Function at 0x140001f60
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x5db0
call fcn.14001c270
sub rsp, rax
mov qword [rsp + 0xe0], 0xfffffffffffffffe
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x5da0], rax
movzx eax, byte [0x1400251fb]
mov byte [rsp + 0x1790], al
lea rax, [rsp + 0x1791]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov dword [rsp + 0x98], 0x104
mov dword [rsp + 0x74], 0
movzx eax, byte [0x1400251ff]
mov byte [rsp + 0x19a0], al
lea rax, [rsp + 0x19a1]
mov rdi, rax
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov dword [rsp + 0x84], 0x3fff
movzx eax, byte [0x140025202]
mov byte [rsp + 0x1720], al
lea rax, [rsp + 0x1721]
mov rdi, rax
xor eax, eax
mov ecx, WSAAsyncSelect
rep stosb byte [rdi], al
mov dword [rsp + 0xa0], WSAAsyncSelect
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc4]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xcc]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x1790]
mov rcx, qword [rsp + 0x5dc0]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x74], 0
je 0x14000223e
mov edx, dword [rsp + 0x74]
lea rcx, str._nNumber_of_subkeys:__d_n
call fcn.140001580
mov dword [rsp + 0x68], 0
jmp 0x1400020e2
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x74]
cmp dword [rsp + 0x68], eax
jae 0x14000223e
mov dword [rsp + 0x9c], 0xff
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x9c]
lea r8, [rsp + 0x18a0]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x5dc0]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0
jne 0x140002239
lea rax, [rsp + 0x18a0]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x104]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xa8]
movzx eax, byte [rax]
mov byte [rsp + 0x60], al
mov rax, qword [rsp + 0x88]
movzx ecx, byte [rsp + 0x60]
mov byte [rax], cl
mov rax, qword [rsp + 0xa8]
inc rax
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x88]
inc rax
mov qword [rsp + 0x88], rax
cmp byte [rsp + 0x60], 0
jne 0x140002184
mov dword [rsp + 0x710], 0
mov dword [rsp + 0x100], 0x7dd
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1720]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
xor r8d, r8d
lea rdx, [0x140025203]
mov rcx, qword [rsp + 0x5dc0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor r9d, r9d
mov r8d, 0x1620
lea rdx, [rsp + 0x100]
mov rcx, qword [0x14002be88]
call fcn.140001440
jmp 0x1400020d8
cmp dword [rsp + 0x80], 0
je 0x14000265a
mov dword [rsp + 0x68], 0
mov dword [rsp + 0x6c], 0
jmp 0x140002268
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x80]
cmp dword [rsp + 0x68], eax
jae 0x14000265a
mov dword [rsp + 0x84], 0x3fff
mov eax, 1
imul rax, rax, 0
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0x3fff
jae 0x1400022a5
jmp 0x1400022aa
call fcn.14000767c
mov rax, qword [rsp + 0xb8]
mov byte [rsp + rax + 0x1da0], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x84]
lea r8, [rsp + 0x1da0]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x5dc0]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0
jne 0x140002655
lea rax, [rsp + 0x1da0]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x104]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax]
mov byte [rsp + 0x61], al
mov rax, qword [rsp + 0x90]
movzx ecx, byte [rsp + 0x61]
mov byte [rax], cl
mov rax, qword [rsp + 0xb0]
inc rax
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x90]
inc rax
mov qword [rsp + 0x90], rax
cmp byte [rsp + 0x61], 0
jne 0x14000233f
lea rax, [rsp + 0x718]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x5dc8]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1400023e1
cmp dword [rsp + 0x70], 1
je 0x140002456
cmp dword [rsp + 0x70], 2
je 0x1400024cb
cmp dword [rsp + 0x70], 3
je 0x140002540
cmp dword [rsp + 0x70], 4
je 0x1400025b2
jmp 0x140002622
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
mov rdx, qword [rsp + 0x5dd0]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002451
lea rax, [rsp + 0x70c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x718]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
xor r8d, r8d
lea rdx, [rsp + 0x1da0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140002451
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x714], eax
jmp 0x140002622
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
mov rdx, qword [rsp + 0x5dd0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400024c6
lea rax, [rsp + 0x70c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x718]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
xor r8d, r8d
lea rdx, [rsp + 0x1da0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400024c6
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x714], eax
jmp 0x140002622
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
mov rdx, qword [rsp + 0x5dd0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000253b
lea rax, [rsp + 0x70c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x718]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
xor r8d, r8d
lea rdx, [rsp + 0x1da0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000253b
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x714], eax
jmp 0x140002622
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
mov rdx, qword [rsp + 0x5dd0]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400025b0
lea rax, [rsp + 0x70c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x718]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
xor r8d, r8d
lea rdx, [rsp + 0x1da0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400025b0
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x714], eax
jmp 0x140002622
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
mov rdx, qword [rsp + 0x5dd0]
mov rcx, 0xffffffff80000005
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002622
lea rax, [rsp + 0x70c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x718]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
xor r8d, r8d
lea rdx, [rsp + 0x1da0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140002622
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x714], eax
mov dword [rsp + 0x710], 1
mov dword [rsp + 0x100], 0x7dd
xor r9d, r9d
mov r8d, 0x1620
lea rdx, [rsp + 0x100]
mov rcx, qword [0x14002be88]
call fcn.140001440
jmp 0x14000225e
xor eax, eax
jmp 0x140002667
mov rcx, qword [rsp + 0x5da0]
xor rcx, rsp
call fcn.140007550
add rsp, 0x5db0
pop rdi
ret