Function at 0x140012dd0
Capabilities:
Check if file exists
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x4b0], rbx
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov rsi, rcx
lea rax, [rbp + 0xb0]
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], 0x41
xor r13d, r13d
mov word [rbp + 0xb0], r13w
lea rdi, fcn.140008d70
mov qword [rbp + 0x98], rdi
lea r14, [0x14008b078]
mov qword [rbp + 0x90], r14
mov dword [rbp + 0x138], r13d
mov qword [rbp + 0x140], r13
mov qword [rsp + 0x20], r13
mov r9d, 0xf003f
mov r8, qword [0x1400ca1d8]
lea rcx, [rbp + 0x90]
call fcn.1400177b0
test eax, eax
js 0x14003a66a
mov r15d, r13d
mov dword [rsp + 0x40], r13d
lea r12, [fcn.140016920]
nop dword [rax]
nop word [rax + rax]
mov dword [rsp + 0x44], 0x100
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov rcx, qword [rbp + 0x140]
test rcx, rcx
je 0x14003a68a
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x44]
lea r8, [rbp + 0x150]
mov edx, r15d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001357b
lea ebx, [rax + 1]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x103
je 0x1400135ba
test ebx, ebx
je 0x14003a9b8
lea rax, [rbp - 0x10]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x41
mov word [rbp - 0x10], r13w
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x30], r14
mov dword [rbp + 0x78], r13d
mov qword [rbp + 0x80], r13
mov qword [rsp + 0x20], r13
mov r9d, 0xf003f
lea r8, [rbp + 0x150]
mov rdx, qword [rbp + 0x140]
lea rcx, [rbp - 0x30]
call fcn.1400177b0
test eax, eax
js 0x14003a98f
lea rax, [0x14008ca70]
mov qword [rsp + 0x50], rax
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
lea rcx, [0x1400c9e30]
cmp rax, r12
jne 0x14003a69d
call fcn.140016920
add rax, 0x18
mov qword [rsp + 0x58], rax
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
lea rcx, [0x1400c9e30]
cmp rax, r12
jne 0x14003a6a9
call fcn.140016920
add rax, 0x18
mov qword [rsp + 0x60], rax
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
lea rcx, [0x1400c9e30]
cmp rax, r12
jne 0x14003a6b5
call fcn.140016920
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 1
mov qword [rsp + 0x74], 1
mov dword [rbp - 0x80], 0xffffffff
mov qword [rbp - 0x7c], 0
mov dword [rsp + 0x7c], 1
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
lea rcx, [0x1400c9e30]
cmp rax, r12
jne 0x14003a6c1
call fcn.140016920
add rax, 0x18
mov qword [rbp - 0x70], rax
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.140019a90
mov rbx, qword [rbp - 0x70]
test eax, eax
js 0x140013391
mov r14, r13
mov rdi, qword [rsi]
cmp rdi, qword [rsi + 0x28]
je 0x14001308d
test r14, r14
jne 0x14003a6de
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14003a6cd
js 0x14003a6d5
mov rdi, qword [rdi + 0x58]
jmp 0x14001305e
test r14, r14
jne 0x14003a6de
cmp qword [rsi + 0x10], 0
je 0x1400134c4
mov r14, qword [rsi + 0x10]
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r14
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
lea rcx, [0x1400c9e30]
cmp rax, r12
jne 0x14003a723
call fcn.140016920
lea r10, [rax + 0x18]
mov qword [r14], r10
test rbx, rbx
je 0x14003a766
test rbx, 0xffffffffffff0000
je 0x14003a72f
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rbx + rdi*2], 0
jne 0x1400130f2
test edi, edi
je 0x14003a766
mov r12d, dword [r10 - 0x10]
mov r15, rbx
sub r15, r10
sar r15, 1
mov ecx, 1
sub ecx, dword [r10 - 8]
mov eax, dword [r10 - 0xc]
sub eax, edi
or eax, ecx
jge 0x140013131
mov edx, edi
mov rcx, r14
call fcn.1400164a0
mov r10, qword [r14]
movsxd rdx, edi
add rdx, rdx
mov r9, rdx
mov rcx, r10
cmp r15, r12
jbe 0x14003a756
mov r8, rbx
call qword [sym.imp.msvcrt.dll_memcpy_s]
test edi, edi
js 0x14003a958
mov rax, qword [r14]
cmp edi, dword [rax - 0xc]
jg 0x14003a958
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [r14]
mov word [rax + rcx*2], r13w
lea r15, [r14 + 8]
mov qword [rbp - 0x40], r15
lea rax, [0x14008ca70]
mov qword [r15], rax
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
lea r13, [fcn.140016920]
lea rcx, [0x1400c9e30]
cmp rax, r13
jne 0x14003a774
call fcn.140016920
add rax, 0x18
mov qword [r15 + 8], rax
lea rdi, [r15 + 0x10]
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
lea rcx, [0x1400c9e30]
cmp rax, r13
jne 0x14003a780
call fcn.140016920
add rax, 0x18
mov qword [rdi], rax
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
lea rcx, [fcn.140016920]
cmp rax, rcx
lea rcx, [0x1400c9e30]
jne 0x14003a78c
call fcn.140016920
add rax, 0x18
mov qword [r15 + 0x18], rax
mov rdx, qword [rsp + 0x58]
lea rcx, [rdx - 0x18]
mov r12, qword [r15 + 8]
sub r12, 0x18
cmp rcx, r12
jne 0x14003a798
mov rdx, qword [rsp + 0x60]
lea rcx, [rdx - 0x18]
mov r12, qword [rdi]
sub r12, 0x18
cmp rcx, r12
jne 0x14003a7e1
mov rdx, qword [rsp + 0x68]
lea rcx, [rdx - 0x18]
mov r12, qword [r15 + 0x18]
sub r12, 0x18
cmp rcx, r12
jne 0x14003a825
mov eax, dword [rsp + 0x70]
mov dword [r15 + 0x20], eax
mov eax, dword [rsp + 0x74]
mov dword [r15 + 0x24], eax
mov eax, dword [rsp + 0x78]
mov dword [r15 + 0x28], eax
mov eax, dword [rsp + 0x7c]
mov dword [r15 + 0x2c], eax
mov eax, dword [rbp - 0x80]
mov dword [r15 + 0x30], eax
mov eax, dword [rbp - 0x7c]
mov dword [r15 + 0x34], eax
mov eax, dword [rbp - 0x78]
mov dword [r15 + 0x38], eax
mov dword [r14 + 0x48], 1
lea r12, [r14 + 0x60]
xor r13d, r13d
mov qword [r12], r13
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0x50]
mov qword [rsi + 0x10], rcx
mov dword [r14 + 0x48], r13d
lea rcx, [r14 + 0x50]
test rcx, rcx
je 0x14003a984
mov rax, qword [rsi + 0x28]
mov qword [rcx], rax
lea rcx, [r14 + 0x58]
test rcx, rcx
je 0x14003a979
mov rax, qword [rsi + 0x28]
mov qword [rcx], rax
test r12, r12
je 0x14003a96e
mov rax, qword [rsi + 0x28]
mov qword [r12], rax
inc qword [rsi + 8]
mov r15d, r13d
mov rdi, qword [rsi]
cmp rdi, qword [rsi + 0x28]
je 0x140013317
mov r15, rdi
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jle 0x14003a86a
mov rdi, qword [rdi + 0x58]
jmp 0x1400132f4
mov qword [r12], r15
test r15, r15
je 0x14001358b
mov rdx, qword [r15]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jle 0x14003a873
mov qword [r15 + 0x58], r14
mov dword [r14 + 0x48], r13d
mov rax, qword [rsi]
cmp r14, rax
je 0x14001335c
mov r10, r14
mov r9, r14
mov rdx, qword [r14 + 0x60]
cmp dword [rdx + 0x48], 0
je 0x140013462
mov dword [rax + 0x48], 1
mov rcx, qword [rsi]
add rcx, 0x60
je 0x14003a963
mov rax, qword [rsi + 0x28]
mov qword [rcx], rax
mov r15d, dword [rsp + 0x40]
lea r12, [fcn.140016920]
lea r14, [0x14008b078]
lea rdi, fcn.140008d70
inc r15d
mov dword [rsp + 0x40], r15d
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400133ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
lea r8, [fcn.1400168c0]
cmp rax, r8
jne 0x14003a8e8
call fcn.1400168c0
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x14003a8f4
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x14003a90a
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x14003a920
mov qword [rbp - 0x30], r14
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x140013434
cmp dword [rbp + 0x78], 0
je 0x140013434
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea rax, [0x14008cac0]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdi
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140012ea0
lea rax, [rbp - 0x10]
cmp rcx, rax
je 0x140012ea0
jmp 0x14003a936
mov rcx, qword [rdx + 0x60]
mov rax, qword [rcx + 0x50]
cmp rdx, rax
je 0x14003a87c
test rax, rax
je 0x140013482
cmp dword [rax + 0x48], 0
je 0x140013593
cmp r14, qword [rdx + 0x50]
je 0x14003a8d7
mov rax, qword [r14 + 0x60]
mov dword [rax + 0x48], 1
mov rax, qword [r14 + 0x60]
mov rcx, qword [rax + 0x60]
mov dword [rcx + 0x48], r13d
mov rdx, qword [r14 + 0x60]
mov rdx, qword [rdx + 0x60]
mov rcx, rsi
call fcn.140011bc0
mov rax, qword [rsi]
cmp r14, rax
jne 0x140013348
jmp 0x14001335c
cmp qword [rsi + 0x28], 0
jne 0x140013523
mov ecx, 0x68
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rsi + 0x28], rax
test rax, rax
je 0x14003a942
xor edx, edx
lea r8d, [rdx + 0x68]
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [rsi + 0x28]
mov dword [rax + 0x48], 1
mov rax, qword [rsi + 0x28]
mov qword [rax + 0x58], rax
mov rcx, qword [rsi + 0x28]
mov rax, qword [rcx + 0x58]
mov qword [rcx + 0x50], rax
mov rcx, qword [rsi + 0x28]
mov rax, qword [rcx + 0x50]
mov qword [rcx + 0x60], rax
mov rax, qword [rsi + 0x28]
mov qword [rsi], rax
lea rcx, [rsi + 0x18]
mov r8d, 0x68
mov rdx, qword [rsi + 0x20]
call fcn.140008fe0
test rax, rax
je 0x14003a94d
mov rdx, qword [rsi + 0x20]
imul r8, rdx, 0x68
add r8, 0xffffffffffffffa0
add r8, rax
sub rdx, 1
js 0x1400130a1
nop dword [rax + rax]
mov rax, qword [rsi + 0x10]
mov qword [r8 + 0x50], rax
mov qword [rsi + 0x10], r8
sub r8, 0x68
sub rdx, 1
jns 0x140013560
jmp 0x1400130a1
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov ebx, r13d
jmp 0x140012ef8
mov qword [rsi], r14
jmp 0x14001333c
mov dword [rdx + 0x48], 1
mov dword [rax + 0x48], 1
mov rax, qword [r14 + 0x60]
mov rcx, qword [rax + 0x60]
mov dword [rcx + 0x48], r13d
mov rax, qword [r14 + 0x60]
mov r14, qword [rax + 0x60]
jmp 0x1400134b3
lea rcx, [rbp + 0x90]
call fcn.140017740
mov eax, r13d
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.14002dd40
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop
cmp eax, 2
je 0x1400135ba
test eax, eax
jg 0x14003a9c0
mov r13d, eax
jmp 0x1400135ba
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov ebx, r13d
jmp 0x140012ef8
call qword [case.0x14000702c.0]
nop
jmp 0x140012f8f
call qword [case.0x14000702c.0]
nop
jmp 0x140012fb8
call qword [case.0x14000702c.0]
nop
jmp 0x140012fe1
call qword [case.0x14000702c.0]
nop
jmp 0x140013032
mov r14, rdi
jmp 0x14001305e
mov rdi, qword [rdi + 0x50]
jmp 0x14001305e
mov rdx, r14
mov rcx, rsi
call fcn.1400761e0
mov rdi, rax
test rax, rax
je 0x14003a706
mov rdx, qword [rax]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14003a706
mov r14, rdi
jmp 0x14003a6de
test r14, r14
je 0x140013096
lea rcx, [r14 + 8]
lea rdx, [rsp + 0x50]
call fcn.140019d08
nop
jmp 0x140013383
call qword [case.0x14000702c.0]
nop
jmp 0x1400130d1
movzx edi, bx
mov ecx, edi
call fcn.1400548e4
test rax, rax
je 0x140013171
mov r8d, edi
mov rdx, rax
mov rcx, r14
call fcn.140056088
nop
jmp 0x140013171
lea r8, [r10 + r15*2]
call qword [sym.imp.msvcrt.dll_memmove_s]
nop
jmp 0x14001314f
mov rcx, r14
call fcn.140055888
nop
jmp 0x140013171
call qword [case.0x14000702c.0]
nop
jmp 0x1400131aa
call qword [case.0x14000702c.0]
nop
jmp 0x1400131d6
call qword [case.0x14000702c.0]
nop
jmp 0x140013204
mov eax, dword [r12 + 0x10]
shr eax, 0x1f
test al, al
jne 0x14003a7ce
mov rax, qword [r12]
cmp qword [rcx], rax
jne 0x14003a7ce
call fcn.1400125b0
mov rdi, rax
mov rcx, r12
call fcn.1400176e0
lea rax, [rdi + 0x18]
mov qword [r15 + 8], rax
lea rdi, [r15 + 0x10]
jmp 0x140013226
mov r8d, dword [rdx - 0x10]
lea rcx, [r15 + 8]
call fcn.1400163e0
nop
jmp 0x140013226
mov eax, dword [r12 + 0x10]
shr eax, 0x1f
test al, al
jne 0x14003a813
mov rax, qword [r12]
cmp qword [rcx], rax
jne 0x14003a813
call fcn.1400125b0
mov rdi, rax
mov rcx, r12
call fcn.1400176e0
lea rax, [rdi + 0x18]
mov qword [r15 + 0x10], rax
jmp 0x14001323f
mov r8d, dword [rdx - 0x10]
mov rcx, rdi
call fcn.1400163e0
nop
jmp 0x14001323f
mov eax, dword [r12 + 0x10]
shr eax, 0x1f
test al, al
jne 0x14003a857
mov rax, qword [r12]
cmp qword [rcx], rax
jne 0x14003a857
call fcn.1400125b0
mov rdi, rax
mov rcx, r12
call fcn.1400176e0
lea rax, [rdi + 0x18]
mov qword [r15 + 0x18], rax
jmp 0x140013259
mov r8d, dword [rdx - 0x10]
lea rcx, [r15 + 0x18]
call fcn.1400163e0
nop
jmp 0x140013259
mov rdi, qword [rdi + 0x50]
jmp 0x1400132f4
mov qword [r15 + 0x50], r14
jmp 0x14001333c
mov rax, qword [rcx + 0x58]
test rax, rax
je 0x14003a88f
cmp dword [rax + 0x48], 0
je 0x140013593
mov r11, qword [rdx + 0x58]
cmp r14, r11
jne 0x14003a8a0
mov rcx, rsi
call fcn.140011bc0
mov r14, rdx
cmp r9, r11
cmovne r14, r10
mov rax, qword [r14 + 0x60]
mov dword [rax + 0x48], 1
mov rax, qword [r14 + 0x60]
mov rcx, qword [rax + 0x60]
mov dword [rcx + 0x48], r13d
mov rdx, qword [r14 + 0x60]
mov rdx, qword [rdx + 0x60]
mov rcx, rsi
call fcn.14007a198
nop
jmp 0x1400134b3
mov r14, rdx
mov rcx, rsi
call fcn.14007a198
nop
jmp 0x14001348c
call qword [case.0x14000702c.0]
nop
jmp 0x1400133ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000702c.0]
nop
jmp 0x1400133e4
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000702c.0]
nop
jmp 0x1400133fe
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000702c.0]
nop
jmp 0x140013418
call qword [sym.imp.msvcrt.dll_free]
nop
jmp 0x140012ea0
mov ecx, 0x8007000e
call fcn.14004a0f0
int3
mov ecx, 0x8007000e
call fcn.14004a0f0
nop
mov ecx, 0x80070057
call fcn.14004a0f0
nop
mov ecx, 0x80004005
call fcn.14004a0f0
int3
mov ecx, 0x80004005
call fcn.14004a0f0
int3
mov ecx, 0x80004005
call fcn.14004a0f0
int3
mov ecx, 0x80004005
call fcn.14004a0f0
nop
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jg 0x14003a99e
mov r13d, eax
jmp 0x14003a9a9
movzx r13d, ax
or r13d, 0x80070000
lea rcx, [rbp - 0x30]
call fcn.140017740
nop
jmp 0x1400135ba
test eax, eax
jle 0x14003a682
movzx r13d, ax
or r13d, 0x80070000
jmp 0x1400135ba