Function at 0x14000b380
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x6b8]
sub rsp, 0x790
mov rax, qword [0x1400010c0]
xor rax, rsp
mov qword [rbp + 0x680], rax
mov rdi, rdx
mov qword [rbp - 0x78], rdx
xor r14d, r14d
mov dword [rsp + 0x40], r14d
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx], r14
mov qword [rdx + 8], r14
mov qword [rdx + 0x10], r14
lea r15d, [r14 + 1]
mov dword [rsp + 0x40], r15d
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x140002478]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000b7bf
mov ebx, 0x104
mov dword [rbp - 0x14], ebx
mov r13d, r15d
xor edx, edx
jmp 0x14000b784
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov r8d, 0x3d
lea rdx, [0x140002478]
lea rcx, [rsp + 0x48]
call fcn.140005980
nop
lea r8, [0x1400024c0]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x48]
call fcn.140009b20
nop
lea r8, [rbp + 0x170]
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.140009b20
nop
lea r8, [0x1400024b8]
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.140009b20
nop
lea rcx, [rbp - 0x68]
call fcn.140004ea0
nop
lea rcx, [rbp - 0x48]
call fcn.140004ea0
nop
lea rcx, [rsp + 0x48]
call fcn.140004ea0
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rdx, qword [rbp + 0x40]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [rax]
test eax, eax
jne 0x14000b772
mov dword [rbp - 0x18], ebx
lea r12d, [rax + 1]
xor edx, edx
jmp 0x14000b738
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r14
lea rax, [rbp + 0x60]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r14b
jne 0x14000b50f
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.140005980
nop
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 8]
call fcn.140007500
or r15d, 2
mov dword [rsp + 0x40], r15d
lea rbx, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova rbx, qword [rbp - 8]
lea rcx, [rbp - 8]
cmova rcx, qword [rbp - 8]
mov rsi, qword [rbp + 8]
add rsi, rcx
jmp 0x14000b5a9
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
test eax, eax
je 0x14000b5a6
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isupper]
neg eax
sbb cl, cl
and cl, 0xe0
add cl, 0x61
movzx r8d, cl
movsx ecx, byte [rbx]
sub ecx, r8d
add ecx, 0xd
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1a
sub ecx, eax
add cl, r8b
mov byte [rbx], cl
inc rbx
cmp rbx, rsi
jne 0x14000b55e
lea rcx, [rsp + 0x68]
call fcn.140004ea0
lea r14, [rbp - 8]
mov rdx, qword [rbp - 8]
mov r8, qword [rbp + 0x10]
cmp r8, 0xf
cmova r14, rdx
lea rbx, [rbp - 8]
cmova rbx, rdx
mov r10, qword [rbp + 8]
add rbx, r10
lea rsi, [rbp - 8]
cmp r8, 0xf
cmova rsi, rdx
cmp rsi, rbx
je 0x14000b611
sub r14, rsi
movsx ecx, byte [rsi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte ds:[r14 + rsi], al
inc rsi
cmp rsi, rbx
jne 0x14000b5ef
mov r8, qword [rbp + 0x10]
mov r10, qword [rbp + 8]
mov rdx, qword [rbp - 8]
lea rcx, [rbp - 8]
cmp r8, 0xf
cmova rcx, rdx
mov qword [rsp + 0x20], 4
lea r9, [0x1400024c4]
mov rdx, r10
call fcn.140009c00
cmp rax, 0xffffffffffffffff
je 0x14000b715
mov dword [rbp - 0x10], 0x400
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x280]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor r14d, r14d
test eax, eax
jne 0x14000b718
cmp dword ds:[rbp - 0x10], 0x44
jb 0x14000b718
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x30], 0xf
mov byte [rbp + 0x18], r14b
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
lea rcx, [rbp + 0x18]
call fcn.140005540
mov rax, qword [rbp + 0x2bc]
mov qword [rbp + 0x38], rax
mov rbx, qword [rdi + 8]
cmp rbx, qword [rdi + 0x10]
je 0x14000b6fa
mov qword [rbp - 0x70], rbx
lea rdx, [rbp + 0x18]
mov rcx, rbx
call fcn.140007500
nop
mov rax, qword [rbp + 0x38]
mov qword [rbx + 0x20], rax
add qword [rdi + 8], 0x28
jmp 0x14000b70a
lea r8, [rbp + 0x18]
mov rdx, rbx
mov rcx, rdi
call fcn.14000c5c0
nop
lea rcx, [rbp + 0x18]
call fcn.140004ea0
jmp 0x14000b718
xor r14d, r14d
mov ebx, 0x104
mov dword [rbp - 0x18], ebx
and r15d, 0xfffffffd
mov dword [rsp + 0x40], r15d
lea rcx, [rbp - 8]
call fcn.140004ea0
mov edx, r12d
inc r12d
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x18]
lea r8, [rbp + 0x60]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
nop
test eax, eax
je 0x14000b4f6
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x14], ebx
lea rcx, [rbp + 0x40]
call fcn.140004ea0
mov edx, r13d
inc r13d
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x14]
lea r8, [rbp + 0x170]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14000b425
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
mov rcx, qword [rbp + 0x680]
xor rcx, rsp
call fcn.14000d960
lea r11, [rsp + 0x790]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret