Function at 0x1400afc54
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov qword [rsp + 0xa0], r9
mov qword [rsp + 0x90], r8
mov r12, rdx
xor esi, esi
mov dword [rsp + 0x64], esi
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
nop
test eax, eax
jne 0x1400b0444
mov r13d, esi
lea rax, str.TotalListOfLastBackedUpApps
mov qword [rsp + 0x78], rax
lea rax, str.ListOfTaskBackedUpApps
mov qword [rsp + 0x80], rax
lea rax, str.ListOfEventDrivenBackedUpApps
mov qword [rsp + 0x88], rax
lea rax, str.TotalListOfLastBackedUpCompatInfos
mov qword [rsp + 0x98], rax
cmp r13d, dword [rsp + 0x64]
jae 0x1400b0444
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x6c], eax
mov edx, eax
lea rcx, [rsp + 0xa8]
call fcn.1400af03c
nop
lea r8, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 8
cmovae r8, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x6c]
mov edx, r13d
mov rcx, r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
nop
mov dword [rsp + 0x60], eax
test eax, eax
je 0x1400afdb5
lea r8, [rsp + 0x60]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionAppListBackup
lea rcx, str.RegEnumKeyEx_failed_for:
call fcn.1400ae8c0
nop
jmp 0x1400b042e
lea r10, [rsp + 0xa8]
mov r14, qword [rsp + 0xa8]
mov r15, qword [rsp + 0xc0]
cmp r15, 8
cmovae r10, r14
mov rsi, qword [rsp + 0xb8]
cmp rsi, 0x1b
jb 0x1400afe7a
lea rdi, [rsi - 0x1a]
lea rdi, [r10 + rdi*2]
mov rax, r10
movzx ebx, word [str.TotalListOfLastBackedUpApps]
mov rcx, rdi
sub rcx, rax
sar rcx, 1
mov r8d, 0
mov edx, r8d
je 0x1400afe24
jmp 0x1400afe1c
cmp rcx, 1
je 0x1400afe24
dec rcx
add rax, 2
cmp word [rax], bx
jne 0x1400afe0f
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400afe8a
mov r8d, 0x1b
lea r9, str.TotalListOfLastBackedUpApps
movzx ecx, word [rdx]
movzx edx, bx
cmp cx, bx
jb 0x1400afe6c
mov r11, rax
sub r11, qword [rsp + 0x78]
cmp cx, bx
ja 0x1400afe6c
cmp r8, 1
je 0x1400afe72
dec r8
add r9, 2
movzx ecx, word [r11 + r9]
movzx edx, word [r9]
cmp cx, dx
jae 0x1400afe4f
add rax, 2
jmp 0x1400afdf9
sub rax, r10
sar rax, 1
jmp 0x1400afe7e
or rax, 0xffffffffffffffff
xor r8d, r8d
test rax, rax
je 0x1400b0008
lea r10, [rsp + 0xa8]
cmp r15, 8
cmovae r10, r14
cmp rsi, 0x16
jb 0x1400aff3a
lea rdi, [rsi - 0x15]
lea rdi, [r10 + rdi*2]
mov rax, r10
movzx ebx, word [str.ListOfTaskBackedUpApps]
mov rcx, rdi
sub rcx, rax
sar rcx, 1
mov rdx, r8
je 0x1400afedb
jmp 0x1400afed3
cmp rcx, 1
je 0x1400afedb
dec rcx
add rax, 2
cmp word [rax], bx
jne 0x1400afec6
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400aff47
mov r8d, reloc.SHELL32.dll_DAD_DragEnterEx2
lea r9, str.ListOfTaskBackedUpApps
movzx ecx, word [rdx]
movzx edx, bx
cmp cx, bx
jb 0x1400aff26
mov r11, rax
sub r11, qword [rsp + 0x80]
cmp cx, bx
ja 0x1400aff26
cmp r8, 1
je 0x1400aff2f
dec r8
add r9, 2
movzx ecx, word [r11 + r9]
movzx edx, word [r9]
cmp cx, dx
jae 0x1400aff09
add rax, 2
xor r8d, r8d
jmp 0x1400afeb6
sub rax, r10
sar rax, 1
xor r8d, r8d
jmp 0x1400aff3e
or rax, 0xffffffffffffffff
test rax, rax
je 0x1400b0008
lea r10, [rsp + 0xa8]
cmp r15, 8
cmovae r10, r14
cmp rsi, 0x1d
jb 0x1400afffb
lea rdi, [rsi - 0x1c]
lea rdi, [r10 + rdi*2]
mov rax, r10
movzx ebx, word [str.ListOfEventDrivenBackedUpApps]
mov rcx, rdi
sub rcx, rax
sar rcx, 1
mov rdx, r8
je 0x1400aff98
jmp 0x1400aff90
cmp rcx, 1
je 0x1400aff98
dec rcx
add rax, 2
cmp word [rax], bx
jne 0x1400aff83
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400b016c
mov r8d, 0x1d
lea r9, str.ListOfEventDrivenBackedUpApps
movzx ecx, word [rdx]
movzx edx, bx
cmp cx, bx
jb 0x1400affe7
mov r11, rax
sub r11, qword [rsp + 0x88]
cmp cx, bx
ja 0x1400affe7
cmp r8, 1
je 0x1400afff0
dec r8
add r9, 2
movzx ecx, word [r11 + r9]
movzx edx, word [r9]
cmp cx, dx
jae 0x1400affca
add rax, 2
xor r8d, r8d
jmp 0x1400aff73
sub rax, r10
sar rax, 1
xor r8d, r8d
jmp 0x1400affff
or rax, 0xffffffffffffffff
test rax, rax
jne 0x1400b016c
xor esi, esi
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe0], 7
mov word [rsp + 0xc8], si
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0xa8]
mov rdx, r12
call fcn.1400bc65c
nop
mov dword [rsp + 0x60], eax
test eax, eax
jns 0x1400b0080
lea rax, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 8
cmovae rax, qword [rsp + 0xa8]
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
call fcn.1400ae96c
nop
jmp 0x1400b0420
lea rbx, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 8
cmovae rbx, qword [rsp + 0xc8]
lea r8, [0x140317c84]
mov rdi, qword [rsp + 0x90]
mov rdx, rdi
lea rcx, [rsp + 0x148]
call fcn.1400ae4c4
nop
lea r8, [rsp + 0xa8]
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.1400ae464
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x108]
call fcn.1401e60ac
nop
lea r8, [0x140317c8c]
mov rdx, rax
lea rcx, [rsp + 0xe8]
call fcn.1401e60ac
nop
mov rdx, rax
mov rcx, rdi
call fcn.1401a44a8
nop
lea rcx, [rsp + 0xe8]
call fcn.14000a8ac
nop
lea rcx, [rsp + 0x108]
call fcn.14000a8ac
nop
lea rcx, [rsp + 0x128]
call fcn.14000a8ac
nop
lea rcx, [rsp + 0x148]
call fcn.14000a8ac
nop
lea rcx, [rsp + 0xc8]
call fcn.14000a8ac
nop
mov r15, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xa8]
xor r8d, r8d
lea r10, [rsp + 0xa8]
cmp r15, 8
cmovae r10, r14
cmp rsi, 0x22
jb 0x1400b0219
lea rdi, [rsi - 0x21]
lea rdi, [r10 + rdi*2]
mov rax, r10
movzx ebx, word [str.TotalListOfLastBackedUpCompatInfos]
mov rcx, rdi
sub rcx, rax
sar rcx, 1
mov rdx, r8
je 0x1400b01bd
jmp 0x1400b01b5
cmp rcx, 1
je 0x1400b01bd
dec rcx
add rax, 2
cmp word [rax], bx
jne 0x1400b01a8
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400b0226
mov r8d, 0x22
lea r9, str.TotalListOfLastBackedUpCompatInfos
movzx ecx, word [rdx]
movzx edx, bx
cmp cx, bx
jb 0x1400b0208
mov r11, rax
sub r11, qword [rsp + 0x98]
cmp cx, bx
ja 0x1400b0208
cmp r8, 1
je 0x1400b0211
dec r8
add r9, 2
movzx ecx, word [r11 + r9]
movzx edx, word [r9]
cmp cx, dx
jae 0x1400b01eb
add rax, 2
xor r8d, r8d
jmp 0x1400b0198
sub rax, r10
sar rax, 1
jmp 0x1400b021d
or rax, 0xffffffffffffffff
test rax, rax
je 0x1400b02e5
lea r10, [rsp + 0xa8]
cmp r15, 8
cmovae r10, r14
cmp rsi, 0x1d
jb 0x1400b02d4
add rsi, 0xffffffffffffffe4
lea rdi, [r10 + rsi*2]
mov rax, r10
movzx ebx, word [str.EventDrivenBackedUpCompatInfo]
xor esi, esi
lea r14, str.EventDrivenBackedUpCompatInfo
mov rcx, rdi
sub rcx, rax
sar rcx, 1
mov rdx, rsi
je 0x1400b0280
jmp 0x1400b0278
cmp rcx, 1
je 0x1400b0280
dec rcx
add rax, 2
cmp word [rax], bx
jne 0x1400b026b
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400b042e
mov r9d, 0x1d
mov r8, r14
movzx ecx, word [rdx]
movzx edx, bx
cmp cx, bx
jb 0x1400b02c6
mov r11, rax
sub r11, r14
cmp cx, bx
ja 0x1400b02c6
cmp r9, 1
je 0x1400b02cc
dec r9
add r8, 2
movzx ecx, word [r8 + r11]
movzx edx, word [r8]
cmp cx, dx
jae 0x1400b02a9
add rax, 2
jmp 0x1400b025b
sub rax, r10
sar rax, 1
jmp 0x1400b02da
or rax, 0xffffffffffffffff
xor esi, esi
test rax, rax
jne 0x1400b042e
jmp 0x1400b02e7
xor esi, esi
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe0], 7
mov word [rsp + 0xc8], si
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0xa8]
mov rdx, r12
call fcn.1400bc65c
nop
mov dword [rsp + 0x60], eax
test eax, eax
jns 0x1400b035d
lea rax, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 8
cmovae rax, qword [rsp + 0xa8]
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
call fcn.1400ae96c
nop
jmp 0x1400b0420
lea rbx, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 8
cmovae rbx, qword [rsp + 0xc8]
lea r8, [0x140317c84]
mov rdi, qword [rsp + 0xa0]
mov rdx, rdi
lea rcx, [rsp + 0xe8]
call fcn.1400ae4c4
nop
lea r8, [rsp + 0xa8]
mov rdx, rax
lea rcx, [rsp + 0x108]
call fcn.1400ae464
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.1401e60ac
nop
lea r8, [0x140317c8c]
mov rdx, rax
lea rcx, [rsp + 0x148]
call fcn.1401e60ac
nop
mov rdx, rax
mov rcx, rdi
call fcn.1401a44a8
nop
lea rcx, [rsp + 0x148]
call fcn.14000a8ac
nop
lea rcx, [rsp + 0x128]
call fcn.14000a8ac
nop
lea rcx, [rsp + 0x108]
call fcn.14000a8ac
nop
lea rcx, [rsp + 0xe8]
call fcn.14000a8ac
nop
lea rcx, [rsp + 0xc8]
call fcn.14000a8ac
nop
lea rcx, [rsp + 0xa8]
call fcn.14000a8ac
nop
inc r13d
jmp 0x1400afd24
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1400a15a0
nop
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret