Function at 0x14001b830
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rax, qword [0x14009a0a0]
xor rax, rsp
mov qword [rbp + 0x470], rax
mov rsi, r8
mov rbx, rcx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x38], r8
xor r14d, r14d
mov dword [rsp + 0x60], r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [rsp + 0x60], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x260]
call fcn.140043850
mov dword [rsp + 0x68], 0x104
mov dword [rsp + 0x64], r14d
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14001b8b5
mov rdx, qword [rsi]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001bcfb
lea rax, [rbp - 0x70]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x260]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14001bcfb
lea r9, [rbp + 0x5a]
mov r8d, dword [rsp + 0x64]
nop dword [rax]
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x14001b960
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
lea rax, [rbp + 0x5a]
cmp r9, rax
je 0x14001b9c4
lea r8, [rbp + 0x5a]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp - 0x30]
call fcn.140007cf0
mov dword [rsp + 0x60], 7
mov rcx, qword [rsi + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 9
jb 0x14001bd7c
mov rax, rsi
cmp qword [rsi + 0x18], 8
jb 0x14001b9f4
mov rax, qword [rsi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.Reg_key:
lea rcx, [rbp + 0x10]
call fcn.14000a3f0
mov dword [rsp + 0x60], 0xf
mov r8d, 5
lea rdx, str._has
lea rcx, [rbp + 0x10]
call fcn.14000b4c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov dword [rsp + 0x60], 0x1f
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.14001c930
mov dword [rsp + 0x60], 0x3f
mov r8d, 8
lea rdx, str._subkeys
lea rcx, [rbp - 0x10]
call fcn.14000b4c0
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov dword [rsp + 0x60], 0x7f
lea rcx, [rbp - 0x68]
call fcn.140030510
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x14001bb08
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bb03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bd82
call fcn.140040d10
mov qword [rbp], r14
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r14w
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x14001bb5a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bb54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bd88
call fcn.140040d10
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x14001bb9a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bb95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bd8e
call fcn.140040d10
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r14w
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001bbeb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bbe6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bd94
call fcn.140040d10
mov edi, r14d
cmp dword [rsp + 0x64], r14d
jbe 0x14001bcfb
nop dword [rax]
mov dword [rsp + 0x6c], 0xff
lea rax, [rbp - 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x6c]
lea r8, [rbp + 0x60]
mov edx, edi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001bcef
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
lea rax, [rbp + 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14001bc60
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x30]
call fcn.140007cf0
nop
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x14001bca3
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rbp - 0x30], r14w
add qword [rbx + 8], 0x20
jmp 0x14001bcb3
lea r8, [rbp - 0x30]
mov rcx, rbx
call fcn.14001c6d0
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001bcef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bcea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bd70
call fcn.140040d10
inc edi
cmp edi, dword [rsp + 0x64]
jb 0x14001bc00
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14001bd36
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14001bd31
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001bd76
mov rcx, r8
call fcn.140040d10
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 7
mov word [rsi], r14w
mov rax, rbx
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.140040cf0
lea r11, [rsp + 0x580]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140053844
nop
call fcn.140053844
nop
call fcn.140001380
nop
call fcn.140053844
nop
call fcn.140053844
nop
call fcn.140053844
nop
call fcn.140053844
int3