Function at 0x1400b4694
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x220]
mov eax, 0x320
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov r12, rdx
mov r14, rcx
xor r13d, r13d
mov qword [rcx], r13
mov qword [rcx + 8], r13
mov qword [rcx + 0x10], r13
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov r15d, r13d
mov qword [rsp + 0x58], r13
mov dword [rbp - 0x70], 1
lea rax, vtable.Mso::Registry::Key.0
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], r13
mov byte [rbp - 0x60], 1
lea rcx, [rbp - 0x78]
call fcn.1400bd160
mov r8, rax
xor edx, edx
mov rcx, r12
call fcn.1400b64b0
test eax, eax
jne 0x1400b4a75
mov esi, r13d
mov ebx, 0x1000
mov rdi, qword [rsp + 0x50]
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x10]
mov edx, esi
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0xea
jne 0x1400b48ba
lea rax, [0x140279280]
mov qword [rsp + 0x68], rax
lea rax, str.KeyLength
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x78], eax
mov word [rsp + 0x7c], r13w
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, str.Long_named_key_encountered.
mov edx, 0x3a7
mov ecx, 0x2001814
mov r8d, 0xf
call fcn.1400b4bc8
mov ecx, dword [rsp + 0x40]
lea eax, [rcx + 1]
mov dword [rsp + 0x60], eax
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], 7
mov edx, ecx
test ecx, ecx
jne 0x1400b47fa
mov qword [rbp - 0x20], rcx
mov word [rbp + rcx*2 - 0x30], r13w
jmp 0x1400b4806
xor r8d, r8d
lea rcx, [rbp - 0x30]
call fcn.14000aabc
lea r8, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r8, qword [rbp - 0x30]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x60]
mov edx, esi
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400b4acc
cmp rdi, r15
je 0x1400b485d
lea rdx, [rbp - 0x30]
mov rcx, rdi
call fcn.14000ad78
add rdi, 0x20
mov qword [rsp + 0x50], rdi
jmp 0x1400b4878
lea r8, [rbp - 0x30]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140023f3c
mov r15, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov rax, qword [rbp - 0x18]
cmp rax, 8
jb 0x1400b4971
mov rcx, qword [rbp - 0x30]
mov rdx, rcx
lea rax, [rax*2 + 2]
cmp rax, rbx
jb 0x1400b496b
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400b496b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test eax, eax
jne 0x1400b49b5
mov edx, dword [rsp + 0x40]
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], 7
lea rcx, [rbp - 0x58]
cmp rdx, 7
ja 0x1400b4901
mov qword [rbp - 0x48], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memmove
mov word [rbp + rbx - 0x58], r13w
mov ebx, 0x1000
jmp 0x1400b490a
lea r9, [rbp + 0x10]
call fcn.14000b820
cmp qword [rbp - 0x48], r13
je 0x1400b4979
mov rax, qword [r14 + 8]
cmp rax, qword [r14 + 0x10]
je 0x1400b492d
lea rdx, [rbp - 0x58]
mov rcx, rax
call fcn.14000ad78
add qword [r14 + 8], 0x20
jmp 0x1400b493c
lea r8, [rbp - 0x58]
mov rdx, rax
mov rcx, r14
call fcn.140023f3c
mov rax, qword [rbp - 0x40]
cmp rax, 8
jb 0x1400b4971
mov rcx, qword [rbp - 0x58]
mov rdx, rcx
lea rax, [rax*2 + 2]
cmp rax, rbx
jb 0x1400b496b
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x1400b49a8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc rsi
jmp 0x1400b4734
mov rax, qword [rbp - 0x40]
cmp rax, 8
jb 0x1400b49b5
mov rcx, qword [rbp - 0x58]
mov rdx, rcx
lea rax, [rax*2 + 2]
cmp rax, rbx
jb 0x1400b49af
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400b49af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x48]
jmp 0x1400b4a6c
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400b49cc
mov r8, qword [rbx]
or r9, 0xffffffffffffffff
inc r9
cmp word [r8 + r9*2], r13w
jne 0x1400b49d0
test r9, r9
je 0x1400b4b66
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
mov byte [rbp + 8], r13b
lea rax, [rbp - 0x30]
mov qword [rbp - 8], rax
mov rdx, r12
lea rcx, [rbp - 0x30]
call fcn.1400b3b2c
mov al, byte [rbp + 8]
neg al
sbb rsi, rsi
lea rax, [rbp - 0x18]
and rsi, rax
mov rcx, rsi
call fcn.1400bb32c
test eax, eax
jne 0x1400b4a43
test rsi, rsi
jne 0x1400b4a37
mov eax, QueryPathOfRegTypeLib
jmp 0x1400b4a3f
mov rcx, rsi
call fcn.1400bb1fc
test eax, eax
je 0x1400b4a5f
lea r9, str.Failed_to_remove_long_named_key.
mov edx, 0x3a7
mov ecx, 0x2001817
mov r8d, 0xa
call fcn.14023a254
lea rcx, [rbp - 0x30]
call fcn.1400b3e18
add rbx, 0x20
cmp rbx, rdi
jne 0x1400b49bf
lea rax, vtable.Mso::Registry::Key.0
mov qword [rbp - 0x78], rax
cmp byte [rbp - 0x60], r13b
je 0x1400b4a95
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b4a95
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x48]
call fcn.14002b134
mov rax, r14
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.14024c6d0
mov rbx, qword [rsp + 0x370]
add rsp, 0x320
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140279258]
mov qword [rsp + 0x68], rcx
lea rcx, [0x140289130]
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x78], eax
mov word [rsp + 0x7c], r13w
xor r9d, r9d
mov edi, 0x3a7
lea r8d, [r9 + 0xa]
mov edx, edi
mov ebx, 0x2001815
mov ecx, ebx
call fcn.140239eb0
test al, al
je 0x1400b4b59
lea rax, [rsp + 0x68]
mov qword [rbp - 0x80], rax
lea rax, vtable.Mso::Logging::CompositeStructuredTrace.0
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x58], rax
xor r9d, r9d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, str.Failed_to_get_the_key_name.
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0xa]
mov edx, edi
mov ecx, ebx
call fcn.14023a0ec
xor edx, edx
mov ecx, 0x2001816
call fcn.1400b3928
int3
xor edx, edx
mov ecx, 0x178525c
call fcn.1400b3928
int3