Function at 0x140007d20
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140056fb0]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor eax, eax
mov r10, r8
mov qword [rsp + 0x48], r8
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x40], rax
movzx eax, byte [0x140058b2b]
neg al
lea rax, [rsp + 0x30]
mov rdi, rdx
sbb r9d, r9d
mov r8d, 4
mov rdx, r10
and r9d, 0x1000000
mov rsi, rcx
mov qword [rsp + 0x20], rax
or r9d, dword [0x140049c50]
bts r9d, 8
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, 5
jne 0x140007ddc
movzx eax, byte [0x140058b2b]
mov rdx, qword [rsp + 0x48]
mov rcx, rsi
neg al
lea rax, [rsp + 0x30]
sbb r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
and r9d, 0x1000000
or r9d, dword [0x140049c50]
bts r9d, 8
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
je 0x140007e57
cmp ebx, 5
jne 0x140007e2b
mov rcx, qword [0x140058b18]
test rcx, rcx
je 0x140007e2f
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x140007e2f
mov r9d, dword [0x140049c50]
mov rdx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
lea r8d, [rbx - 1]
bts r9d, 8
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test ebx, ebx
je 0x140007e57
cmp byte [0x140058b13], 0
jne 0x14000805b
lea rcx, str.Error_opening__s:_n
mov rdx, rdi
call fcn.14000adf8
mov ecx, ebx
call fcn.140005190
jmp 0x14000805b
movzx eax, byte [0x14004b6c8]
test al, al
je 0x140007e7f
movzx ecx, byte [0x140058b12]
test cl, cl
jne 0x140007e7f
mov edx, 1
xor esi, esi
mov dword [0x140058b14], edx
jmp 0x140007f70
movzx eax, byte [0x140058b10]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
neg al
movzx eax, byte [0x140058b2b]
sbb edx, edx
and edx, 0x10
neg al
sbb ecx, ecx
and ecx, 8
or edx, ecx
mov rcx, qword [rsp + 0x30]
or edx, 0x85
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov ecx, dword [rsp + 0x38]
call fcn.14000ac7c
movzx ecx, byte [0x140058b10]
lea r9, [rsp + 0x38]
neg cl
movzx ecx, byte [0x140058b2b]
mov qword [rsp + 0x40], rax
sbb edx, edx
and edx, 0x10
neg cl
mov rcx, qword [rsp + 0x30]
sbb r8d, r8d
and r8d, 8
or edx, r8d
mov r8, rax
or edx, 0x85
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov ebx, eax
test eax, eax
je 0x140007f34
cmp byte [0x140058b13], 0
jne 0x140007f25
lea rcx, str.__Error_getting_security_for__s:_n
mov rdx, rdi
call fcn.14000adf8
mov ecx, ebx
call fcn.140005190
mov rcx, qword [rsp + 0x40]
call fcn.14000ac3c
jmp 0x14000805b
mov r8, qword [rsp + 0x40]
lea rdx, [0x140049c60]
xor esi, esi
xor r9d, r9d
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call fcn.140004240
mov rcx, qword [rsp + 0x40]
call fcn.14000ac3c
movzx eax, byte [0x14004b6c8]
movzx ecx, byte [0x140058b12]
mov edx, dword [0x140058b14]
cmp byte [0x140058b11], 0
jne 0x140007f91
test al, al
je 0x140007f85
test edx, edx
je 0x140007f85
test cl, cl
je 0x140007f91
mov byte [0x14004b6c8], 0
jmp 0x140008050
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x50]
mov r9d, 0x208
xor edx, edx
mov byte [0x14004b6c8], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x140008050
nop dword [rax + rax]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rdi + rcx*2], 0
jne 0x140007fc4
lea rdx, [rsp + 0x50]
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140007fe0
add rcx, rax
lea rcx, [rcx*2 + 4]
call fcn.14000ac7c
lea r9, [rsp + 0x50]
lea rdx, str._s_s
mov rcx, rax
mov r8, rdi
mov rbx, rax
call fcn.14000aecc
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x50]
mov rdx, rbx
call fcn.140007d20
mov rcx, rbx
call fcn.14000ac3c
mov rcx, qword [rsp + 0x30]
inc esi
lea r8, [rsp + 0x50]
mov edx, esi
mov r9d, 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x140007fc0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14000b260
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x270
pop rdi
pop rsi
pop rbp
ret