Function at 0x14000f050
Capabilities:
Check if file exists
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x4d8], rbx
mov rax, qword [0x1400c5228]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
lea rax, [rbp + 0xd0]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], 0x41
xor r14d, r14d
mov word [rbp + 0xd0], r14w
lea rsi, [0x14008a770]
mov qword [rbp + 0xb8], rsi
lea r12, [0x14008a680]
mov qword [rbp + 0xb0], r12
mov dword [rbp + 0x158], r14d
mov qword [rbp + 0x160], r14
mov qword [rsp + 0x20], r14
mov r9d, 0xf003f
mov r8, qword [r8]
lea rcx, [rbp + 0xb0]
call fcn.14000fab0
test eax, eax
js 0x140036ed0
mov r15d, r14d
mov dword [rsp + 0x50], r14d
lea r13, [0x14008a7a8]
nop dword [rax]
nop word [rax + rax]
mov dword [rbp - 0x68], 0x100
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x140036ef0
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x68]
lea r8, [rbp + 0x170]
mov edx, r15d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000fa43
lea ebx, [rax + 1]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x103
je 0x14000fa6f
test ebx, ebx
je 0x1400370eb
lea rax, [rbp + 0x10]
mov qword [rbp], rax
mov qword [rbp + 8], 0x41
mov word [rbp + 0x10], r14w
mov qword [rbp - 8], rsi
mov qword [rbp - 0x10], r12
mov dword [rbp + 0x98], r14d
mov qword [rbp + 0xa0], r14
mov qword [rsp + 0x20], r14
mov r9d, 0xf003f
lea r8, [rbp + 0x170]
mov rdx, qword [rbp + 0x160]
lea rcx, [rbp - 0x10]
call fcn.14000fab0
test eax, eax
js 0x1400370c2
lea rax, [0x14008a7f8]
mov qword [rbp - 0x60], rax
mov rax, qword [0x1400c60d0]
lea rcx, [0x1400c60d0]
mov rax, qword [rax + 0x18]
call qword [case.0x140002c98.0]
add rax, 0x18
mov qword [rbp - 0x58], rax
mov rax, qword [0x1400c60d0]
lea rcx, [0x1400c60d0]
mov rax, qword [rax + 0x18]
call qword [case.0x140002c98.0]
add rax, 0x18
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x70], r14d
mov rax, qword [0x1400c60d0]
lea rcx, [0x1400c60d0]
mov rax, qword [rax + 0x18]
call qword [case.0x140002c98.0]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov rax, qword [0x1400c60d0]
lea rcx, [0x1400c60d0]
mov rax, qword [rax + 0x18]
call qword [case.0x140002c98.0]
add rax, 0x18
mov qword [rbp - 0x80], rax
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x60]
call fcn.140010630
test eax, eax
js 0x14000f76a
mov rsi, r14
mov qword [rsp + 0x48], r14
mov rbx, qword [rdi]
mov r12, qword [rsp + 0x60]
mov r14, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x60]
cmp rbx, qword [rdi + 0x28]
je 0x14000f367
test rsi, rsi
jne 0x140036f1f
cmp ecx, dword [rbx + 8]
je 0x14000f2fa
seta al
test al, al
jne 0x14000f60e
mov rax, qword [rbx + 8]
cmp rax, r12
je 0x14000f4dc
mov rbx, qword [rbx + 0x80]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
jmp 0x14000f2b3
xor r13d, r13d
test ecx, ecx
je 0x14000f2da
xor esi, esi
mov r14, qword [rsp + 0x58]
mov r15, r14
neg r15
nop
cmp rsi, r12
jae 0x14003701d
cmp rsi, qword [rbx + 8]
jae 0x140037012
lea rdi, [r15 + r14]
add rdi, qword [rbx]
mov eax, dword [r14 + 8]
cmp eax, dword [rdi + 8]
jne 0x14000f928
test eax, eax
jne 0x14000f353
mov rdx, qword [rdi]
mov rcx, qword [r14]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14000f5e7
mov ecx, dword [rsp + 0x60]
inc r13d
inc rsi
add r14, 0x10
cmp r13d, ecx
jb 0x14000f310
jmp 0x14000f930
test rsi, rsi
jne 0x140036f1f
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.14000fbd0
mov qword [rsp + 0x48], rax
xor r14d, r14d
mov r13d, r14d
mov rbx, qword [rdi]
mov r15, qword [rsp + 0x60]
mov r12d, dword [rsp + 0x60]
cmp rbx, qword [rdi + 0x28]
je 0x14000f449
mov r13, rbx
cmp r12d, dword [rbx + 8]
je 0x14000f3d2
seta al
test al, al
jne 0x14000f5bc
mov rax, qword [rbx + 8]
cmp rax, r15
je 0x14000f54d
mov rbx, qword [rbx + 0x80]
mov rdi, qword [rsp + 0x40]
jmp 0x14000f399
mov dword [rbp - 0x70], r14d
test r12d, r12d
je 0x14000f3b7
mov rsi, r14
mov r14, qword [rsp + 0x58]
mov r12, r14
neg r12
nop dword [rax]
cmp rsi, r15
jae 0x140037054
cmp rsi, qword [rbx + 8]
jae 0x140037049
lea rdi, [r14 + r12]
add rdi, qword [rbx]
mov eax, dword [r14 + 8]
cmp eax, dword [rdi + 8]
jne 0x14000f93a
test eax, eax
jne 0x14000f42f
mov rdx, qword [rdi]
mov rcx, qword [r14]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14000f5ca
mov eax, dword [rbp - 0x70]
inc eax
mov dword [rbp - 0x70], eax
inc rsi
add r14, 0x10
cmp eax, dword [rsp + 0x60]
jb 0x14000f3f0
jmp 0x14000f942
mov rsi, qword [rsp + 0x48]
mov qword [rsi + 0x88], r13
test r13, r13
je 0x14000fa53
mov rax, qword [r13 + 8]
cmp r12d, eax
jne 0x14000f873
test r12d, r12d
je 0x140036f7c
xor esi, esi
mov rdi, qword [rsp + 0x58]
mov rax, rdi
mov qword [rbp - 0x70], rax
cmp rsi, r15
jae 0x14003708b
cmp rsi, qword [r13 + 8]
jae 0x140037080
mov rbx, rdi
sub rbx, rax
add rbx, qword [r13]
mov eax, dword [rdi + 8]
cmp eax, dword [rbx + 8]
jne 0x14000fa25
test eax, eax
jne 0x14000f4c3
mov rdx, qword [rbx]
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14000f617
inc r14d
inc rsi
add rdi, 0x10
cmp r14d, r12d
jae 0x140036f77
mov rax, qword [rbp - 0x70]
jmp 0x14000f482
xor esi, esi
test rax, rax
je 0x140036f0d
xor edi, edi
cmp rdi, rax
jae 0x14003703e
mov rcx, rdi
add rcx, rcx
mov rax, qword [rbx]
cmp dword [rax + rcx*8 + 8], 0
jne 0x14000f9b2
cmp rdi, r12
jae 0x140037033
mov rax, rdi
add rax, rax
mov rdx, qword [r14 + rax*8]
cmp rdi, qword [rbx + 8]
jae 0x140037028
add rdi, rdi
mov rax, qword [rbx]
mov rcx, qword [rax + rdi*8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14000f2e7
inc esi
mov edi, esi
mov rax, qword [rbx + 8]
cmp rdi, rax
jb 0x14000f4f2
jmp 0x140036f0d
mov esi, r14d
test rax, rax
je 0x14000f5bc
mov rdi, r14
cmp r14, rax
jae 0x140037075
mov rcx, rdi
add rcx, rcx
mov rax, qword [rbx]
cmp dword [rax + rcx*8 + 8], 0
jne 0x14000f9ce
cmp rdi, r15
jae 0x14003706a
mov rax, rdi
add rax, rax
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + rax*8]
cmp rdi, qword [rbx + 8]
jae 0x14003705f
add rdi, rdi
mov rax, qword [rbx]
mov rcx, qword [rax + rdi*8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14000f3c4
inc esi
mov edi, esi
mov rax, qword [rbx + 8]
cmp rdi, rax
jb 0x14000f561
mov rbx, qword [rbx + 0x78]
mov rdi, qword [rsp + 0x40]
jmp 0x14000f394
mov rdx, qword [rdi]
mov rcx, qword [r14]
call qword [sym.imp.msvcrt.dll__wcsicmp]
xor r14d, r14d
test eax, eax
js 0x14000f5bc
mov r12d, dword [rsp + 0x60]
jmp 0x14000f3b7
mov rdx, qword [rdi]
mov rcx, qword [r14]
call qword [sym.imp.msvcrt.dll__wcsicmp]
mov r14, qword [rsp + 0x58]
test eax, eax
jns 0x14000f2da
mov ecx, dword [rsp + 0x60]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rbx + 0x78]
jmp 0x14000f2b7
mov rdx, qword [rbx]
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
mov rsi, qword [rsp + 0x48]
xor r14d, r14d
test eax, eax
js 0x14000f6a5
mov rax, qword [r13 + 8]
cmp rax, r15
jne 0x14000f6b0
mov edi, r14d
test rax, rax
je 0x14000f6a5
mov rbx, r14
cmp rbx, rax
jae 0x1400370ac
mov rax, rbx
shl rax, 4
add rax, qword [r13]
cmp dword [rax + 8], 0
jne 0x14000f9f6
cmp rbx, r15
jae 0x1400370a1
mov rax, rbx
shl rax, 4
add rax, qword [rsp + 0x58]
cmp rbx, qword [r13 + 8]
jae 0x140037096
shl rbx, 4
add rbx, qword [r13]
mov rdx, qword [rax]
mov rcx, qword [rbx]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14000f6b0
inc edi
mov rax, qword [r13 + 8]
mov ebx, edi
cmp rbx, rax
jb 0x14000f64c
mov rdi, qword [rsp + 0x40]
mov qword [r13 + 0x78], rsi
jmp 0x14000f6bc
mov qword [r13 + 0x80], rsi
mov rdi, qword [rsp + 0x40]
mov dword [rsi + 0x70], r14d
mov rax, qword [rdi]
cmp rsi, rax
je 0x14000f732
mov rcx, qword [rsi + 0x88]
cmp dword [rcx + 0x70], 0
jne 0x14000f732
mov rdx, qword [rcx + 0x88]
mov rax, qword [rdx + 0x78]
cmp rcx, rax
je 0x14000f94a
test rax, rax
je 0x14000f887
cmp dword [rax + 0x70], 0
jne 0x14000f887
mov dword [rcx + 0x70], 1
mov dword [rax + 0x70], 1
mov rax, qword [rsi + 0x88]
mov rcx, qword [rax + 0x88]
mov dword [rcx + 0x70], r14d
mov rax, qword [rsi + 0x88]
mov rsi, qword [rax + 0x88]
mov rax, qword [rdi]
cmp rsi, rax
jne 0x14000f6c8
mov dword [rax + 0x70], 1
mov rcx, qword [rdi]
add rcx, 0x88
je 0x1400370b7
mov rax, qword [rdi + 0x28]
mov qword [rcx], rax
lea r13, [0x14008a7a8]
lea r12, [0x14008a680]
lea rsi, [0x14008a770]
mov r15d, dword [rsp + 0x50]
inc r15d
mov dword [rsp + 0x50], r15d
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x140036f98
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x140036fae
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x14000f7f7
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x14000f7e9
nop dword [rax]
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x140036fc4
add rbx, 0x10
sub rdi, 1
jne 0x14000f7c0
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x140036fda
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x140036ff0
mov qword [rbp - 0x10], r12
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x14000f84c
cmp dword [rbp + 0x98], 0
je 0x14000f84c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], rsi
mov rcx, qword [rbp]
test rcx, rcx
je 0x14000f120
lea rax, [rbp + 0x10]
cmp rcx, rax
je 0x14000f120
jmp 0x140037006
seta al
test al, al
je 0x14000f62f
mov qword [r13 + 0x78], rsi
jmp 0x14000f6bc
cmp rsi, qword [rcx + 0x78]
je 0x140036f84
mov rax, qword [rsi + 0x88]
mov dword [rax + 0x70], 1
mov rax, qword [rsi + 0x88]
mov rcx, qword [rax + 0x88]
mov dword [rcx + 0x70], r14d
mov rax, qword [rsi + 0x88]
mov rcx, qword [rax + 0x88]
test rcx, rcx
je 0x14000f72a
mov rdx, qword [rcx + 0x80]
mov rax, qword [rdx + 0x78]
mov qword [rcx + 0x80], rax
mov rax, qword [rdx + 0x78]
cmp rax, qword [rdi + 0x28]
jne 0x14000f9ea
mov rax, qword [rcx + 0x88]
mov qword [rdx + 0x88], rax
mov rax, qword [rcx + 0x88]
cmp rax, qword [rdi + 0x28]
je 0x14000fa12
cmp rcx, qword [rax + 0x78]
je 0x14000fa5b
mov qword [rax + 0x80], rdx
mov qword [rdx + 0x78], rcx
mov qword [rcx + 0x88], rdx
jmp 0x14000f72a
test eax, eax
je 0x140036f03
mov r14, qword [rsp + 0x58]
jmp 0x14000f2da
test eax, eax
je 0x140036f6f
xor r14d, r14d
jmp 0x14000f5dd
mov rax, qword [rdx + 0x80]
test rax, rax
je 0x14000f960
cmp dword [rax + 0x70], 0
je 0x14000f6fc
cmp rsi, qword [rcx + 0x80]
jne 0x14000f977
mov rsi, rcx
mov rdx, rcx
mov rcx, rdi
call fcn.140011f08
mov rax, qword [rsi + 0x88]
mov dword [rax + 0x70], 1
mov rax, qword [rsi + 0x88]
mov rcx, qword [rax + 0x88]
mov dword [rcx + 0x70], r14d
mov rdx, qword [rsi + 0x88]
mov rdx, qword [rdx + 0x88]
mov rcx, rdi
call fcn.140011e88
jmp 0x14000f72a
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.140011c8c
cmp dword [rax + 8], 0
jne 0x14000f53b
jmp 0x14000f506
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.140011c8c
cmp dword [rax + 8], 0
jne 0x14000f5af
jmp 0x14000f575
mov qword [rax + 0x88], rcx
jmp 0x14000f8e8
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140011c8c
cmp dword [rax + 8], 0
jne 0x14000f698
jmp 0x14000f661
mov qword [rdi], rdx
mov qword [rdx + 0x78], rcx
mov qword [rcx + 0x88], rdx
jmp 0x14000f72a
mov rsi, qword [rsp + 0x48]
xor r14d, r14d
test eax, eax
jne 0x14000f62f
mov rdi, qword [rsp + 0x40]
mov qword [r13 + 0x78], rsi
jmp 0x14000f6bc
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov ebx, r14d
jmp 0x14000f176
mov qword [rdi], rsi
jmp 0x14000f6bc
mov qword [rax + 0x78], rdx
mov qword [rdx + 0x78], rcx
mov qword [rcx + 0x88], rdx
jmp 0x14000f72a
lea rcx, [rbp + 0xb0]
call fcn.140011e14
mov eax, r14d
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.14002c960
mov rbx, qword [rsp + 0x4d8]
add rsp, 0x480
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop
cmp eax, 2
je 0x14000fa6f
test eax, eax
jg 0x1400370f3
mov r14d, eax
jmp 0x14000fa6f
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov ebx, r14d
jmp 0x14000f176
mov r14, qword [rsp + 0x58]
jmp 0x14000f604
mov rsi, rbx
mov qword [rsp + 0x48], rbx
mov rdi, qword [rsp + 0x40]
jmp 0x14000f2b3
mov rdx, rsi
mov rcx, rdi
call fcn.1400242a8
mov rbx, rax
test rax, rax
je 0x140036f48
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140024204
test al, al
je 0x140036f48
mov rsi, rbx
jmp 0x140036f1f
test rsi, rsi
je 0x14000f370
lea rcx, [rsi + 0x38]
call fcn.140025a78
lea rdx, [rbp - 0x60]
lea rcx, [rsi + 0x38]
call fcn.140024cec
xor r14d, r14d
jmp 0x14000f750
xor r14d, r14d
jmp 0x14000f5bc
mov rsi, qword [rsp + 0x48]
xor r14d, r14d
jmp 0x14000f62f
mov rsi, rcx
mov rdx, rcx
mov rcx, rdi
call fcn.140011e88
nop
jmp 0x14000f891
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140002c98.0]
nop
jmp 0x14000f78d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140002c98.0]
nop
jmp 0x14000f7a9
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140002c98.0]
nop
jmp 0x14000f7da
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140002c98.0]
nop
jmp 0x14000f812
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140002c98.0]
nop
jmp 0x14000f82d
call qword [sym.imp.msvcrt.dll_free]
nop
jmp 0x14000f120
mov ecx, 0x80070057
call fcn.1400450dc
int3
mov ecx, 0x80070057
call fcn.1400450dc
int3
mov ecx, 0x80070057
call fcn.1400450dc
int3
mov ecx, 0x80070057
call fcn.1400450dc
int3
mov ecx, 0x80070057
call fcn.1400450dc
int3
mov ecx, 0x80070057
call fcn.1400450dc
int3
mov ecx, 0x80070057
call fcn.1400450dc
int3
mov ecx, 0x80070057
call fcn.1400450dc
int3
mov ecx, 0x80070057
call fcn.1400450dc
int3
mov ecx, 0x80070057
call fcn.1400450dc
int3
mov ecx, 0x80070057
call fcn.1400450dc
int3
mov ecx, 0x80070057
call fcn.1400450dc
int3
mov ecx, 0x80070057
call fcn.1400450dc
int3
mov ecx, 0x80070057
call fcn.1400450dc
int3
mov ecx, 0x80070057
call fcn.1400450dc
nop
mov ecx, 0x80004005
call fcn.1400450dc
nop
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jg 0x1400370d1
mov r14d, eax
jmp 0x1400370dc
movzx r14d, ax
or r14d, 0x80070000
lea rcx, [rbp - 0x10]
call fcn.140011e14
nop
jmp 0x14000fa6f
test eax, eax
jle 0x140036ee8
movzx r14d, ax
or r14d, 0x80070000
jmp 0x14000fa6f