Function at 0x1400725f0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xd8
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov rsi, rcx
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x140072c47
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x49], rax
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x140072c52
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x51], rax
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x49]
call fcn.140017720
test al, al
jne 0x1400726cb
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x140072c5d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rdx, [0x1400f4784]
mov rdi, 0xffffffffffffffff
cmp rdx, 0x10000
jae 0x1400726a5
movzx edx, dx
mov rcx, rsi
call fcn.14000d4c0
jmp 0x1400726c6
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400726b0
mov r8d, eax
mov rcx, rsi
call fcn.14000fd40
nop
jmp 0x140072bf0
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x140072c68
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x31], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
mov rdi, 0xffffffffffffffff
cmp rdx, 0x10000
jae 0x14007270f
movzx edx, dx
lea rcx, [rbp - 0x31]
call fcn.14000d4c0
jmp 0x140072729
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x140072712
mov r8d, eax
lea rcx, [rbp - 0x31]
call fcn.14000fd40
nop
xor r15d, r15d
mov qword [rbp - 0x21], r15
mov dword [rbp - 0x19], r15d
mov qword [rbp - 0x11], r15
mov qword [rbp - 0x39], r15
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rbp - 0x31]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140072b7b
mov rax, qword [rbp - 0x39]
mov qword [rbp - 0x21], rax
mov dword [rbp - 0x19], r15d
mov r14d, r15d
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x140072c73
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x69], rax
mov edx, 0x104
mov dword [rbp + 0x6f], edx
test edx, edx
js 0x140072cec
mov r8d, 1
mov rax, qword [rbp - 0x69]
sub r8d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or ecx, r8d
jge 0x1400727c9
lea rcx, [rbp - 0x69]
call fcn.14000e630
lea rax, [rbp + 0x17]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x6f]
mov r8, qword [rbp - 0x69]
mov edx, r14d
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc r14d
test eax, eax
jne 0x140072801
mov bl, 1
jmp 0x140072803
xor bl, bl
mov rcx, qword [rbp - 0x69]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400b7e14
test eax, eax
js 0x140072ce1
mov rcx, qword [rbp - 0x69]
cmp eax, dword [rcx - 0xc]
jg 0x140072ce1
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbp - 0x69]
mov word [rax + rcx*2], r15w
test bl, bl
je 0x140072b1f
mov dword [rbp + 0x6f], 0x104
mov qword [rbp - 0x41], r15
lea rdx, [rbp - 0x41]
mov rcx, qword [rbp - 0x69]
call sub.ADVAPI32.dll_ConvertStringSidToSidW
cmp qword [rbp - 0x41], 0
jne 0x140072863
mov edx, dword [rbp + 0x6f]
jmp 0x1400727a0
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x140072ccb
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x59], rax
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x140072cc0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x61], rax
mov dword [rbp + 0x7f], r15d
mov dword [rbp + 0x77], r15d
lea rax, [rbp - 0x29]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x7f]
xor r8d, r8d
mov rdx, qword [rbp - 0x41]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400729db
lea rax, [rbp - 0x61]
mov qword [rbp - 9], rax
mov qword [rbp - 1], r15
mov dword [rbp + 7], edi
mov edx, dword [rbp + 0x77]
test edx, edx
js 0x140072c9f
mov ecx, 1
mov rbx, qword [rbp - 0x61]
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x14007291e
lea rcx, [rbp - 0x61]
call fcn.14000e630
mov rbx, qword [rbp - 0x61]
mov qword [rbp - 1], rbx
mov edx, dword [rbp + 0x7f]
test edx, edx
js 0x140072c94
mov ecx, 1
mov r8, qword [rbp - 0x59]
sub ecx, dword [r8 - 8]
mov eax, dword [r8 - 0xc]
sub eax, edx
or eax, ecx
jge 0x140072951
lea rcx, [rbp - 0x59]
call fcn.14000e630
mov r8, qword [rbp - 0x59]
lea rax, [rbp - 0x29]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x7f]
mov rdx, qword [rbp - 0x41]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
nop
mov rcx, qword [rbp - 0x59]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400b7e14
test eax, eax
js 0x140072c89
mov rcx, qword [rbp - 0x59]
cmp eax, dword [rcx - 0xc]
jg 0x140072c89
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbp - 0x59]
mov word [rax + rcx*2], r15w
mov rcx, qword [rbp - 0x61]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400b7e14
test eax, eax
js 0x140072c7e
mov rcx, qword [rbp - 0x61]
cmp eax, dword [rcx - 0xc]
jg 0x140072c7e
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbp - 0x61]
mov word [rax + rcx*2], r15w
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rbp - 0x59]
test rax, rax
je 0x140072cb5
mov rcx, qword [rbp - 0x51]
sub rax, rcx
nop dword [rax]
movzx r8d, word [rcx]
movzx edx, word [rcx + rax]
sub r8d, edx
jne 0x140072a15
add rcx, 2
test edx, edx
jne 0x140072a00
mov rcx, qword [rbp - 0x61]
test r8d, r8d
jne 0x140072a4d
mov rax, qword [rbp - 0x49]
test rax, rax
je 0x140072caa
mov rdx, rcx
sub rax, rcx
movzx r9d, word [rdx]
movzx r8d, word [rdx + rax]
sub r9d, r8d
jne 0x140072a48
add rdx, 2
test r8d, r8d
jne 0x140072a31
test r9d, r9d
je 0x140072a94
lea rdx, [rcx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140072a67
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x140072a83
mov edx, dword [rbp + 0x6f]
jmp 0x1400727a0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, dword [rbp + 0x6f]
jmp 0x1400727a0
mov rcx, qword [rbp - 0x69]
add rcx, 0xffffffffffffffe8
call fcn.14000c440
add rax, 0x18
mov qword [rsi], rax
mov rdx, qword [rbp - 0x61]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140072ac6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140072ae4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x69]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140072b02
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140072b12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x31]
add rdx, 0xffffffffffffffe8
jmp 0x140072bda
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x140072cd6
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rdx, [0x1400f4784]
cmp rdx, 0x10000
jae 0x140072b5a
movzx edx, dx
mov rcx, rsi
call fcn.14000d4c0
jmp 0x140072b76
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140072b60
mov r8d, eax
mov rcx, rsi
call fcn.14000fd40
nop
jmp 0x140072ae4
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x140072c3c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rdx, [0x1400f4784]
cmp rdx, 0x10000
jae 0x140072bb6
movzx edx, dx
mov rcx, rsi
call fcn.14000d4c0
jmp 0x140072bd6
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140072bc0
mov r8d, eax
mov rcx, rsi
call fcn.14000fd40
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140072bf0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140072c0e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140072c29
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rsi
add rsp, 0xd8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
int3
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80070057
call fcn.14000c310
nop
mov ecx, 0x80070057
call fcn.14000c310
nop
mov ecx, 0x80070057
call fcn.14000c310
nop
mov ecx, 0x80070057
call fcn.14000c310
int3
mov ecx, 0x80004005
call fcn.14000c310
int3
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
int3
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80070057
call fcn.14000c310
nop
mov ecx, 0x80070057
call fcn.14000c310
int3