Function at 0x140004de0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x4358
call fcn.14005ff70
sub rsp, rax
movaps xmmword [rsp + 0x4340], xmm6
mov rdi, rcx
xor eax, eax
mov dword [rsp + 0xa4], eax
mov dword [rsp + 0xa0], eax
mov dword [rsp + 0xb4], r9d
cmp r9d, 4
jl 0x140004e39
lea rdx, [0x14009f87f]
mov rcx, rdi
call sym._ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8ue170005ILi0EEEPKc
mov rax, rdi
jmp 0x1400056ac
mov r14, rdx
xorps xmm6, xmm6
movups xmmword [rsp + 0x50], xmm6
movups xmmword [rsp + 0x40], xmm6
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x98], r8
xor esi, esi
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0xbc]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa4]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movups xmmword [rdi], xmm6
mov qword [rsp + 0xa8], rdi
mov qword [rdi + 0x10], rsi
test eax, eax
jne 0x1400056a4
cmp dword [rsp + 0xa0], 0
je 0x1400054a0
mov rax, qword [rsp + 0x98]
inc rax
mov qword [rsp + 0xc0], rax
xor r15d, r15d
xorps xmm6, xmm6
lea r12, [rsp + 0x1c0]
lea r13, [rsp + 0xe4]
mov rdi, qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov rsi, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea rbp, [rsp + 0x80]
mov dword [rsp + 0xe4], 0x3fff
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, r14
mov edx, r15d
mov r8, r12
mov r9, r13
call rdi
test eax, eax
jne 0x14000548f
mov dword [rsp + 0x7c], 0
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, r12
xor r8d, r8d
lea r9, [rsp + 0xb8]
call rsi
test eax, eax
jne 0x14000548f
mov edx, dword [rsp + 0x7c]
lea rcx, [rsp + 0x118]
call method.std::__1::vector_unsigned_char__std::__1::allocator_unsigned_char___.vector_unsigned_long_long_
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x340]
mov qword [rsp + 0x20], rax
mov rcx, r14
mov rdx, r12
xor r8d, r8d
lea r9, [rsp + 0xb8]
call rsi
test eax, eax
jne 0x140005475
mov rax, qword [rsp + 0x98]
test byte [rax], 1
mov rdx, qword [rsp + 0xc0]
je 0x140004fb9
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0x100]
call sym._ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8ue170005ILi0EEEPKc
mov edx, dword [rsp + 0xb8]
mov r9d, dword [rsp + 0x7c]
lea rcx, [rsp + 0xc8]
lea r8, [rsp + 0x340]
call sym.FormatRegistryValue_unsigned_long__unsigned_char__unsigned_long_
lea rcx, [rsp + 0xe8]
mov rdx, r12
call sym._ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8ue170005ILi0EEEPKc
lea rcx, [rsp + 0x60]
lea rdx, [0x14009f880]
call sym._ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8ue170005ILi0EEEPKc
mov rcx, rbp
lea rdx, [0x14009f882]
call sym._ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8ue170005ILi0EEEPKc
lea rcx, [rsp + 0xc8]
lea rdx, [rsp + 0x60]
mov r8, rbp
call sym.replaceAll_std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char_____std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char____const__std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char____const_
test byte [rsp + 0x80], 1
je 0x140005043
mov rcx, qword [rsp + 0x90]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0x60], 1
je 0x140005054
mov rcx, qword [rsp + 0x70]
call sym..weak._ZdlPv.default.__clang_call_terminate
lea rcx, [rsp + 0x60]
lea rdx, [0x14009f885]
call sym._ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8ue170005ILi0EEEPKc
mov rcx, rbp
lea rdx, str.
