Function at 0x14008eb30
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov r12, rdx
xor r13d, r13d
mov r14d, r13d
mov dword [rsp + 0x40], r13d
mov qword [rbp - 0x48], r13
mov dword [rbp], r13d
lea r9, [rbp]
lea r8, [rbp - 0x48]
call fcn.140092ad0
cmp al, 1
jne 0x14008ee81
lea rdx, [0x1403f0b94]
mov rcx, qword [rbp - 0x48]
call fcn.1402ad108
test rax, rax
jne 0x14008ee73
mov qword [rbp - 0x58], r13
lea rcx, [rbp - 0x58]
call fcn.140093210
test al, al
jne 0x14008ebd2
lea rdx, str.SIUtilRegistryKeySetSecurityDescEveryoneAccess_failed__PrivateSecurityEveryoneAccessListCreate_n
lea ecx, [r13 + 1]
call fcn.140093500
jmp 0x14008ed06
mov edx, 0x28
lea ecx, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x14008ec0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.SIUtilRegistryKeySetSecurityDescEveryoneAccess_failed__LocalAlloc__d_n
lea ecx, [rbx + 1]
call fcn.140093500
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14008ed06
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x14008ec53
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.SIUtilRegistryKeySetSecurityDescEveryoneAccess_failed__InitializeSecurityDescriptor__d_n
mov r8d, eax
mov ecx, 1
call fcn.140093500
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14008ed06
xor r9d, r9d
mov r8, qword [rbp - 0x58]
lea edx, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x14008ec7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.SIUtilRegistryKeySetSecurityDescEveryoneAccess_failed__SetSecurityDescriptorDacl__d_n
jmp 0x14008ec2e
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, r12
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14008ecb9
mov r9d, eax
mov r8, r12
lea rdx, str.SIUtilRegistryKeySetSecurityDescEveryoneAccess_failed__RegOpenKeyEx__s__d_n
mov ecx, 1
call fcn.140093500
jmp 0x14008ec3b
mov r8, rbx
mov edx, 4
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x14008ee73
mov r8d, edi
lea rdx, str.SIUtilRegistryKeySetSecurityDescEveryoneAccess_failed__RegSetKeySecurity__u_n
mov ecx, 1
call fcn.140093500
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.14008f3f0
mov rbx, rax
lea rdx, str.MACHINE_
lea rcx, [rsp + 0x68]
call fcn.14008f3f0
nop
mov r9, rbx
mov r8, rax
lea rcx, [rbp - 0x20]
call fcn.14008f880
mov dword [rsp + 0x40], 4
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14008ed80
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008ed7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008f24e
call fcn.1402ab340
movdqa xmm0, xmmword [0x1404332f0]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r13w
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14008edd6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008edd1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008f254
call fcn.1402ab340
movdqa xmm0, xmmword [0x1404332f0]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r13w
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rcx, qword [rbp - 0x20]
call fcn.140092cd0
test al, al
jne 0x14008ee12
lea rdx, str._SIService::PrivateRegistrySettingsChangeSecurityDescriptor_failed__SIUtilRegistryKeySetSecurityDescOwnershipAndEveryoneAccess_n
mov ecx, 1
call fcn.140093500
mov r14d, 4
and r14d, 0xfffffffb
mov dword [rsp + 0x40], r14d
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14008ee61
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008ee5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008f25a
call fcn.1402ab340
movdqa xmm0, xmmword [0x1404332f0]
movdqu xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x20], r13w
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbp - 0x48], r13
mov r15d, r13d
nop dword [rax]
nop dword [rax + rax]
lea rdx, [0x1403f0cc0]
lea rcx, [rbp - 0x40]
call fcn.14008f3f0
nop
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 8
xor r8d, r8d
mov rdx, r12
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008f1b3
mov sil, 1
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x10]
call fcn.1402ae030
mov dword [rbp - 0x58], 0xff
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x58]
lea r8, [rbp + 0x10]
mov edx, r15d
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14008ef31
cmp eax, 0x103
je 0x14008ef2e
mov r8d, eax
lea rdx, str.SIUtilRegistryKeysEnumerate_RegEnumKeyEx_failed___d_n
mov ecx, 1
call fcn.140093500
xor sil, sil
lea rax, [rbp + 0x10]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14008ef40
mov rax, qword [rbp - 0x28]
cmp rdx, rax
ja 0x14008ef7e
lea rdi, [rbp - 0x40]
cmp rax, 8
cmovae rdi, qword [rbp - 0x40]
mov qword [rbp - 0x30], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rbp + 0x10]
mov rcx, rdi
call fcn.1402ad790
mov word [rdi + rbx], r13w
jmp 0x14008ef8b
lea r9, [rbp + 0x10]
lea rcx, [rbp - 0x40]
call fcn.14008ff70
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test sil, sil
je 0x14008f1cb
lea rdx, [0x1403f0cc4]
lea rcx, [rsp + 0x68]
call fcn.14008f3f0
mov rbx, rax
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.14008f3f0
nop
mov r9, rbx
mov r8, rax
lea rcx, [rbp - 0x78]
call fcn.14008f880
or r14d, 1
mov dword [rsp + 0x40], r14d
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x20]
call fcn.14008f530
nop
and r14d, 0xfffffffe
mov dword [rsp + 0x40], r14d
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14008f033
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008f02e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008f260
call fcn.1402ab340
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r13w
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14008f086
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008f081
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008f266
call fcn.1402ab340
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r13w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14008f0db
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008f0d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008f26c
call fcn.1402ab340
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r13w
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
mov rcx, 0xffffffff80000002
call fcn.14008eb30
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14008f149
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008f144
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008f272
call fcn.1402ab340
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r13w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14008f19a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008f195
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008f248
call fcn.1402ab340
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
inc r15d
jmp 0x14008ee90
mov r9d, eax
mov r8, r12
lea rdx, str.SIUtilRegistryKeysEnumerate_failed___s__d_n
mov ecx, 1
call fcn.140093500
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14008f207
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008f202
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008f248
call fcn.1402ab340
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.1402ab320
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1402b2324
nop
call fcn.1402b2324
nop
call fcn.1402b2324
nop
call fcn.1402b2324
nop
call fcn.1402b2324
nop
call fcn.1402b2324
nop
call fcn.1402b2324
nop
call fcn.1402b2324
int3