Function at 0x140001990
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
lea rax, [rsp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140001a05
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Error_opening_HKEY_CURRENT_USER
call fcn.140003040
mov rcx, rax
lea rdx, [0x140003210]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140001d03
mov rcx, qword [rsp + 0x68]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x78]
mov qword [rsp + 0x2d0], rdi
lea r8, [rbp - 0x70]
xor edi, edi
mov dword [rsp + 0x78], 0x104
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140001a7f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Error_enumerating_subkeys
call fcn.140003040
mov rcx, rax
lea rdx, [0x140003210]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [rdi + 1]
jmp 0x140001cfb
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.First_subkey_in_HKEY_CURRENT_USER:
call fcn.140003250
mov rcx, rax
lea rdx, [rbp - 0x70]
call fcn.1400034c0
mov rcx, rax
lea rdx, [0x1400036a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x70]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoft
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140001b11
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Error_opening_HKEY_CURRENT_USERSOFTWAREMicrosoft
call fcn.140003040
mov rcx, rax
lea rdx, [0x140003210]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140001cfb
mov rcx, qword [rsp + 0x70]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x78]
mov qword [rsp + 0x30], rdi
lea r8, [rbp - 0x70]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x78], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140001b83
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Error_enumerating_subkeys_under_HKEY_CURRENT_USERSOFTWAREMicrosoft
call fcn.140003040
mov rcx, rax
lea rdx, [0x140003210]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x140001cfb
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.First_subkey_under_HKEY_CURRENT_USERSOFTWAREMicrosoft:
mov qword [rsp + 0x2c0], rbx
mov qword [rsp + 0x2c8], rsi
mov qword [rsp + 0x2d8], r14
call fcn.140003250
mov rcx, rax
lea rdx, [rbp - 0x70]
call fcn.1400034c0
mov rcx, rax
lea rdx, [0x1400036a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [0x1400090d0], 0xf
lea r14, [0x1400090b8]
mov rsi, qword [0x1400090c8]
movabs rbx, 0x7fffffffffffffff
cmova r14, qword [0x1400090b8]
xorps xmm0, xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
movups xmmword [rsp + 0x40], xmm0
cmp rsi, rbx
ja 0x140001d1b
cmp rsi, 0xf
ja 0x140001c3a
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 0xf
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x40], xmm0
jmp 0x140001cd1
mov rax, rsi
or rax, 0xf
cmp rax, rbx
jbe 0x140001c72
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140003d80
mov rcx, rax
test rax, rax
je 0x140001c9d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001cb3
mov ecx, 0x16
mov rbx, rax
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001ca4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001d21
jmp 0x140001c54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001cb0
call fcn.140003d80
jmp 0x140001cb3
mov rax, rdi
lea r8, [rsi + 1]
mov qword [rsp + 0x40], rax
mov rdx, r14
mov qword [rsp + 0x50], rsi
mov rcx, rax
mov qword [rsp + 0x58], rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x40]
call fcn.140001450
mov rbx, qword [rsp + 0x2c0]
test al, al
mov rsi, qword [rsp + 0x2c8]
mov r14, qword [rsp + 0x2d8]
setne dil
mov eax, edi
mov rdi, qword [rsp + 0x2d0]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140003d60
add rsp, 0x2b0
pop rbp
ret
call fcn.140001370
int3
call fcn.1400012d0
int3