Function at 0x1400fd620
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x9b0
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x9a0], rax
xor ebp, ebp
mov r14, rcx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x340]
mov rdi, rbp
mov r13, rbp
mov r15d, ebp
mov dword [rsp + 0x30], ebp
call fcn.1401617b0
lea rcx, [rsp + 0x460]
call fcn.1401617b0
lea r8, [rsp + 0x586]
mov r9d, 0x101
xor edx, edx
mov rcx, 0xffffffff80000000
mov r12d, ebp
mov word [rsp + 0x580], 0x66
mov word [rsp + 0x582], 0x6f
mov word [rsp + 0x584], 0x6f
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
je 0x1400fd83c
nop
nop
test eax, eax
jne 0x1400fd805
cmp word [rsp + 0x586], 0x2e
jne 0x1400fd805
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x790]
lea rdx, [rsp + 0x586]
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x34], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1400fd805
cmp word [rsp + 0x790], 0x2e
je 0x1400fd805
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x790]
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x38], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1400fd805
cmp word [rsp + 0x80], bp
je 0x1400fd805
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x340]
call fcn.140162580
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x460]
call fcn.140162580
mov r14, qword [rsp + 0x468]
mov rsi, qword [rsp + 0x348]
mov ecx, 0x38
call fcn.1400be650
cmp byte [rsi], bpl
mov rdx, rsi
mov rbx, rax
je 0x1400fd7c0
add rdx, 1
cmp byte [rdx], bpl
jne 0x1400fd7b7
sub edx, esi
mov rcx, rsi
mov dword [rax + 8], edx
call fcn.140158530
mov rcx, r14
mov qword [rbx], rax
call fcn.140158580
test rdi, rdi
mov qword [rbx + 0x10], rbp
mov dword [rbx + 0x18], ebp
mov qword [rbx + 0x20], rax
mov eax, dword [0x1401f3838]
mov dword [rbx + 0x28], eax
je 0x1400fd7f7
mov qword [r13 + 0x30], rbx
jmp 0x1400fd7fa
mov rdi, rbx
mov qword [rbx + 0x30], rbp
mov r13, rbx
add r15d, 1
add r12d, 1
lea r8, [rsp + 0x586]
mov r9d, 0x101
mov edx, r12d
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x1400fd6d0
mov r14, qword [rsp + 0x40]
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x460]
call fcn.140001150
lea rcx, [rsp + 0x340]
call fcn.140001150
test r15d, r15d
je 0x1400fdb32
movsxd rcx, r15d
shl rcx, 3
call fcn.1400be650
test rdi, rdi
mov rsi, rax
mov rcx, rax
je 0x1400fd890
nop
nop
nop
mov qword [rcx], rdi
mov rdi, qword [rdi + 0x30]
add rcx, 8
test rdi, rdi
jne 0x1400fd880
lea r8, [0x1400fd540]
mov edx, r15d
mov rcx, rax
call fcn.1400d1bc0
test r15d, r15d
mov rbx, rbp
jle 0x1400fd993
mov edi, r15d
test rbx, rbx
je 0x1400fd904
mov rax, qword [rsi + rbx*8]
mov r9, qword [rsi + rbx*8 - 8]
mov r10d, dword [r9 + 8]
mov r11d, dword [rax + 8]
mov rcx, qword [rax]
cmp r11d, r10d
mov r8d, r10d
cmovl r8d, r11d
test r8d, r8d
je 0x1400fd8f6
mov r9, qword [r9]
sub r9, rcx
nop
movzx eax, byte [r9 + rcx]
movzx edx, byte [rcx]
sub edx, eax
jne 0x1400fd8fc
add rcx, 1
sub r8d, 1
jne 0x1400fd8e0
mov edx, r11d
sub edx, r10d
test edx, edx
je 0x1400fd985
mov rcx, qword [rsi + rbx*8]
lea r8, [rsp + 0x80]
mov r9d, 0x2b8
mov rcx, qword [rcx + 0x20]
mov edx, 0x80
mov dword [rsp + 0x20], 0x4411
call fcn.1400c9ec0
test rax, rax
je 0x1400fd985
lea rcx, [rsp + 0x298]
call fcn.140160c50
mov rcx, qword [rsi + rbx*8]
mov qword [rcx + 0x10], rax
mov rax, qword [rsi + rbx*8]
mov rdx, qword [rax + 0x10]
mov rcx, rdx
cmp byte [rdx], bpl
je 0x1400fd95f
add rcx, 1
cmp byte [rcx], bpl
jne 0x1400fd956
sub ecx, edx
mov dword [rax + 0x18], ecx
mov rcx, qword [rsi + rbx*8]
mov eax, dword [rsp + 0x88]
mov dword [rcx + 0x28], eax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400fd985
call qword [sym.imp.USER32.dll_DestroyIcon]
add rbx, 1
sub rdi, 1
jne 0x1400fd8b1
lea r8, [0x1400fd590]
mov edx, r15d
mov rcx, rsi
call fcn.1400d1bc0
lea rcx, [rsp + 0x80]
call fcn.1401617b0
mov rcx, qword [r14 + 0x10]
mov edx, 0x41f
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [rsp + 0x30]
test edi, edi
mov r15, rax
jle 0x1400fdad9
mov r14, rdi
test rbp, rbp
je 0x1400fda61
mov rdx, qword [rsi + rbp*8]
mov rcx, qword [rsi + rbp*8 - 8]
lea rbx, [0x14019aef2]
mov rax, qword [rdx + 0x10]
mov r12d, dword [rcx + 0x18]
mov r13d, dword [rdx + 0x18]
test rax, rax
lea rdi, [0x14019aef2]
mov r9d, r12d
cmovne rbx, rax
mov rax, qword [rcx + 0x10]
mov edx, r13d
test rax, rax
mov rcx, rbx
cmovne rdi, rax
mov r8, rdi
call fcn.14000d960
test eax, eax
mov r11d, eax
jne 0x1400fda5c
cmp r13d, r12d
mov ecx, r12d
cmovl ecx, r13d
test ecx, ecx
je 0x1400fda56
sub rdi, rbx
nop
nop
movzx eax, byte [rdi + rbx]
movzx r11d, byte [rbx]
sub r11d, eax
jne 0x1400fda5c
add rbx, 1
sub ecx, 1
jne 0x1400fda40
mov r11d, r13d
sub r11d, r12d
test r11d, r11d
je 0x1400fdac2
mov rdx, qword [rsi + rbp*8]
cmp dword [rdx + 0x18], 0
je 0x1400fdac2
mov rdx, qword [rdx + 0x10]
lea rcx, [rsp + 0x80]
call fcn.140167a80
mov rcx, qword [rsi + rbp*8]
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x48], 7
mov qword [rsp + 0x50], 0xffffffffffffffff
mov eax, dword [rcx + 0x28]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x64], eax
mov eax, dword [rcx + 0x28]
mov edx, 0x40b
mov rcx, r15
mov dword [rsp + 0x68], eax
call qword [sym.imp.USER32.dll_SendMessageW]
add rbp, 1
sub r14, 1
jne 0x1400fd9d3
mov edi, dword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
lea rcx, [rsp + 0x80]
call fcn.140001150
test edi, edi
jle 0x1400fdb2a
mov rbx, rsi
nop
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x1400fdb01
call fcn.1400be6d0
mov rcx, qword [rbx]
mov rcx, qword [rcx + 0x20]
call fcn.1400be6d0
mov rcx, qword [rbx]
mov rcx, qword [rcx]
call fcn.1400be6d0
mov rcx, qword [rbx]
call fcn.1400be6d0
add rbx, 8
sub rdi, 1
jne 0x1400fdaf0
mov rcx, rsi
call fcn.1400be6d0
mov dword [r14 + 0x28], 1
mov rcx, qword [rsp + 0x9a0]
xor rcx, rsp
call fcn.1401931f0
lea r11, [rsp + 0x9b0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret