Function at 0x140014660
Capabilities:
Check if file exists
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x4d8], rbx
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov r14, rcx
mov qword [rsp + 0x48], rcx
lea rax, [0x14008cac0]
mov qword [rbp + 0xb0], rax
lea rax, fcn.14001b680
mov qword [rbp + 0xb8], rax
lea rax, [rbp + 0xd0]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], 0x41
xor r15d, r15d
mov word [rbp + 0xd0], r15w
lea rax, fcn.140008d70
mov qword [rbp + 0xb8], rax
lea rax, [0x14008b078]
mov qword [rbp + 0xb0], rax
mov dword [rbp + 0x158], r15d
mov qword [rbp + 0x160], r15
mov qword [rsp + 0x20], r15
mov r9d, 0xf003f
mov r8, qword [r8]
lea rcx, [rbp + 0xb0]
call fcn.1400177b0
test eax, eax
js 0x14003b06a
mov r12d, r15d
mov dword [rsp + 0x50], r15d
lea r13, fcn.14001b680
lea rsi, [fcn.140016920]
lea rdi, [0x1400c9e40]
mov dword [rbp - 0x70], 0x100
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x14003b08a
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x70]
lea r8, [rbp + 0x170]
mov edx, r12d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jne 0x140015067
lea ebx, [rax + 1]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x103
je 0x14001507f
test ebx, ebx
je 0x14003b2d1
lea rax, [0x14008cac0]
mov qword [rbp - 0x10], rax
lea rax, fcn.14001b680
mov qword [rbp - 8], rax
lea rax, [rbp + 0x10]
mov qword [rbp], rax
mov qword [rbp + 8], 0x41
mov word [rbp + 0x10], r15w
lea rax, fcn.140008d70
mov qword [rbp - 8], rax
lea rax, [0x14008b078]
mov qword [rbp - 0x10], rax
mov dword [rbp + 0x98], r15d
mov qword [rbp + 0xa0], r15
mov qword [rsp + 0x20], r15
mov r9d, 0xf003f
lea r8, [rbp + 0x170]
mov rdx, qword [rbp + 0x160]
lea rcx, [rbp - 0x10]
call fcn.1400177b0
test eax, eax
js 0x14003b2a8
mov qword [rbp - 0x60], r13
lea rax, [0x14008cbc0]
mov qword [rbp - 0x60], rax
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
cmp rax, rsi
jne 0x14003b09d
lock inc dword [0x1400c9e50]
mov rax, rdi
add rax, 0x18
mov qword [rbp - 0x58], rax
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
cmp rax, rsi
jne 0x14003b0b0
lock inc dword [0x1400c9e50]
mov rax, rdi
add rax, 0x18
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], r15d
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
cmp rax, rsi
jne 0x14003b0c3
lock inc dword [0x1400c9e50]
mov rax, rdi
add rax, 0x18
mov qword [rsp + 0x78], rax
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
cmp rax, rsi
jne 0x14003b0d6
lock inc dword [0x1400c9e50]
mov rax, rdi
add rax, 0x18
mov qword [rbp - 0x80], rax
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x60]
call fcn.140013840
test eax, eax
js 0x140014de8
mov rdi, r15
mov qword [rsp + 0x40], r15
mov rbx, qword [r14]
cmp rbx, qword [r14 + 0x28]
je 0x14001495e
test rdi, rdi
jne 0x14003b103
mov r14d, dword [rsp + 0x60]
mov eax, dword [rbx + 8]
cmp r14d, eax
je 0x140014a06
ja 0x140014ae0
mov rax, qword [rbx + 8]
cmp rax, qword [rsp + 0x60]
je 0x140014aee
mov rbx, qword [rbx + 0x80]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
jmp 0x140014916
test rdi, rdi
jne 0x14003b103
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.140015360
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x68], r15
mov rbx, qword [r14]
cmp rbx, qword [r14 + 0x28]
je 0x1400149c2
mov qword [rbp - 0x68], rbx
mov r14d, dword [rsp + 0x60]
mov ecx, dword [rbx + 8]
cmp r14d, ecx
je 0x140014a73
ja 0x140014bd9
mov rax, qword [rbx + 8]
cmp rax, qword [rsp + 0x60]
je 0x140014b68
mov rbx, qword [rbx + 0x80]
mov r14, qword [rsp + 0x48]
jmp 0x140014984
mov r13, qword [rbp - 0x68]
mov rsi, qword [rsp + 0x40]
mov qword [rsi + 0x88], r13
test r13, r13
je 0x140015077
mov r12d, dword [rsp + 0x60]
mov rax, qword [r13 + 8]
cmp r12d, eax
je 0x140014c3a
seta al
test al, al
je 0x140014cc1
mov qword [r13 + 0x78], rsi
mov r14, qword [rsp + 0x48]
jmp 0x140014d41
mov r13d, r15d
test r14d, r14d
je 0x14001493c
mov rdi, r15
mov rsi, r15
cmp rdi, qword [rsp + 0x60]
jae 0x14003b20e
mov r15, qword [rsp + 0x58]
cmp rdi, qword [rbx + 8]
jae 0x14003b203
mov r12, qword [rbx]
mov eax, dword [r15 + rsi + 8]
cmp eax, dword [r12 + rsi + 8]
jne 0x140014fc2
test eax, eax
jne 0x140014a5f
mov rdx, qword [r12 + rsi]
mov rcx, qword [r15 + rsi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140014be7
inc r13d
inc rdi
add rsi, 0x10
cmp r13d, r14d
jb 0x140014a18
jmp 0x14003b0e9
mov r13d, r15d
test r14d, r14d
je 0x1400149a5
mov rdi, r15
mov rsi, r15
cmp rdi, qword [rsp + 0x60]
jae 0x14003b245
mov r15, qword [rsp + 0x58]
cmp rdi, qword [rbx + 8]
jae 0x14003b23a
mov r12, qword [rbx]
mov eax, dword [r15 + rsi + 8]
cmp eax, dword [r12 + rsi + 8]
jne 0x140014fe0
test eax, eax
jne 0x140014acc
mov rdx, qword [r12 + rsi]
mov rcx, qword [r15 + rsi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140014c13
inc r13d
inc rdi
add rsi, 0x10
cmp r13d, r14d
jb 0x140014a85
jmp 0x14003b15b
mov rbx, qword [rbx + 0x78]
mov r14, qword [rsp + 0x48]
jmp 0x140014916
mov esi, r15d
test rax, rax
je 0x14003b0f1
mov rdi, r15
cmp r15, rax
jae 0x14003b22f
mov rcx, rdi
add rcx, rcx
mov rax, qword [rbx]
cmp dword [rax + rcx*8 + 8], 0
jne 0x140014ff9
cmp rdi, qword [rsp + 0x60]
jae 0x14003b224
mov rcx, rdi
add rcx, rcx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax + rcx*8]
cmp rdi, qword [rbx + 8]
jae 0x14003b219
add rdi, rdi
mov rax, qword [rbx]
mov rcx, qword [rax + rdi*8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14001494b
inc esi
mov edi, esi
mov rax, qword [rbx + 8]
cmp rdi, rax
jb 0x140014b06
jmp 0x14003b0f1
mov esi, r15d
test rax, rax
je 0x140014bd9
mov rdi, r15
cmp r15, rax
jae 0x14003b266
mov rcx, rdi
add rcx, rcx
mov rax, qword [rbx]
cmp dword [rax + rcx*8 + 8], 0
jne 0x140015015
cmp rdi, qword [rsp + 0x60]
jae 0x14003b25b
mov rcx, rdi
add rcx, rcx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax + rcx*8]
cmp rdi, qword [rbx + 8]
jae 0x14003b250
add rdi, rdi
mov rax, qword [rbx]
mov rcx, qword [rax + rdi*8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1400149b4
inc esi
mov edi, esi
mov rax, qword [rbx + 8]
cmp rdi, rax
jb 0x140014b7c
mov rbx, qword [rbx + 0x78]
mov r14, qword [rsp + 0x48]
jmp 0x140014984
mov rdx, qword [r12 + rsi]
mov rcx, qword [r15 + rsi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
xor r15d, r15d
test eax, eax
jns 0x14001493c
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rbx + 0x78]
mov r14, qword [rsp + 0x48]
jmp 0x140014916
mov rdx, qword [r12 + rsi]
mov rcx, qword [r15 + rsi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
xor r15d, r15d
test eax, eax
jns 0x1400149a5
mov rbx, qword [rbx + 0x78]
mov r14, qword [rsp + 0x48]
jmp 0x140014984
test r12d, r12d
je 0x14003b16d
xor edi, edi
mov ebx, edi
cmp rbx, qword [rsp + 0x60]
jae 0x14003b27c
mov rsi, qword [rsp + 0x58]
cmp rbx, qword [r13 + 8]
jae 0x14003b271
mov r14, qword [r13]
mov eax, dword [rsi + rdi + 8]
cmp eax, dword [r14 + rdi + 8]
jne 0x14001504d
test eax, eax
jne 0x140014c8a
mov rdx, qword [r14 + rdi]
mov rcx, qword [rsi + rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140014c9e
inc r15d
inc rbx
add rdi, 0x10
cmp r15d, r12d
jb 0x140014c47
jmp 0x14003b163
mov rdx, qword [r14 + rdi]
mov rcx, qword [rsi + rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
mov rsi, qword [rsp + 0x40]
xor r15d, r15d
test eax, eax
js 0x1400149f8
mov r14, qword [rsp + 0x48]
mov rax, qword [r13 + 8]
cmp rax, qword [rsp + 0x60]
jne 0x140014d3a
mov edi, r15d
test rax, rax
je 0x1400149f8
mov rbx, r15
cmp rbx, rax
jae 0x14003b292
mov rax, rbx
shl rax, 4
add rax, qword [r13]
cmp dword [rax + 8], 0
jne 0x140015031
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140017650
cmp rbx, qword [r13 + 8]
jae 0x14003b287
shl rbx, 4
add rbx, qword [r13]
mov rdx, qword [rax]
mov rcx, qword [rbx]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140014d3a
inc edi
mov rax, qword [r13 + 8]
mov ebx, edi
cmp rbx, rax
jb 0x140014ce4
jmp 0x1400149f8
mov qword [r13 + 0x80], rsi
mov dword [rsi + 0x70], r15d
mov rax, qword [r14]
cmp rsi, rax
je 0x140014db7
mov rcx, qword [rsi + 0x88]
cmp dword [rcx + 0x70], 0
jne 0x140014db7
mov rdx, qword [rcx + 0x88]
mov rax, qword [rdx + 0x78]
cmp rcx, rax
je 0x140014f5a
test rax, rax
je 0x140014f15
cmp dword [rax + 0x70], 0
jne 0x140014f15
mov dword [rcx + 0x70], 1
mov dword [rax + 0x70], 1
mov rax, qword [rsi + 0x88]
mov rcx, qword [rax + 0x88]
mov dword [rcx + 0x70], r15d
mov rax, qword [rsi + 0x88]
mov rsi, qword [rax + 0x88]
mov rax, qword [r14]
cmp rsi, rax
jne 0x140014d4d
mov dword [rax + 0x70], 1
mov rcx, qword [r14]
add rcx, 0x88
je 0x14003b29d
mov rax, qword [r14 + 0x28]
mov qword [rcx], rax
lea r13, fcn.14001b680
lea rsi, [fcn.140016920]
mov r12d, dword [rsp + 0x50]
inc r12d
mov dword [rsp + 0x50], r12d
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x14003b189
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x14003b19f
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x140014e71
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x140014e67
nop word [rax + rax]
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x14003b1b5
add rbx, 0x10
sub rdi, 1
jne 0x140014e40
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop
lea rax, [0x14008cbc0]
mov qword [rbp - 0x60], rax
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x14003b1cb
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x14003b1e1
mov qword [rbp - 0x60], r13
lea rax, [0x14008b078]
mov qword [rbp - 0x10], rax
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x140014ed9
cmp dword [rbp + 0x98], 0
je 0x140014ed9
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop
lea rax, [0x14008cac0]
mov qword [rbp - 0x10], rax
lea rax, fcn.140008d70
mov qword [rbp - 8], rax
mov rcx, qword [rbp]
test rcx, rcx
je 0x140014f05
lea rax, [rbp + 0x10]
cmp rcx, rax
jne 0x14003b1f7
lea rax, fcn.14001b680
mov qword [rbp - 8], rax
jmp 0x140014746
cmp rsi, qword [rcx + 0x78]
je 0x14003b175
mov rax, qword [rsi + 0x88]
mov dword [rax + 0x70], 1
mov rax, qword [rsi + 0x88]
mov rcx, qword [rax + 0x88]
mov dword [rcx + 0x70], r15d
mov rdx, qword [rsi + 0x88]
mov rdx, qword [rdx + 0x88]
mov rcx, r14
call fcn.140015970
jmp 0x140014daf
mov rax, qword [rdx + 0x80]
test rax, rax
je 0x140014f70
cmp dword [rax + 0x70], 0
je 0x140014d81
cmp rsi, qword [rcx + 0x80]
jne 0x140014f87
mov rsi, rcx
mov rdx, rcx
mov rcx, r14
call fcn.140015970
mov rax, qword [rsi + 0x88]
mov dword [rax + 0x70], 1
mov rax, qword [rsi + 0x88]
mov rcx, qword [rax + 0x88]
mov dword [rcx + 0x70], r15d
mov rdx, qword [rsi + 0x88]
mov rdx, qword [rdx + 0x88]
mov rcx, r14
call fcn.1400152e0
jmp 0x140014daf
xor r15d, r15d
test eax, eax
jne 0x14001493c
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rbx + 0x78]
mov r14, qword [rsp + 0x48]
jmp 0x140014916
xor r15d, r15d
test eax, eax
jne 0x1400149a5
mov rbx, qword [rbx + 0x78]
mov r14, qword [rsp + 0x48]
jmp 0x140014984
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.140017650
cmp dword [rax + 8], 0
jne 0x140014b56
jmp 0x140014b1a
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.140017650
cmp dword [rax + 8], 0
jne 0x140014bcc
jmp 0x140014b90
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140017650
cmp dword [rax + 8], 0
jne 0x140014d28
jmp 0x140014cf9
mov rsi, qword [rsp + 0x40]
xor r15d, r15d
test eax, eax
je 0x1400149f8
mov r14, qword [rsp + 0x48]
jmp 0x140014cc1
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov ebx, r15d
jmp 0x1400147a3
mov qword [r14], rsi
jmp 0x140014d41
lea rcx, [rbp + 0xb0]
call fcn.140017740
mov eax, r15d
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.14002dd40
mov rbx, qword [rsp + 0x4d8]
add rsp, 0x480
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop
cmp eax, 2
je 0x14001507f
test eax, eax
jg 0x14003b2d9
mov r15d, eax
jmp 0x14001507f
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov ebx, r15d
jmp 0x1400147a3
lea rcx, [0x1400c9e30]
call qword [case.0x14000702c.0]
nop
jmp 0x140014862
lea rcx, [0x1400c9e30]
call qword [case.0x14000702c.0]
nop
jmp 0x140014888
lea rcx, [0x1400c9e30]
call qword [case.0x14000702c.0]
nop
jmp 0x1400148c2
lea rcx, [0x1400c9e30]
call qword [case.0x14000702c.0]
nop
jmp 0x1400148e9
xor r15d, r15d
jmp 0x14001493c
mov rdi, rbx
mov qword [rsp + 0x40], rbx
mov r14, qword [rsp + 0x48]
jmp 0x140014916
mov rdx, rdi
mov rcx, r14
call fcn.14001eadc
mov rbx, rax
test rax, rax
je 0x14003b12c
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.14001eca4
test al, al
je 0x14003b12c
mov rdi, rbx
jmp 0x14003b103
test rdi, rdi
je 0x140014967
lea rbx, [rdi + 0x38]
mov qword [rbp - 0x18], rbx
mov rcx, rbx
call fcn.14002d404
mov qword [rbp - 0x68], rbx
lea rdx, [rbp - 0x60]
mov rcx, rbx
call fcn.14002d444
nop
jmp 0x140014dd5
xor r15d, r15d
jmp 0x1400149a5
mov rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
xor r15d, r15d
jmp 0x140014cc1
mov rsi, rcx
mov rdx, rcx
mov rcx, r14
call fcn.1400152e0
nop
jmp 0x140014f1f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000702c.0]
nop
jmp 0x140014e09
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000702c.0]
nop
jmp 0x140014e23
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000702c.0]
nop
jmp 0x140014e58
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000702c.0]
nop
jmp 0x140014e95
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000702c.0]
nop
jmp 0x140014eae
call qword [sym.imp.msvcrt.dll_free]
nop
jmp 0x140014f05
mov ecx, 0x80070057
call fcn.14004a0f0
int3
mov ecx, 0x80070057
call fcn.14004a0f0
int3
mov ecx, 0x80070057
call fcn.14004a0f0
int3
mov ecx, 0x80070057
call fcn.14004a0f0
int3
mov ecx, 0x80070057
call fcn.14004a0f0
int3
mov ecx, 0x80070057
call fcn.14004a0f0
int3
mov ecx, 0x80070057
call fcn.14004a0f0
int3
mov ecx, 0x80070057
call fcn.14004a0f0
int3
mov ecx, 0x80070057
call fcn.14004a0f0
int3
mov ecx, 0x80070057
call fcn.14004a0f0
int3
mov ecx, 0x80070057
call fcn.14004a0f0
int3
mov ecx, 0x80070057
call fcn.14004a0f0
int3
mov ecx, 0x80070057
call fcn.14004a0f0
int3
mov ecx, 0x80070057
call fcn.14004a0f0
int3
mov ecx, 0x80004005
call fcn.14004a0f0
nop
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jg 0x14003b2b7
mov r15d, eax
jmp 0x14003b2c2
movzx r15d, ax
or r15d, 0x80070000
lea rcx, [rbp - 0x10]
call fcn.140017740
nop
jmp 0x14001507f
test eax, eax
jle 0x14003b082
movzx r15d, ax
or r15d, 0x80070000
jmp 0x14001507f