call sym._ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8ue170005ILi0EEEPKc
lea rcx, [rsp + 0xc8]
lea rdx, [rsp + 0x60]
mov r8, rbp
call sym.replaceAll_std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char_____std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char____const__std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char____const_
test byte [rsp + 0x80], 1
je 0x1400050a0
mov rcx, qword [rsp + 0x90]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0x60], 1
je 0x1400050b1
mov rcx, qword [rsp + 0x70]
call sym..weak._ZdlPv.default.__clang_call_terminate
lea rcx, [rsp + 0x60]
lea rdx, [0x14009f880]
call sym._ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8ue170005ILi0EEEPKc
mov rcx, rbp
lea rdx, [0x14009f88c]
call sym._ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8ue170005ILi0EEEPKc
lea rcx, [rsp + 0xe8]
lea rdx, [rsp + 0x60]
mov r8, rbp
call sym.replaceAll_std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char_____std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char____const__std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char____const_
test byte [rsp + 0x80], 1
je 0x1400050fd
mov rcx, qword [rsp + 0x90]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0x60], 1
je 0x14000510e
mov rcx, qword [rsp + 0x70]
call sym..weak._ZdlPv.default.__clang_call_terminate
lea rcx, [rsp + 0x60]
lea rdx, [0x14009f850]
call sym._ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8ue170005ILi0EEEPKc
mov rcx, rbp
lea rdx, [0x14009f88e]
call sym._ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8ue170005ILi0EEEPKc
lea rcx, [rsp + 0xc8]
lea rdx, [rsp + 0x60]
mov r8, rbp
call sym.replaceAll_std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char_____std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char____const__std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char____const_
test byte [rsp + 0x80], 1
je 0x14000515a
mov rcx, qword [rsp + 0x90]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0x60], 1
je 0x14000516b
mov rcx, qword [rsp + 0x70]
call sym..weak._ZdlPv.default.__clang_call_terminate
lea rcx, [rsp + 0x60]
lea rdx, [0x14009f880]
call sym._ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8ue170005ILi0EEEPKc
mov rcx, rbp
lea rdx, [0x14009f88c]
call sym._ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8ue170005ILi0EEEPKc
lea rcx, [rsp + 0x100]
lea rdx, [rsp + 0x60]
mov r8, rbp
call sym.replaceAll_std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char_____std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char____const__std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char____const_
test byte [rsp + 0x80], 1
je 0x1400051b7
mov rcx, qword [rsp + 0x90]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0x60], 1
je 0x1400051c8
mov rcx, qword [rsp + 0x70]
call sym..weak._ZdlPv.default.__clang_call_terminate
lea rbx, [rsp + 0x1a8]
mov rcx, rbx
lea rdx, [0x14009f891]
lea r8, [rsp + 0x100]
call method.std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char____std::__1::operator_char__std::__1::char_traits_char___std::__1.allocator_char____char_const__std::__1::basic_string_char__std::__1::char_traits_char___std::__1:
mov rcx, rbx
lea rdx, [0x14009f88c]
call method.std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char___.append_char_const_
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x140], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x130], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
movzx eax, byte [rsp + 0xe8]
mov r8d, eax
shr r8d, 1
test al, 1
mov rdx, qword [rsp + 0xf8]
lea rax, [rsp + 0xe9]
cmove rdx, rax
cmovne r8, qword [rsp + 0xf0]
lea rcx, [rsp + 0x130]
call method.std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char___.append_char_const__unsigned_long_long_
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x160], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x150], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x150]
lea rdx, [0x14009f895]
call method.std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char___.append_char_const_
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x180], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x170], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x170]
lea rdx, [0x14009f898]
call method.std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char___.append_char_const_
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x1a0], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x190], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
movzx eax, byte [rsp + 0xc8]
mov r8d, eax
shr r8d, 1
test al, 1
mov rdx, qword [rsp + 0xd8]
lea rax, [rsp + 0xc9]
cmove rdx, rax
cmovne r8, qword [rsp + 0xd0]
lea rcx, [rsp + 0x190]
call method.std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char___.append_char_const__unsigned_long_long_
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x90], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x80], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov rcx, rbp
lea rdx, [0x14009f89b]
call method.std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char___.append_char_const_
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
movzx eax, byte [rsp + 0x60]
mov r8d, eax
shr r8d, 1
test al, 1
mov rdx, qword [rsp + 0x70]
lea rax, [rsp + 0x61]
cmove rdx, rax
cmovne r8, qword [rsp + 0x68]
mov rcx, qword [rsp + 0xa8]
call method.std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char___.append_char_const__unsigned_long_long_
test byte [rsp + 0x60], 1
je 0x1400053a6
mov rcx, qword [rsp + 0x70]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0x80], 1
je 0x1400053bd
mov rcx, qword [rsp + 0x90]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0x190], 1
je 0x1400053d4
mov rcx, qword [rsp + 0x1a0]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0x170], 1
je 0x1400053eb
mov rcx, qword [rsp + 0x180]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0x150], 1
je 0x140005402
mov rcx, qword [rsp + 0x160]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0x130], 1
je 0x140005419
mov rcx, qword [rsp + 0x140]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0x1a8], 1
je 0x140005430
mov rcx, qword [rsp + 0x1b8]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0xe8], 1
je 0x140005447
mov rcx, qword [rsp + 0xf8]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0xc8], 1
je 0x14000545e
mov rcx, qword [rsp + 0xd8]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0x100], 1
je 0x140005475
mov rcx, qword [rsp + 0x110]
call sym..weak._ZdlPv.default.__clang_call_terminate
mov rcx, qword [rsp + 0x118]
test rcx, rcx
je 0x14000548f
mov qword [rsp + 0x120], rcx
call sym..weak._ZdlPv.default.__clang_call_terminate
inc r15d
cmp r15d, dword [rsp + 0xa0]
jb 0x140004ef4
cmp dword [rsp + 0xa4], 0
mov rsi, qword [rsp + 0x98]
je 0x1400056a4
lea rax, [rsi + 1]
mov qword [rsp + 0xc0], rax
inc dword [rsp + 0xb4]
xor ebp, ebp
xorps xmm6, xmm6
lea r15, [rsp + 0x240]
lea r12, [rsp + 0xbc]
mov rbx, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea r13, [rsp + 0x1c0]
mov dword [rsp + 0xbc], 0xff
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, r14
mov edx, ebp
mov r8, r15
mov r9, r12
call rbx
test eax, eax
jne 0x140005695
movzx edi, byte [rsi]
test dil, 1
je 0x140005526
mov rdi, qword [rsi + 8]
jmp 0x140005528
shr edi, 1
lea r8, [rdi + 1]
mov rcx, r13
lea r9, [rsp + 0x100]
call method.std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char___.basic_string_abi:ue170005__std::__1::__uninitialized_size_tag__unsigned_long_long__std::__1::allocator_char__const_
test byte [rsp + 0x1c0], 1
lea rsi, [rsp + 0x1c1]
je 0x140005556
mov rsi, qword [rsp + 0x1d0]
test rdi, rdi
je 0x140005587
mov rax, qword [rsp + 0x98]
test byte [rax], 1
mov rdx, qword [rsp + 0xc0]
je 0x14000557c
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rcx, rsi
mov r8, rdi
call sym.memmove
mov word [rsi + rdi], 0x5c
mov rcx, r13
mov rdx, r15
call method.std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char___.append_char_const_
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x350], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x340], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x1c0], 1
mov rsi, qword [rsp + 0x98]
je 0x1400055d9
mov rcx, qword [rsp + 0x1d0]
call sym..weak._ZdlPv.default.__clang_call_terminate
lea rax, [rsp + 0x118]
mov qword [rsp + 0x20], rax
mov rcx, r14
mov rdx, r15
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000567e
mov rdx, qword [rsp + 0x118]
mov rcx, r13
lea r8, [rsp + 0x340]
mov r9d, dword [rsp + 0xb4]
call sym.DumpRegistryKeyToJson_HKEY____std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char____const__int_
movzx eax, byte [rsp + 0x1c0]
mov r8d, eax
shr r8d, 1
test al, 1
mov rdx, qword [rsp + 0x1d0]
lea rax, [rsp + 0x1c1]
cmove rdx, rax
cmovne r8, qword [rsp + 0x1c8]
mov rcx, qword [rsp + 0xa8]
call method.std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char___.append_char_const__unsigned_long_long_
test byte [rsp + 0x1c0], 1
je 0x140005670
mov rcx, qword [rsp + 0x1d0]
call sym..weak._ZdlPv.default.__clang_call_terminate
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [rsp + 0x340], 1
je 0x140005695
mov rcx, qword [rsp + 0x350]
call sym..weak._ZdlPv.default.__clang_call_terminate
inc ebp
cmp ebp, dword [rsp + 0xa4]
jb 0x1400054ed
mov rax, qword [rsp + 0xa8]
movaps xmm6, xmmword [rsp + 0x4340]
add rsp, 0x4358
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret