Function at 0x14010f290
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x9b0
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x9a0], rax
xor ebp, ebp
mov r14, rcx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x340]
mov rdi, rbp
mov r13, rbp
mov r15d, ebp
mov dword [rsp + 0x30], ebp
call fcn.140177280
lea rcx, [rsp + 0x460]
call fcn.140177280
lea r8, [rsp + 0x586]
mov r9d, 0x101
xor edx, edx
mov rcx, 0xffffffff80000000
mov r12d, ebp
mov word [rsp + 0x580], 0x66
mov word [rsp + 0x582], 0x6f
mov word [rsp + 0x584], 0x6f
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
je 0x14010f4ac
nop
nop
test eax, eax
jne 0x14010f475
cmp word [rsp + 0x586], 0x2e
jne 0x14010f475
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x790]
lea rdx, [rsp + 0x586]
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x34], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x14010f475
cmp word [rsp + 0x790], 0x2e
je 0x14010f475
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x790]
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x38], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x14010f475
cmp word [rsp + 0x80], bp
je 0x14010f475
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x340]
call fcn.140178050
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x460]
call fcn.140178050
mov r14, qword [rsp + 0x468]
mov rsi, qword [rsp + 0x348]
mov ecx, 0x38
call fcn.1400cf700
cmp byte [rsi], bpl
mov rdx, rsi
mov rbx, rax
je 0x14010f430
add rdx, 1
cmp byte [rdx], bpl
jne 0x14010f427
sub edx, esi
mov rcx, rsi
mov dword [rax + 8], edx
call fcn.14016dca0
mov rcx, r14
mov qword [rbx], rax
call fcn.14016dcf0
test rdi, rdi
mov qword [rbx + 0x10], rbp
mov dword [rbx + 0x18], ebp
mov qword [rbx + 0x20], rax
mov eax, dword [0x14020e268]
mov dword [rbx + 0x28], eax
je 0x14010f467
mov qword [r13 + 0x30], rbx
jmp 0x14010f46a
mov rdi, rbx
mov qword [rbx + 0x30], rbp
mov r13, rbx
add r15d, 1
add r12d, 1
lea r8, [rsp + 0x586]
mov r9d, 0x101
mov edx, r12d
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x14010f340
mov r14, qword [rsp + 0x40]
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x460]
call fcn.14017d580
lea rcx, [rsp + 0x340]
call fcn.14017d580
test r15d, r15d
je 0x14010f7a2
movsxd rcx, r15d
shl rcx, 3
call fcn.1400cf700
test rdi, rdi
mov rsi, rax
mov rcx, rax
je 0x14010f500
nop
nop
nop
mov qword [rcx], rdi
mov rdi, qword [rdi + 0x30]
add rcx, 8
test rdi, rdi
jne 0x14010f4f0
lea r8, [0x14010f1b0]
mov edx, r15d
mov rcx, rax
call fcn.1400e2e20
test r15d, r15d
mov rbx, rbp
jle 0x14010f603
mov edi, r15d
test rbx, rbx
je 0x14010f574
mov rax, qword [rsi + rbx*8]
mov r9, qword [rsi + rbx*8 - 8]
mov r10d, dword [r9 + 8]
mov r11d, dword [rax + 8]
mov rcx, qword [rax]
cmp r11d, r10d
mov r8d, r10d
cmovl r8d, r11d
test r8d, r8d
je 0x14010f566
mov r9, qword [r9]
sub r9, rcx
nop
movzx eax, byte [r9 + rcx]
movzx edx, byte [rcx]
sub edx, eax
jne 0x14010f56c
add rcx, 1
sub r8d, 1
jne 0x14010f550
mov edx, r11d
sub edx, r10d
test edx, edx
je 0x14010f5f5
mov rcx, qword [rsi + rbx*8]
lea r8, [rsp + 0x80]
mov r9d, 0x2b8
mov rcx, qword [rcx + 0x20]
mov edx, 0x80
mov dword [rsp + 0x20], 0x4411
call fcn.1400daf70
test rax, rax
je 0x14010f5f5
lea rcx, [rsp + 0x298]
call fcn.140176720
mov rcx, qword [rsi + rbx*8]
mov qword [rcx + 0x10], rax
mov rax, qword [rsi + rbx*8]
mov rdx, qword [rax + 0x10]
mov rcx, rdx
cmp byte [rdx], bpl
je 0x14010f5cf
add rcx, 1
cmp byte [rcx], bpl
jne 0x14010f5c6
sub ecx, edx
mov dword [rax + 0x18], ecx
mov rcx, qword [rsi + rbx*8]
mov eax, dword [rsp + 0x88]
mov dword [rcx + 0x28], eax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14010f5f5
call qword [sym.imp.USER32.dll_DestroyIcon]
add rbx, 1
sub rdi, 1
jne 0x14010f521
lea r8, [0x14010f200]
mov edx, r15d
mov rcx, rsi
call fcn.1400e2e20
lea rcx, [rsp + 0x80]
call fcn.140177280
mov rcx, qword [r14 + 0x10]
mov edx, 0x41f
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [rsp + 0x30]
test edi, edi
mov r15, rax
jle 0x14010f749
mov r14, rdi
test rbp, rbp
je 0x14010f6d1
mov rdx, qword [rsi + rbp*8]
mov rcx, qword [rsi + rbp*8 - 8]
lea rbx, [0x1401b0f62]
mov rax, qword [rdx + 0x10]
mov r12d, dword [rcx + 0x18]
mov r13d, dword [rdx + 0x18]
test rax, rax
lea rdi, [0x1401b0f62]
mov r9d, r12d
cmovne rbx, rax
mov rax, qword [rcx + 0x10]
mov edx, r13d
test rax, rax
mov rcx, rbx
cmovne rdi, rax
mov r8, rdi
call fcn.14000db80
test eax, eax
mov r11d, eax
jne 0x14010f6cc
cmp r13d, r12d
mov ecx, r12d
cmovl ecx, r13d
test ecx, ecx
je 0x14010f6c6
sub rdi, rbx
nop
nop
movzx eax, byte [rdi + rbx]
movzx r11d, byte [rbx]
sub r11d, eax
jne 0x14010f6cc
add rbx, 1
sub ecx, 1
jne 0x14010f6b0
mov r11d, r13d
sub r11d, r12d
test r11d, r11d
je 0x14010f732
mov rdx, qword [rsi + rbp*8]
cmp dword [rdx + 0x18], 0
je 0x14010f732
mov rdx, qword [rdx + 0x10]
lea rcx, [rsp + 0x80]
call fcn.14017d850
mov rcx, qword [rsi + rbp*8]
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x48], 7
mov qword [rsp + 0x50], 0xffffffffffffffff
mov eax, dword [rcx + 0x28]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x64], eax
mov eax, dword [rcx + 0x28]
mov edx, 0x40b
mov rcx, r15
mov dword [rsp + 0x68], eax
call qword [sym.imp.USER32.dll_SendMessageW]
add rbp, 1
sub r14, 1
jne 0x14010f643
mov edi, dword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
lea rcx, [rsp + 0x80]
call fcn.14017d580
test edi, edi
jle 0x14010f79a
mov rbx, rsi
nop
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14010f771
call fcn.1400cf780
mov rcx, qword [rbx]
mov rcx, qword [rcx + 0x20]
call fcn.1400cf780
mov rcx, qword [rbx]
mov rcx, qword [rcx]
call fcn.1400cf780
mov rcx, qword [rbx]
call fcn.1400cf780
add rbx, 8
sub rdi, 1
jne 0x14010f760
mov rcx, rsi
call fcn.1400cf780
mov dword [r14 + 0x28], 1
mov rcx, qword [rsp + 0x9a0]
xor rcx, rsp
call fcn.1401a8fb0
lea r11, [rsp + 0x9b0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret