Function at 0x1400497c0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
sub rsp, 0x290
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1406b92c0]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov rbx, rcx
mov qword [rbp + 0xa0], rcx
mov edi, 1
mov dword [rbp + 8], edi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor esi, esi
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov dword [rbp + 8], edi
movabs rax, 0x7628789f924f8650
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x80336d0999ce70a5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x60c15a1c1e9acd5b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x32d74cb964ef333e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0xc2856875c326be7b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x99840b9687d0a9c0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x2414eb598186e4c4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0xb98d93cfc4d40205
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0x9e43ff50832f935b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x99bc8ed297592ee8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x357435dac61cdf03
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0xef701967fcbc02d0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x14a4097071e8b935
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x5eb83ecd0a807062
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0xb9d91b06a24afd27
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xabb332d3b1e3edf4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x1525c66cb3b5a1e9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x94bcd08986f94746
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0xaf069d62b31fab6b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x99bc8eafaf681dd8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqa xmm0, xmmword [rbp + 0x80]
vxorps xmm0, xmm0, xmmword [rbp + 0x100]
vmovdqa xmmword [rbp + 0x80], xmm0
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x40]
mov rcx, 0xffffffff80000002
vzeroupper
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140049b84
mov dword [rbp + 0xb0], 0x80
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0xb0]
lea r8, [rbp + 0x120]
xor edx, edx
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140049b76
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], rsi
lea rax, [rbp + 0x120]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140049ad0
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x10]
call fcn.1400055c0
nop
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140049b1b
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x20]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x10], 0
add qword [rbx + 8], 0x20
jmp 0x140049b28
lea r8, [rbp + 0x10]
mov rcx, rbx
call fcn.140018810
nop
lea rcx, [rbp + 0x10]
call fcn.1400159a0
mov dword [rbp + 0xb0], 0x80
mov edx, edi
inc edi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0xb0]
lea r8, [rbp + 0x120]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x140049ab0
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, rbx
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.14028f750
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret