Function at 0x14001dc1c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x698]
sub rsp, 0x770
mov rax, qword [0x140001200]
xor rax, rsp
mov qword [rbp + 0x660], rax
mov r14, rdx
mov qword [rbp - 0x50], rdx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rdx], xmm0
mov qword [rdx], r12
mov qword [rdx + 8], r12
mov qword [rdx + 0x10], r12
lea r13d, [r12 + 1]
mov dword [rsp + 0x40], r13d
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x14000eb28]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001e385
mov dword [rbp - 0x34], 0x104
mov ebx, r13d
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x34]
lea r8, [rbp + 0x150]
xor edx, edx
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14001e37b
lea r15d, [r12 + 0xf]
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
mov r8d, 0x3d
lea rdx, [0x14000eb28]
lea rcx, [rbp - 0x70]
call fcn.140016368
nop
mov r8d, 1
lea rdx, [0x14000eb70]
lea rcx, [rbp - 0x70]
call fcn.140014e60
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
vmovups ymm0, ymmword [rax]
vmovups ymmword [rsp + 0x70], ymm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r15
mov byte [rax], r12b
or r13d, 4
mov dword [rsp + 0x40], r13d
lea rax, [rbp + 0x150]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r12b
jne 0x14001dd6c
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x70]
vzeroupper
call fcn.140014e60
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
vmovups ymm0, ymmword [rax]
vmovups ymmword [rsp + 0x50], ymm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r15
mov byte [rax], r12b
or r13d, 8
mov dword [rsp + 0x40], r13d
mov r8d, 6
lea rdx, [0x14000eb68]
lea rcx, [rsp + 0x50]
vzeroupper
call fcn.140014e60
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x20], ymm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r15
mov byte [rax], r12b
or r13d, 0x10
mov dword [rsp + 0x40], r13d
mov rdx, qword [rsp + 0x68]
cmp rdx, r15
jbe 0x14001de42
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001de3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e3c4
vzeroupper
call fcn.140022fd0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r15
mov byte [rsp + 0x50], r12b
mov rdx, qword [rbp - 0x78]
cmp rdx, r15
jbe 0x14001de8f
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001de87
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e3cd
vzeroupper
call fcn.140022fd0
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r15
mov byte [rsp + 0x70], r12b
mov rdx, qword [rbp - 0x58]
cmp rdx, r15
jbe 0x14001ded9
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ded1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e3d6
vzeroupper
call fcn.140022fd0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r15
mov byte [rbp - 0x70], r12b
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], r15
cmova rdx, qword [rbp + 0x20]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
vzeroupper
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001e301
mov dword [rbp - 0x38], 0x104
mov dword [rsp + 0x44], 1
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x38]
lea r8, [rbp + 0x40]
xor edx, edx
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x14001e2f7
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], r12
lea rax, [rbp + 0x40]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r12b
jne 0x14001df74
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 8]
call fcn.140016368
nop
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], r15
cmova rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
lea rcx, [rbp - 0x30]
call fcn.140016428
or r13d, 2
mov dword [rsp + 0x40], r13d
lea rsi, [rbp - 0x30]
mov rbx, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x18]
cmp rdi, r15
cmova rsi, rbx
lea r15, [rbp - 0x30]
cmova r15, rbx
mov rcx, qword [rbp - 0x20]
add r15, rcx
cmp rsi, r15
je 0x14001e040
movsx ecx, byte [rsi]
call fcn.14002d740
test eax, eax
je 0x14001e02c
movsx ecx, byte [rsi]
call fcn.14002d8a0
neg eax
sbb cl, cl
and cl, 0xe0
add cl, 0x61
movzx r8d, cl
movsx ecx, byte [rsi]
sub ecx, r8d
add ecx, 0xd
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1a
sub ecx, eax
add cl, r8b
mov byte [rsi], cl
inc rsi
cmp rsi, r15
jne 0x14001dfe6
mov rdi, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x30]
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x14001e087
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e076
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e3df
call fcn.140022fd0
mov rdi, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x30]
lea r15, [rbp - 0x30]
cmp rdi, 0xf
cmova r15, rbx
lea r12, [rbp - 0x30]
cmova r12, rbx
add r12, rcx
lea rsi, [rbp - 0x30]
cmp rdi, 0xf
cmova rsi, rbx
cmp rsi, r12
je 0x14001e0d2
sub r15, rsi
movsx ecx, byte [rsi]
call fcn.14002db18
mov byte [r15 + rsi], al
inc rsi
cmp rsi, r12
jne 0x14001e0b2
mov rdi, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x30]
lea rsi, [rbp - 0x30]
cmp rdi, 0xf
cmova rsi, rbx
cmp rcx, 4
jb 0x14001e12f
lea r15, [rcx + rsi]
lea r8, [r15 - 3]
sub r8, rsi
mov edx, 0x2e
mov rcx, rsi
call fcn.140046540
xor r12d, r12d
jmp 0x14001e120
cmp dword [rax], 0x6578652e
je 0x14001e12a
inc rax
lea r8, [r15 - 3]
sub r8, rax
mov edx, 0x2e
mov rcx, rax
call fcn.140046540
test rax, rax
jne 0x14001e101
jmp 0x14001e276
sub rax, rsi
jmp 0x14001e136
or rax, 0xffffffffffffffff
xor r12d, r12d
cmp rax, 0xffffffffffffffff
je 0x14001e276
mov dword [rbp - 0x10], 0x400
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x40]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001e26e
cmp dword [rbp - 0x10], 0x44
jb 0x14001e26e
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], 0xf
mov byte [rbp - 8], r12b
mov rbx, qword [rbp - 0x20]
lea r9, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova r9, qword [rbp - 0x30]
lea rcx, [rbp - 8]
cmp rbx, 0xf
ja 0x14001e1cd
mov qword [rbp + 8], rbx
mov r8, rbx
mov rdx, r9
call fcn.140045b00
mov byte [rbp + rbx - 8], r12b
jmp 0x14001e1d5
mov rdx, rbx
call fcn.140016d00
mov rax, qword [rbp + 0x29c]
mov qword [rbp + 0x18], rax
mov rbx, qword [r14 + 8]
cmp rbx, qword [r14 + 0x10]
je 0x14001e223
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
mov rcx, rbx
call fcn.140016428
mov rax, qword [rbp + 0x18]
mov qword [rbx + 0x20], rax
add qword [r14 + 8], 0x28
jmp 0x14001e233
lea r8, [rbp - 8]
mov rdx, rbx
mov rcx, r14
call fcn.14001f2ac
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x14001e26e
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e269
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e3e5
call fcn.140022fd0
mov rbx, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x18]
mov dword [rbp - 0x38], 0x104
mov r15d, 0xf
cmp rdi, r15
jbe 0x14001e2b9
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14001e2b1
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e3b8
mov rcx, rbx
call fcn.140022fd0
mov ebx, dword [rsp + 0x44]
mov edx, ebx
inc ebx
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x38]
lea r8, [rbp + 0x40]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x14001df5b
mov ebx, dword [rsp + 0x48]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x34], 0x104
mov rdx, qword [rbp + 0x38]
cmp rdx, r15
jbe 0x14001e342
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e33d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e3be
call fcn.140022fd0
mov edx, ebx
inc ebx
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x34]
lea r8, [rbp + 0x150]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14001dcf3
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, r14
mov rcx, qword [rbp + 0x660]
xor rcx, rsp
call fcn.140022fb0
lea r11, [rsp + 0x770]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14002d6bc
nop
call fcn.14002d6bc
nop
vzeroupper
call fcn.14002d6bc
nop
vzeroupper
call fcn.14002d6bc
nop
vzeroupper
call fcn.14002d6bc
nop
call fcn.14002d6bc
int3
call fcn.14002d6bc
int3