Function at 0x140059310
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x448]
sub rsp, 0x548
mov rax, qword [0x14033e810]
xor rax, rsp
mov qword [rbp + 0x430], rax
mov r12, r9
mov qword [rbp - 0x28], r9
mov rbx, r8
mov rdi, rcx
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x78], rdx
mov rsi, qword [rbp + 0x4b0]
mov qword [rbp - 0x30], rsi
mov rdx, qword [rbp + 0x4b8]
mov qword [rbp - 0x38], rdx
mov rcx, qword [rbp + 0x4c0]
mov qword [rbp - 0x40], rcx
mov rax, qword [rbp + 0x4c8]
mov qword [rbp - 0x48], rax
mov r14, qword [rbp + 0x4d8]
mov qword [rbp - 0x50], r14
xor r13d, r13d
mov dword [rbp - 0x6c], r13d
test rcx, rcx
je 0x1400599d3
cmp qword [rdx + 0x10], r13
je 0x1400599d3
mov rcx, qword [rdi + 8]
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400599d3
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x220]
call fcn.140241ba0
mov dword [rbp - 0x60], 0x104
mov dword [rsp + 0x70], r13d
xor eax, eax
mov ecx, dword [rbp + 0x4e0]
test ecx, ecx
setne al
inc eax
mov dword [rbp - 0x6c], eax
mov eax, 0x20219
mov r9d, 0x20119
test ecx, ecx
cmove r9d, eax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400599d3
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x220]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x1400599c2
cmp dword [rbp + 0x4e8], r13d
je 0x1400599c2
xor r15d, r15d
mov dword [rbp - 0x70], r15d
test eax, eax
je 0x1400599c2
mov rcx, qword [rdi + 8]
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400599d3
cmp dword [rbp + 0x4f0], 0
je 0x1400599c2
mov dword [rbp - 0x5c], 0x104
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x5c]
lea r8, [rbp + 0x10]
mov edx, r15d
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400599b0
test r14, r14
je 0x14005954d
xor edi, edi
xor ebx, ebx
mov rcx, qword [r14 + 0x10]
test rcx, rcx
jle 0x14005954d
nop
test rbx, rbx
js 0x140059a03
cmp rbx, rcx
jge 0x140059a03
mov rax, qword [r14 + 8]
mov rdx, qword [rax + rbx*8]
lea rcx, [rbp + 0x10]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x1400599ac
inc edi
inc rbx
mov rcx, qword [r14 + 0x10]
movsxd rax, edi
cmp rax, rcx
jl 0x140059510
lea rdx, [0x1402ed690]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrCatW]
lea rdx, [rbp + 0x10]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrCatW]
lea rdx, [0x1402ed690]
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrCatW]
lea rdx, [rbp + 0x10]
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrCatW]
lea rcx, [rbp - 0x18]
call fcn.1400a64e0
nop
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x18]
call fcn.1400a659c
xor r12d, r12d
call fcn.1400a2364
nop
test rax, rax
je 0x1400599f8
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
test rsi, rsi
je 0x1400595f0
cmp rsi, 0x10000
jae 0x1400595dd
movzx edx, si
lea rcx, [rbp - 0x80]
call fcn.14000d610
jmp 0x140059602
mov rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], 0
jne 0x1400595e4
jmp 0x1400595f2
xor eax, eax
mov r8d, eax
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.14000df90
nop
mov rsi, qword [rbp - 0x80]
lea r15, [rsi - 0x18]
movsxd rax, dword [r15 + 8]
lea rbx, [rsi + rax*2]
cmp rsi, rbx
jae 0x14005965e
lea rdx, [0x1402ed690]
mov rcx, rsi
call fcn.1402519d8
mov rdi, rax
movsxd rcx, eax
lea rcx, [rsi + rcx*2]
cmp rcx, rbx
jae 0x14005965e
lea rdx, [0x1402ed690]
call fcn.140251a1c
lea r14d, [rax + 1]
add r14d, edi
mov r9d, eax
mov r8d, edi
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x80]
call fcn.140029da0
jmp 0x1400596a2
mov r14d, 0xffffffff
mov rcx, qword [r15]
test rcx, rcx
je 0x140059677
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140059687
call fcn.1400a2364
nop
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
nop
test rax, rax
je 0x140059a25
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
or r13d, 1
nop word [rax + rax]
mov rax, qword [rsp + 0x78]
cmp word [rax], 0
je 0x1400598d3
xor edi, edi
xor ebx, ebx
mov rcx, qword [rbp - 8]
test rcx, rcx
jle 0x14005972e
nop dword [rax]
test rbx, rbx
js 0x140059a09
cmp rbx, rcx
jge 0x140059a09
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + rbx*8]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14005970c
inc edi
inc rbx
movsxd rax, edi
mov rcx, qword [rbp - 8]
cmp rax, rcx
jl 0x1400596d0
jmp 0x14005972e
inc r12d
movsxd rdx, edi
mov r8d, 1
lea rcx, [rbp - 0x18]
call fcn.1400a668c
cmp r12d, dword [rbp + 0x4d0]
je 0x14005986d
test r14d, r14d
js 0x140059a1a
movsxd rax, r14d
lea rbx, [rsi + rax*2]
movsxd rax, dword [r15 + 8]
lea rdi, [rsi + rax*2]
cmp rbx, rdi
jae 0x140059796
lea rdx, [0x1402ed690]
mov rcx, rbx
call fcn.1402519d8
mov rsi, rax
movsxd rcx, eax
lea rcx, [rbx + rcx*2]
cmp rcx, rdi
jae 0x140059796
lea rdx, [0x1402ed690]
call fcn.140251a1c
lea r8d, [rsi + r14]
lea r14d, [rax + 1]
add r14d, r8d
mov r9d, eax
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x80]
call fcn.140029da0
mov rax, qword [rbp - 0x68]
jmp 0x1400597d9
mov r14d, 0xffffffff
mov rcx, qword [r15]
test rcx, rcx
je 0x1400597af
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x1400597bf
call fcn.1400a2364
nop
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
nop
test rax, rax
je 0x140059a0f
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x68], rax
or r13d, 2
lea r8, [rax - 0x18]
mov rbx, qword [rsp + 0x78]
add rbx, 0xffffffffffffffe8
cmp r8, rbx
je 0x140059848
mov edx, dword [rbx + 0x10]
shr edx, 0x1f
test dl, dl
jne 0x140059833
mov rdx, qword [rbx]
cmp qword [r8], rdx
jne 0x140059833
mov rcx, r8
call fcn.14000de80
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140059828
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x78], rax
jmp 0x140059844
mov r8d, dword [rax - 0x10]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14000df90
mov rax, qword [rbp - 0x68]
lea rdx, [rax - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140059864
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rbp - 0x80]
jmp 0x1400596b0
mov r12, qword [rbp - 0x28]
mov rdx, r12
mov rcx, qword [rbp - 0x40]
call fcn.140055020
mov rcx, rax
test rax, rax
je 0x1400598b9
mov eax, dword [rbp - 0x6c]
mov dword [rcx + 0x20], eax
mov eax, dword [rcx + 0x24]
test eax, eax
je 0x1400598a0
cmp eax, 2
jne 0x1400598b9
mov dword [rcx + 0x24], 5
jmp 0x1400598b9
mov rax, qword [rcx + 0x28]
cmp qword [rax + 0x18], 0
jne 0x1400598b9
cmp qword [rcx + 8], 0
jne 0x1400598b9
mov dword [rcx + 0x24], 1
dec dword [rbp + 0x4f0]
mov rdi, qword [rbp - 0x48]
inc dword [rdi]
mov rsi, qword [rbp - 0x30]
mov r14, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x58]
jmp 0x14005994d
mov eax, dword [rbp + 0x4e8]
dec eax
mov dword [rsp + 0x68], 1
mov ecx, dword [rbp + 0x4f0]
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rbp + 0x4e0]
mov dword [rsp + 0x50], eax
mov r14, qword [rbp - 0x50]
mov qword [rsp + 0x48], r14
mov eax, dword [rbp + 0x4d0]
mov dword [rsp + 0x40], eax
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x28], rax
mov rsi, qword [rbp - 0x30]
mov qword [rsp + 0x20], rsi
mov r12, qword [rbp - 0x28]
mov r9, r12
lea r8, [rbp + 0x10]
mov rdx, qword [rbp - 0x78]
mov rdi, qword [rbp - 0x58]
mov rcx, rdi
call fcn.140059310
mov rdx, r12
call fcn.14005a250
mov rdx, rsi
call fcn.14005a250
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140059980
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, 0xffffffff
lock xadd dword [r15 + 0x10], eax
sub eax, 1
jg 0x14005999d
mov rcx, qword [r15]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x18]
call fcn.1400a6500
mov r15d, dword [rbp - 0x70]
jmp 0x1400599b0
mov rdi, qword [rbp - 0x58]
inc r15d
mov dword [rbp - 0x70], r15d
cmp r15d, dword [rsp + 0x70]
jb 0x140059490
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1400599d5
xor eax, eax
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.1402155d0
add rsp, 0x548
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400080b0
nop
call fcn.1400a2cd8
nop
call fcn.1400a2cd8
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80070057
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
int3