4], esi
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0xd4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xdc]
mov r8, rbx
mov edx, r14d
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1400fa0fc
mov rcx, r15
call fcn.140052280
nop
test rbx, rbx
je 0x1400fa07c
mov rcx, rbx
call fcn.14014f900
nop
test rdi, rdi
je 0x1400fa08a
mov rcx, rdi
call fcn.14014f900
nop
mov rax, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf8]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fa0ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fa242
call fcn.14014f900
mov qword [rsp + 0xf8], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x100], xmm0
lea rcx, [rsp + 0xe8]
call fcn.140052360
mov rax, r15
jmp 0x1400f9f22
mov eax, dword [rsp + 0xd4]
dec eax
cmp eax, 1
ja 0x1400fa1be
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], si
mov r8, r13
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400fa130
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1400260f0
nop
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], si
mov r8, r13
inc r8
cmp word [rdi + r8*2], 0
jne 0x1400fa170
mov rdx, rdi
lea rcx, [rsp + 0x90]
call fcn.1400260f0
nop
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xe0]
call fcn.1400f8600
nop
lea rcx, [rsp + 0x90]
call fcn.140026440
lea rcx, [rsp + 0x70]
call fcn.140026440
inc r14d
jmp 0x1400f9ff0
test rbx, rbx
je 0x1400fa1d4
mov rcx, rbx
call fcn.14014f900
nop
test rdi, rdi
je 0x1400fa1e2
mov rcx, rdi
call fcn.14014f900
nop
jmp 0x1400fa1eb
lea rdx, [rsp + 0xe0]
mov rcx, r15
call fcn.1400f8c50
nop
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf8]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f9ef9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f9ef9
call fcn.140156b00
int3
call fcn.140156b00
int3