Function at 0x1400033d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x5e8
xor r12d, r12d
mov qword [rsp + 0x630], rcx
lea rcx, [0x14001a470]
call fcn.140006e10
mov rdi, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r8d, r8d
mov r9d, 0x108
mov r15, rax
lea rax, [rsp + 0xa0]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rdx, r15
call rdi
test eax, eax
jne 0x1400035e2
mov ecx, 0x40000
call fcn.140005de0
mov r12, rax
test rax, rax
je 0x1400035d4
mov byte [rax], 0
lea rcx, [0x14001a4e0]
xor ebx, ebx
lea r13, [rsp + 0x98]
lea rsi, [rsp + 0x1c0]
lea r14, [rsp + 0xa8]
call fcn.140006e10
lea rcx, [0x14001a500]
mov qword [rsp + 0x48], rax
call fcn.140006e10
lea rcx, [0x14001a528]
mov qword [rsp + 0x58], rax
call fcn.140006e10
lea rcx, [0x14001a547]
mov qword [rsp + 0x60], rax
call fcn.140006d90
lea rcx, [0x14001a551]
mov qword [rsp + 0x50], rax
call fcn.140006d90
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x68], rax
jmp 0x1400034c3
add ebx, 1
mov dword [rsp + 0x98], 0x104
mov r9, r13
mov r8, rsi
mov edx, ebx
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140003588
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov r9d, 0x101
mov rdx, rsi
mov rcx, qword [rsp + 0xa0]
call rdi
test eax, eax
jne 0x1400034c0
lea r15, [rsp + 0x9c]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
lea rbp, [rsp + 0x3d0]
mov qword [rsp + 0x28], r15
mov rcx, qword [rsp + 0xa8]
mov dword [rsp + 0x9c], 0x104
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140003608
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400034c0
mov rcx, r12
mov r15, qword [rsp + 0x70]
call sub.msvcrt.dll_strlen
mov rdi, qword [rsp + 0x630]
mov rcx, qword [rsp + 0x68]
add eax, 1
mov dword [rdi], eax
call fcn.140006ea0
mov rcx, qword [rsp + 0x50]
call fcn.140006ea0
mov rcx, qword [rsp + 0x60]
call fcn.140006ea0
mov rcx, qword [rsp + 0x58]
call fcn.140006ea0
mov rcx, qword [rsp + 0x48]
call fcn.140006ea0
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r15
call fcn.140006ea0
mov rax, r12
add rsp, 0x5e8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor edx, edx
mov r9d, 0xffffffff
mov r8, rbp
mov ecx, 0xfde9
mov eax, dword [rsp + 0x9c]
mov byte [rsp + rax + 0x3d0], 0
lea rax, [rsp + 0x3d1]
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x9c]
mov byte [rsp + rax + 0x3d1], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140003744
movsxd rcx, eax
mov dword [rsp + 0x80], eax
call fcn.140005de0
test rax, rax
je 0x140003744
mov edx, dword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rbp
mov qword [rsp + 0x38], 0
mov ecx, 0xfde9
mov dword [rsp + 0x28], edx
xor edx, edx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [r12], 0
mov r10, qword [rsp + 0x80]
je 0x1400036e3
test ebx, ebx
jne 0x140003a10
mov rcx, r10
mov qword [rsp + 0x80], r10
call sub.msvcrt.dll_strlen
mov r10, qword [rsp + 0x80]
lea r9, [rsp + 0xb0]
mov rcx, r9
mov r8d, eax
mov qword [rsp + 0x80], r9
mov rdx, r10
mov qword [rsp + 0x88], r10
call fcn.140001590
mov r9, qword [rsp + 0x80]
mov rcx, r12
mov rdx, r9
call sub.msvcrt.dll_strcat
mov r10, qword [rsp + 0x88]
mov rcx, r10
call fcn.140005e40
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], r15
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rbp
mov rcx, qword [rsp + 0xa8]
mov dword [rsp + 0x9c], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400038c8
mov rdx, qword [rsp + 0x50]
mov rcx, r12
call sub.msvcrt.dll_strcat
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call sub.msvcrt.dll_strcat
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], r15
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rbp
mov rcx, qword [rsp + 0xa8]
mov dword [rsp + 0x9c], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400039f0
mov eax, dword [rsp + 0x9c]
mov rdx, qword [rsp + 0x78]
mov r8, rbp
mov ecx, 0xfde9
mov r9d, 0xffffffff
mov byte [rbp + rax], 0
mov eax, dword [rsp + 0x9c]
mov byte [rax + rdx], 0
xor edx, edx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r15d, eax
test eax, eax
je 0x140003571
movsxd rcx, eax
call fcn.140005de0
test rax, rax
je 0x140003571
mov r9d, 0xffffffff
mov r8, rbp
mov dword [rsp + 0x28], r15d
xor edx, edx
mov qword [rsp + 0x38], 0
mov ecx, 0xfde9
lea r15, [rsp + 0xb0]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, qword [rsp + 0x50]
mov rcx, r12
call sub.msvcrt.dll_strcat
mov r10, qword [rsp + 0x78]
mov rcx, r10
call sub.msvcrt.dll_strlen
mov r10, qword [rsp + 0x78]
mov rcx, r15
mov r8d, eax
mov rdx, r10
call fcn.140001590
mov rcx, r12
mov rdx, r15
call sub.msvcrt.dll_strcat
mov r10, qword [rsp + 0x78]
mov rcx, r10
call fcn.140005e40
jmp 0x140003571
mov eax, dword [rsp + 0x9c]
mov rdx, qword [rsp + 0x78]
mov r8, rbp
mov ecx, 0xfde9
mov r9d, 0xffffffff
mov byte [rbp + rax], 0
mov eax, dword [rsp + 0x9c]
mov byte [rax + rdx], 0
xor edx, edx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140003794
movsxd rcx, eax
mov dword [rsp + 0x80], eax
call fcn.140005de0
test rax, rax
je 0x140003794
mov edx, dword [rsp + 0x80]
mov r8, rbp
mov r9d, 0xffffffff
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov ecx, 0xfde9
mov dword [rsp + 0x28], edx
xor edx, edx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, qword [rsp + 0x50]
mov rcx, r12
call sub.msvcrt.dll_strcat
mov r10, qword [rsp + 0x80]
mov rcx, r10
call sub.msvcrt.dll_strlen
mov r10, qword [rsp + 0x80]
lea r9, [rsp + 0xb0]
mov r8d, eax
mov rcx, r9
mov qword [rsp + 0x80], r9
mov rdx, r10
mov qword [rsp + 0x88], r10
call fcn.140001590
mov r9, qword [rsp + 0x80]
mov rcx, r12
mov rdx, r9
call sub.msvcrt.dll_strcat
mov r10, qword [rsp + 0x88]
mov rcx, r10
call fcn.140005e40
jmp 0x140003794
mov rdx, qword [rsp + 0x50]
mov rcx, r12
call sub.msvcrt.dll_strcat
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call sub.msvcrt.dll_strcat
jmp 0x140003571
mov rdx, qword [rsp + 0x50]
mov rcx, r12
call sub.msvcrt.dll_strcat
mov r10, qword [rsp + 0x80]
jmp 0x1400036e3