Function at 0x140010d40
Capabilities:
Check if file exists
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x4d8], rbx
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov r14, rcx
mov qword [rsp + 0x48], rcx
lea rax, [0x14008bc60]
mov qword [rbp + 0xb0], rax
lea rax, fcn.14001b3f0
mov qword [rbp + 0xb8], rax
lea rax, [rbp + 0xd0]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], 0x41
xor r15d, r15d
mov word [rbp + 0xd0], r15w
lea rax, fcn.140019f80
mov qword [rbp + 0xb8], rax
lea rax, [0x14008bba0]
mov qword [rbp + 0xb0], rax
mov dword [rbp + 0x158], r15d
mov qword [rbp + 0x160], r15
mov qword [rsp + 0x20], r15
mov r9d, 0xf003f
mov r8, qword [r8]
lea rcx, [rbp + 0xb0]
call fcn.140013ea0
test eax, eax
js 0x140037196
mov r12d, r15d
mov dword [rsp + 0x50], r15d
lea r13, fcn.14001b3f0
lea rsi, [fcn.140013010]
lea rdi, [0x1400c9e40]
mov dword [rbp - 0x70], 0x100
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x1400371b6
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x70]
lea r8, [rbp + 0x170]
mov edx, r12d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jne 0x140011747
lea ebx, [rax + 1]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x103
je 0x14001175f
test ebx, ebx
je 0x1400373fd
lea rax, [0x14008bc60]
mov qword [rbp - 0x10], rax
lea rax, fcn.14001b3f0
mov qword [rbp - 8], rax
lea rax, [rbp + 0x10]
mov qword [rbp], rax
mov qword [rbp + 8], 0x41
mov word [rbp + 0x10], r15w
lea rax, fcn.140019f80
mov qword [rbp - 8], rax
lea rax, [0x14008bba0]
mov qword [rbp - 0x10], rax
mov dword [rbp + 0x98], r15d
mov qword [rbp + 0xa0], r15
mov qword [rsp + 0x20], r15
mov r9d, 0xf003f
lea r8, [rbp + 0x170]
mov rdx, qword [rbp + 0x160]
lea rcx, [rbp - 0x10]
call fcn.140013ea0
test eax, eax
js 0x1400373d4
mov qword [rbp - 0x60], r13
lea rax, [0x14008bd60]
mov qword [rbp - 0x60], rax
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
cmp rax, rsi
jne 0x1400371c9
lock inc dword [0x1400c9e50]
mov rax, rdi
add rax, 0x18
mov qword [rbp - 0x58], rax
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
cmp rax, rsi
jne 0x1400371dc
lock inc dword [0x1400c9e50]
mov rax, rdi
add rax, 0x18
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], r15d
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
cmp rax, rsi
jne 0x1400371ef
lock inc dword [0x1400c9e50]
mov rax, rdi
add rax, 0x18
mov qword [rsp + 0x78], rax
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
cmp rax, rsi
jne 0x140037202
lock inc dword [0x1400c9e50]
mov rax, rdi
add rax, 0x18
mov qword [rbp - 0x80], rax
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x60]
call fcn.14000ff20
test eax, eax
js 0x1400114c8
mov rdi, r15
mov qword [rsp + 0x40], r15
mov rbx, qword [r14]
cmp rbx, qword [r14 + 0x28]
je 0x14001103e
test rdi, rdi
jne 0x14003722f
mov r14d, dword [rsp + 0x60]
mov eax, dword [rbx + 8]
cmp r14d, eax
je 0x1400110e6
ja 0x1400111c0
mov rax, qword [rbx + 8]
cmp rax, qword [rsp + 0x60]
je 0x1400111ce
mov rbx, qword [rbx + 0x80]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
jmp 0x140010ff6
test rdi, rdi
jne 0x14003722f
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.140011a40
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x68], r15
mov rbx, qword [r14]
cmp rbx, qword [r14 + 0x28]
je 0x1400110a2
mov qword [rbp - 0x68], rbx
mov r14d, dword [rsp + 0x60]
mov ecx, dword [rbx + 8]
cmp r14d, ecx
je 0x140011153
ja 0x1400112b9
mov rax, qword [rbx + 8]
cmp rax, qword [rsp + 0x60]
je 0x140011248
mov rbx, qword [rbx + 0x80]
mov r14, qword [rsp + 0x48]
jmp 0x140011064
mov r13, qword [rbp - 0x68]
mov rsi, qword [rsp + 0x40]
mov qword [rsi + 0x88], r13
test r13, r13
je 0x140011757
mov r12d, dword [rsp + 0x60]
mov rax, qword [r13 + 8]
cmp r12d, eax
je 0x14001131a
seta al
test al, al
je 0x1400113a1
mov qword [r13 + 0x78], rsi
mov r14, qword [rsp + 0x48]
jmp 0x140011421
mov r13d, r15d
test r14d, r14d
je 0x14001101c
mov rdi, r15
mov rsi, r15
cmp rdi, qword [rsp + 0x60]
jae 0x14003733a
mov r15, qword [rsp + 0x58]
cmp rdi, qword [rbx + 8]
jae 0x14003732f
mov r12, qword [rbx]
mov eax, dword [r15 + rsi + 8]
cmp eax, dword [r12 + rsi + 8]
jne 0x1400116a2
test eax, eax
jne 0x14001113f
mov rdx, qword [r12 + rsi]
mov rcx, qword [r15 + rsi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1400112c7
inc r13d
inc rdi
add rsi, 0x10
cmp r13d, r14d
jb 0x1400110f8
jmp 0x140037215
mov r13d, r15d
test r14d, r14d
je 0x140011085
mov rdi, r15
mov rsi, r15
cmp rdi, qword [rsp + 0x60]
jae 0x140037371
mov r15, qword [rsp + 0x58]
cmp rdi, qword [rbx + 8]
jae 0x140037366
mov r12, qword [rbx]
mov eax, dword [r15 + rsi + 8]
cmp eax, dword [r12 + rsi + 8]
jne 0x1400116c0
test eax, eax
jne 0x1400111ac
mov rdx, qword [r12 + rsi]
mov rcx, qword [r15 + rsi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1400112f3
inc r13d
inc rdi
add rsi, 0x10
cmp r13d, r14d
jb 0x140011165
jmp 0x140037287
mov rbx, qword [rbx + 0x78]
mov r14, qword [rsp + 0x48]
jmp 0x140010ff6
mov esi, r15d
test rax, rax
je 0x14003721d
mov rdi, r15
cmp r15, rax
jae 0x14003735b
mov rcx, rdi
add rcx, rcx
mov rax, qword [rbx]
cmp dword [rax + rcx*8 + 8], 0
jne 0x1400116d9
cmp rdi, qword [rsp + 0x60]
jae 0x140037350
mov rcx, rdi
add rcx, rcx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax + rcx*8]
cmp rdi, qword [rbx + 8]
jae 0x140037345
add rdi, rdi
mov rax, qword [rbx]
mov rcx, qword [rax + rdi*8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14001102b
inc esi
mov edi, esi
mov rax, qword [rbx + 8]
cmp rdi, rax
jb 0x1400111e6
jmp 0x14003721d
mov esi, r15d
test rax, rax
je 0x1400112b9
mov rdi, r15
cmp r15, rax
jae 0x140037392
mov rcx, rdi
add rcx, rcx
mov rax, qword [rbx]
cmp dword [rax + rcx*8 + 8], 0
jne 0x1400116f5
cmp rdi, qword [rsp + 0x60]
jae 0x140037387
mov rcx, rdi
add rcx, rcx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax + rcx*8]
cmp rdi, qword [rbx + 8]
jae 0x14003737c
add rdi, rdi
mov rax, qword [rbx]
mov rcx, qword [rax + rdi*8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140011094
inc esi
mov edi, esi
mov rax, qword [rbx + 8]
cmp rdi, rax
jb 0x14001125c
mov rbx, qword [rbx + 0x78]
mov r14, qword [rsp + 0x48]
jmp 0x140011064
mov rdx, qword [r12 + rsi]
mov rcx, qword [r15 + rsi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
xor r15d, r15d
test eax, eax
jns 0x14001101c
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rbx + 0x78]
mov r14, qword [rsp + 0x48]
jmp 0x140010ff6
mov rdx, qword [r12 + rsi]
mov rcx, qword [r15 + rsi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
xor r15d, r15d
test eax, eax
jns 0x140011085
mov rbx, qword [rbx + 0x78]
mov r14, qword [rsp + 0x48]
jmp 0x140011064
test r12d, r12d
je 0x140037299
xor edi, edi
mov ebx, edi
cmp rbx, qword [rsp + 0x60]
jae 0x1400373a8
mov rsi, qword [rsp + 0x58]
cmp rbx, qword [r13 + 8]
jae 0x14003739d
mov r14, qword [r13]
mov eax, dword [rsi + rdi + 8]
cmp eax, dword [r14 + rdi + 8]
jne 0x14001172d
test eax, eax
jne 0x14001136a
mov rdx, qword [r14 + rdi]
mov rcx, qword [rsi + rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14001137e
inc r15d
inc rbx
add rdi, 0x10
cmp r15d, r12d
jb 0x140011327
jmp 0x14003728f
mov rdx, qword [r14 + rdi]
mov rcx, qword [rsi + rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
mov rsi, qword [rsp + 0x40]
xor r15d, r15d
test eax, eax
js 0x1400110d8
mov r14, qword [rsp + 0x48]
mov rax, qword [r13 + 8]
cmp rax, qword [rsp + 0x60]
jne 0x14001141a
mov edi, r15d
test rax, rax
je 0x1400110d8
mov rbx, r15
cmp rbx, rax
jae 0x1400373be
mov rax, rbx
shl rax, 4
add rax, qword [r13]
cmp dword [rax + 8], 0
jne 0x140011711
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140013d40
cmp rbx, qword [r13 + 8]
jae 0x1400373b3
shl rbx, 4
add rbx, qword [r13]
mov rdx, qword [rax]
mov rcx, qword [rbx]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14001141a
inc edi
mov rax, qword [r13 + 8]
mov ebx, edi
cmp rbx, rax
jb 0x1400113c4
jmp 0x1400110d8
mov qword [r13 + 0x80], rsi
mov dword [rsi + 0x70], r15d
mov rax, qword [r14]
cmp rsi, rax
je 0x140011497
mov rcx, qword [rsi + 0x88]
cmp dword [rcx + 0x70], 0
jne 0x140011497
mov rdx, qword [rcx + 0x88]
mov rax, qword [rdx + 0x78]
cmp rcx, rax
je 0x14001163a
test rax, rax
je 0x1400115f5
cmp dword [rax + 0x70], 0
jne 0x1400115f5
mov dword [rcx + 0x70], 1
mov dword [rax + 0x70], 1
mov rax, qword [rsi + 0x88]
mov rcx, qword [rax + 0x88]
mov dword [rcx + 0x70], r15d
mov rax, qword [rsi + 0x88]
mov rsi, qword [rax + 0x88]
mov rax, qword [r14]
cmp rsi, rax
jne 0x14001142d
mov dword [rax + 0x70], 1
mov rcx, qword [r14]
add rcx, 0x88
je 0x1400373c9
mov rax, qword [r14 + 0x28]
mov qword [rcx], rax
lea r13, fcn.14001b3f0
lea rsi, [fcn.140013010]
mov r12d, dword [rsp + 0x50]
inc r12d
mov dword [rsp + 0x50], r12d
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x1400372b5
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x1400372cb
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x140011551
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x140011547
nop word [rax + rax]
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x1400372e1
add rbx, 0x10
sub rdi, 1
jne 0x140011520
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop
lea rax, [0x14008bd60]
mov qword [rbp - 0x60], rax
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x1400372f7
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x14003730d
mov qword [rbp - 0x60], r13
lea rax, [0x14008bba0]
mov qword [rbp - 0x10], rax
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x1400115b9
cmp dword [rbp + 0x98], 0
je 0x1400115b9
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop
lea rax, [0x14008bc60]
mov qword [rbp - 0x10], rax
lea rax, fcn.140019f80
mov qword [rbp - 8], rax
mov rcx, qword [rbp]
test rcx, rcx
je 0x1400115e5
lea rax, [rbp + 0x10]
cmp rcx, rax
jne 0x140037323
lea rax, fcn.14001b3f0
mov qword [rbp - 8], rax
jmp 0x140010e26
cmp rsi, qword [rcx + 0x78]
je 0x1400372a1
mov rax, qword [rsi + 0x88]
mov dword [rax + 0x70], 1
mov rax, qword [rsi + 0x88]
mov rcx, qword [rax + 0x88]
mov dword [rcx + 0x70], r15d
mov rdx, qword [rsi + 0x88]
mov rdx, qword [rdx + 0x88]
mov rcx, r14
call fcn.140012050
jmp 0x14001148f
mov rax, qword [rdx + 0x80]
test rax, rax
je 0x140011650
cmp dword [rax + 0x70], 0
je 0x140011461
cmp rsi, qword [rcx + 0x80]
jne 0x140011667
mov rsi, rcx
mov rdx, rcx
mov rcx, r14
call fcn.140012050
mov rax, qword [rsi + 0x88]
mov dword [rax + 0x70], 1
mov rax, qword [rsi + 0x88]
mov rcx, qword [rax + 0x88]
mov dword [rcx + 0x70], r15d
mov rdx, qword [rsi + 0x88]
mov rdx, qword [rdx + 0x88]
mov rcx, r14
call fcn.1400119c0
jmp 0x14001148f
xor r15d, r15d
test eax, eax
jne 0x14001101c
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rbx + 0x78]
mov r14, qword [rsp + 0x48]
jmp 0x140010ff6
xor r15d, r15d
test eax, eax
jne 0x140011085
mov rbx, qword [rbx + 0x78]
mov r14, qword [rsp + 0x48]
jmp 0x140011064
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.140013d40
cmp dword [rax + 8], 0
jne 0x140011236
jmp 0x1400111fa
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.140013d40
cmp dword [rax + 8], 0
jne 0x1400112ac
jmp 0x140011270
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140013d40
cmp dword [rax + 8], 0
jne 0x140011408
jmp 0x1400113d9
mov rsi, qword [rsp + 0x40]
xor r15d, r15d
test eax, eax
je 0x1400110d8
mov r14, qword [rsp + 0x48]
jmp 0x1400113a1
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov ebx, r15d
jmp 0x140010e83
mov qword [r14], rsi
jmp 0x140011421
lea rcx, [rbp + 0xb0]
call fcn.140013e30
mov eax, r15d
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.14002cdb0
mov rbx, qword [rsp + 0x4d8]
add rsp, 0x480
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop
cmp eax, 2
je 0x14001175f
test eax, eax
jg 0x140037405
mov r15d, eax
jmp 0x14001175f
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov ebx, r15d
jmp 0x140010e83
lea rcx, [0x1400c9e30]
call qword [case.0x140006f84.0]
nop
jmp 0x140010f42
lea rcx, [0x1400c9e30]
call qword [case.0x140006f84.0]
nop
jmp 0x140010f68
lea rcx, [0x1400c9e30]
call qword [case.0x140006f84.0]
nop
jmp 0x140010fa2
lea rcx, [0x1400c9e30]
call qword [case.0x140006f84.0]
nop
jmp 0x140010fc9
xor r15d, r15d
jmp 0x14001101c
mov rdi, rbx
mov qword [rsp + 0x40], rbx
mov r14, qword [rsp + 0x48]
jmp 0x140010ff6
mov rdx, rdi
mov rcx, r14
call fcn.14002139c
mov rbx, rax
test rax, rax
je 0x140037258
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140021564
test al, al
je 0x140037258
mov rdi, rbx
jmp 0x14003722f
test rdi, rdi
je 0x140011047
lea rbx, [rdi + 0x38]
mov qword [rbp - 0x18], rbx
mov rcx, rbx
call fcn.14002c474
mov qword [rbp - 0x68], rbx
lea rdx, [rbp - 0x60]
mov rcx, rbx
call fcn.14002c4b4
nop
jmp 0x1400114b5
xor r15d, r15d
jmp 0x140011085
mov rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
xor r15d, r15d
jmp 0x1400113a1
mov rsi, rcx
mov rdx, rcx
mov rcx, r14
call fcn.1400119c0
nop
jmp 0x1400115ff
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140006f84.0]
nop
jmp 0x1400114e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140006f84.0]
nop
jmp 0x140011503
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140006f84.0]
nop
jmp 0x140011538
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140006f84.0]
nop
jmp 0x140011575
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140006f84.0]
nop
jmp 0x14001158e
call qword [sym.imp.msvcrt.dll_free]
nop
jmp 0x1400115e5
mov ecx, 0x80070057
call fcn.14004a3b0
int3
mov ecx, 0x80070057
call fcn.14004a3b0
int3
mov ecx, 0x80070057
call fcn.14004a3b0
int3
mov ecx, 0x80070057
call fcn.14004a3b0
int3
mov ecx, 0x80070057
call fcn.14004a3b0
int3
mov ecx, 0x80070057
call fcn.14004a3b0
int3
mov ecx, 0x80070057
call fcn.14004a3b0
int3
mov ecx, 0x80070057
call fcn.14004a3b0
int3
mov ecx, 0x80070057
call fcn.14004a3b0
int3
mov ecx, 0x80070057
call fcn.14004a3b0
int3
mov ecx, 0x80070057
call fcn.14004a3b0
int3
mov ecx, 0x80070057
call fcn.14004a3b0
int3
mov ecx, 0x80070057
call fcn.14004a3b0
int3
mov ecx, 0x80070057
call fcn.14004a3b0
int3
mov ecx, 0x80004005
call fcn.14004a3b0
nop
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jg 0x1400373e3
mov r15d, eax
jmp 0x1400373ee
movzx r15d, ax
or r15d, 0x80070000
lea rcx, [rbp - 0x10]
call fcn.140013e30
nop
jmp 0x14001175f
test eax, eax
jle 0x1400371ae
movzx r15d, ax
or r15d, 0x80070000
jmp 0x14001175f