Function at 0x140011610
Capabilities:
Check if file exists
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x4d8], rbx
mov rax, qword [0x1400da318]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
lea rax, [rbp + 0xd0]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], 0x41
xor r14d, r14d
mov word [rbp + 0xd0], r14w
lea rsi, [0x14009a690]
mov qword [rbp + 0xb8], rsi
lea r12, [0x14009a5a0]
mov qword [rbp + 0xb0], r12
mov dword [rbp + 0x158], r14d
mov qword [rbp + 0x160], r14
mov qword [rsp + 0x20], r14
mov r9d, 0xf003f
mov r8, qword [r8]
lea rcx, [rbp + 0xb0]
call fcn.1400120b0
test eax, eax
js 0x14003527a
mov r15d, r14d
mov dword [rsp + 0x50], r14d
lea r13, [0x14009a6c8]
mov dword [rbp - 0x68], 0x100
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x1400352a0
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x68]
lea r8, [rbp + 0x170]
mov edx, r15d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001203b
lea ebx, [rax + 1]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x103
je 0x14001206d
test ebx, ebx
je 0x140035413
lea rax, [rbp + 0x10]
mov qword [rbp], rax
mov qword [rbp + 8], 0x41
mov word [rbp + 0x10], r14w
mov qword [rbp - 8], rsi
mov qword [rbp - 0x10], r12
mov dword [rbp + 0x98], r14d
mov qword [rbp + 0xa0], r14
mov qword [rsp + 0x20], r14
mov r9d, 0xf003f
lea r8, [rbp + 0x170]
mov rdx, qword [rbp + 0x160]
lea rcx, [rbp - 0x10]
call fcn.1400120b0
test eax, eax
js 0x1400353e4
lea rax, [0x14009a718]
mov qword [rbp - 0x60], rax
mov rax, qword [0x1400db5d0]
lea rcx, [0x1400db5d0]
mov rax, qword [rax + 0x18]
call qword [case.0x1400244c5.0]
add rax, 0x18
mov qword [rbp - 0x58], rax
mov rax, qword [0x1400db5d0]
lea rcx, [0x1400db5d0]
mov rax, qword [rax + 0x18]
call qword [case.0x1400244c5.0]
add rax, 0x18
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x70], r14d
mov rax, qword [0x1400db5d0]
lea rcx, [0x1400db5d0]
mov rax, qword [rax + 0x18]
call qword [case.0x1400244c5.0]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov rax, qword [0x1400db5d0]
lea rcx, [0x1400db5d0]
mov rax, qword [rax + 0x18]
call qword [case.0x1400244c5.0]
add rax, 0x18
mov qword [rbp - 0x80], rax
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x60]
call fcn.1400129a0
test eax, eax
js 0x140011d6b
mov rsi, r14
mov qword [rsp + 0x48], r14
mov rbx, qword [rdi]
mov r12, qword [rsp + 0x60]
mov r14, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x60]
cmp rbx, qword [rdi + 0x28]
je 0x140011930
test rsi, rsi
jne 0x1400352d5
cmp ecx, dword [rbx + 8]
je 0x1400118bf
seta al
test al, al
jne 0x140011bb2
mov rax, qword [rbx + 8]
cmp rax, r12
je 0x140011aaa
mov rbx, qword [rbx + 0x80]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
jmp 0x140011878
xor r13d, r13d
test ecx, ecx
je 0x14001189f
xor esi, esi
mov r14, qword [rsp + 0x58]
mov r15, r14
neg r15
cmp rsi, r12
jae 0x1400353ce
cmp rsi, qword [rbx + 8]
jae 0x1400353ce
lea rdi, [r15 + r14]
add rdi, qword [rbx]
mov eax, dword [r14 + 8]
cmp eax, dword [rdi + 8]
jne 0x140011f20
test eax, eax
jne 0x14001191c
mov rdx, qword [rdi]
mov rcx, qword [r14]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140011bde
mov ecx, dword [rsp + 0x60]
inc r13d
inc rsi
add r14, 0x10
cmp r13d, ecx
jb 0x1400118d3
jmp 0x140011f28
test rsi, rsi
jne 0x1400352d5
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1400121f0
mov qword [rsp + 0x48], rax
xor r14d, r14d
mov r13d, r14d
mov rbx, qword [rdi]
mov r15, qword [rsp + 0x60]
mov r12d, dword [rsp + 0x60]
cmp rbx, qword [rdi + 0x28]
je 0x140011a11
mov r13, rbx
cmp r12d, dword [rbx + 8]
je 0x14001199b
seta al
test al, al
jne 0x140011b96
mov rax, qword [rbx + 8]
cmp rax, r15
je 0x140011b21
mov rbx, qword [rbx + 0x80]
mov rdi, qword [rsp + 0x40]
jmp 0x140011962
mov dword [rbp - 0x70], r14d
test r12d, r12d
je 0x140011980
mov rsi, r14
mov r14, qword [rsp + 0x58]
mov r12, r14
neg r12
cmp rsi, r15
jae 0x1400353ce
cmp rsi, qword [rbx + 8]
jae 0x1400353ce
lea rdi, [r14 + r12]
add rdi, qword [rbx]
mov eax, dword [r14 + 8]
cmp eax, dword [rdi + 8]
jne 0x140011f32
test eax, eax
jne 0x1400119f7
mov rdx, qword [rdi]
mov rcx, qword [r14]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140011bbb
mov eax, dword [rbp - 0x70]
inc eax
mov dword [rbp - 0x70], eax
inc rsi
add r14, 0x10
cmp eax, dword [rsp + 0x60]
jb 0x1400119b2
jmp 0x140011f3a
mov rsi, qword [rsp + 0x48]
mov qword [rsi + 0x88], r13
test r13, r13
je 0x140012051
mov rax, qword [r13 + 8]
cmp r12d, eax
jne 0x140011bff
test r12d, r12d
je 0x140035332
xor esi, esi
mov rdi, qword [rsp + 0x58]
mov rax, rdi
mov qword [rbp - 0x70], rax
cmp rsi, r15
jae 0x1400353ce
cmp rsi, qword [r13 + 8]
jae 0x1400353ce
mov rbx, rdi
sub rbx, rax
add rbx, qword [r13]
mov eax, dword [rdi + 8]
cmp eax, dword [rbx + 8]
jne 0x14001201d
test eax, eax
jne 0x140011a91
mov rdx, qword [rbx]
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140011c0c
inc r14d
inc rsi
add rdi, 0x10
cmp r14d, r12d
jae 0x14003532d
mov rax, qword [rbp - 0x70]
jmp 0x140011a4a
xor esi, esi
test rax, rax
je 0x1400352c3
xor edi, edi
cmp rdi, rax
jae 0x1400353ce
mov rcx, rdi
add rcx, rcx
mov rax, qword [rbx]
cmp dword [rax + rcx*8 + 8], 0
jne 0x140011faa
cmp rdi, r12
jae 0x1400353ce
mov rax, rdi
add rax, rax
mov rdx, qword [r14 + rax*8]
cmp rdi, qword [rbx + 8]
jae 0x1400353ce
add rdi, rdi
mov rax, qword [rbx]
mov rcx, qword [rax + rdi*8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400118ac
inc esi
mov edi, esi
mov rax, qword [rbx + 8]
cmp rdi, rax
jb 0x140011ac0
jmp 0x1400352c3
mov esi, r14d
test rax, rax
je 0x140011b96
mov rdi, r14
cmp r14, rax
jae 0x1400353ce
mov rcx, rdi
add rcx, rcx
mov rax, qword [rbx]
cmp dword [rax + rcx*8 + 8], 0
jne 0x140011fc6
cmp rdi, r15
jae 0x1400353ce
mov rax, rdi
add rax, rax
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + rax*8]
cmp rdi, qword [rbx + 8]
jae 0x1400353ce
add rdi, rdi
mov rax, qword [rbx]
mov rcx, qword [rax + rdi*8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14001198d
inc esi
mov edi, esi
mov rax, qword [rbx + 8]
cmp rdi, rax
jb 0x140011b35
mov rbx, qword [rbx + 0x78]
mov rdi, qword [rsp + 0x40]
jmp 0x14001195d
mov ecx, dword [rsp + 0x60]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rbx + 0x78]
jmp 0x14001187c
mov rdx, qword [rdi]
mov rcx, qword [r14]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
xor r14d, r14d
test eax, eax
js 0x140011b96
mov r12d, dword [rsp + 0x60]
jmp 0x140011980
mov rdx, qword [rdi]
mov rcx, qword [r14]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
mov r14, qword [rsp + 0x58]
test eax, eax
jns 0x14001189f
jmp 0x140011ba4
seta al
test al, al
jne 0x140011cab
jmp 0x140011c2a
mov rdx, qword [rbx]
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
mov rsi, qword [rsp + 0x48]
xor r14d, r14d
test eax, eax
js 0x140011ca6
mov rax, qword [r13 + 8]
cmp rax, r15
jne 0x140011cb1
mov edi, r14d
test rax, rax
je 0x140011ca6
mov rbx, r14
cmp rbx, rax
jae 0x1400353ce
mov rax, rbx
shl rax, 4
add rax, qword [r13]
cmp dword [rax + 8], 0
jne 0x140011fee
cmp rbx, r15
jae 0x1400353ce
mov rax, rbx
shl rax, 4
add rax, qword [rsp + 0x58]
cmp rbx, qword [r13 + 8]
jae 0x1400353ce
shl rbx, 4
add rbx, qword [r13]
mov rdx, qword [rax]
mov rcx, qword [rbx]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140011cb1
inc edi
mov rax, qword [r13 + 8]
mov ebx, edi
cmp rbx, rax
jb 0x140011c47
mov rdi, qword [rsp + 0x40]
mov qword [r13 + 0x78], rsi
jmp 0x140011cbd
mov qword [r13 + 0x80], rsi
mov rdi, qword [rsp + 0x40]
mov dword [rsi + 0x70], r14d
mov rax, qword [rdi]
cmp rsi, rax
je 0x140011d33
mov rcx, qword [rsi + 0x88]
cmp dword [rcx + 0x70], 0
jne 0x140011d33
mov rdx, qword [rcx + 0x88]
mov rax, qword [rdx + 0x78]
cmp rcx, rax
je 0x140011f42
test rax, rax
je 0x140011e7f
cmp dword [rax + 0x70], 0
jne 0x140011e7f
mov dword [rcx + 0x70], 1
mov dword [rax + 0x70], 1
mov rax, qword [rsi + 0x88]
mov rcx, qword [rax + 0x88]
mov dword [rcx + 0x70], r14d
mov rax, qword [rsi + 0x88]
mov rsi, qword [rax + 0x88]
mov rax, qword [rdi]
cmp rsi, rax
jne 0x140011cc9
mov dword [rax + 0x70], 1
mov rcx, qword [rdi]
add rcx, 0x88
je 0x1400353d9
mov rax, qword [rdi + 0x28]
mov qword [rcx], rax
lea r13, [0x14009a6c8]
lea r12, [0x14009a5a0]
lea rsi, [0x14009a690]
mov r15d, dword [rsp + 0x50]
inc r15d
mov dword [rsp + 0x50], r15d
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x14003534e
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x140035364
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x140011dfd
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x140011de9
nop
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x14003537a
add rbx, 0x10
sub rdi, 1
jne 0x140011dc0
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x140035390
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x1400353a6
mov qword [rbp - 0x10], r12
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x140011e58
cmp dword [rbp + 0x98], 0
je 0x140011e58
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], rsi
mov rcx, qword [rbp]
test rcx, rcx
je 0x1400116d3
lea rax, [rbp + 0x10]
cmp rcx, rax
je 0x1400116d3
jmp 0x1400353bc
cmp rsi, qword [rcx + 0x78]
je 0x14003533a
mov rax, qword [rsi + 0x88]
mov dword [rax + 0x70], 1
mov rax, qword [rsi + 0x88]
mov rcx, qword [rax + 0x88]
mov dword [rcx + 0x70], r14d
mov rax, qword [rsi + 0x88]
mov rcx, qword [rax + 0x88]
test rcx, rcx
je 0x140011d2b
mov rdx, qword [rcx + 0x80]
mov rax, qword [rdx + 0x78]
mov qword [rcx + 0x80], rax
mov rax, qword [rdx + 0x78]
cmp rax, qword [rdi + 0x28]
jne 0x140011fe2
mov rax, qword [rcx + 0x88]
mov qword [rdx + 0x88], rax
mov rax, qword [rcx + 0x88]
cmp rax, qword [rdi + 0x28]
je 0x14001200a
cmp rcx, qword [rax + 0x78]
je 0x140012059
mov qword [rax + 0x80], rdx
mov qword [rdx + 0x78], rcx
mov qword [rcx + 0x88], rdx
jmp 0x140011d2b
test eax, eax
je 0x1400352b9
mov r14, qword [rsp + 0x58]
jmp 0x14001189f
test eax, eax
je 0x140035325
xor r14d, r14d
jmp 0x140011bd4
mov rax, qword [rdx + 0x80]
test rax, rax
je 0x140011f58
cmp dword [rax + 0x70], 0
je 0x140011cfd
cmp rsi, qword [rcx + 0x80]
jne 0x140011f6f
mov rsi, rcx
mov rdx, rcx
mov rcx, rdi
call fcn.140014460
mov rax, qword [rsi + 0x88]
mov dword [rax + 0x70], 1
mov rax, qword [rsi + 0x88]
mov rcx, qword [rax + 0x88]
mov dword [rcx + 0x70], r14d
mov rdx, qword [rsi + 0x88]
mov rdx, qword [rdx + 0x88]
mov rcx, rdi
call fcn.1400143e0
jmp 0x140011d2b
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.14001419c
cmp dword [rax + 8], 0
jne 0x140011b0f
jmp 0x140011ad4
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.14001419c
cmp dword [rax + 8], 0
jne 0x140011b89
jmp 0x140011b49
mov qword [rax + 0x88], rcx
jmp 0x140011ee0
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14001419c
cmp dword [rax + 8], 0
jne 0x140011c99
jmp 0x140011c5c
mov qword [rdi], rdx
mov qword [rdx + 0x78], rcx
mov qword [rcx + 0x88], rdx
jmp 0x140011d2b
mov rsi, qword [rsp + 0x48]
xor r14d, r14d
test eax, eax
jne 0x140011c2a
mov rdi, qword [rsp + 0x40]
mov qword [r13 + 0x78], rsi
jmp 0x140011cbd
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov ebx, r14d
jmp 0x140011735
mov qword [rdi], rsi
jmp 0x140011cbd
mov qword [rax + 0x78], rdx
mov qword [rdx + 0x78], rcx
mov qword [rcx + 0x88], rdx
jmp 0x140011d2b
lea rcx, [rbp + 0xb0]
call fcn.140014250
mov eax, r14d
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.14002a310
mov rbx, qword [rsp + 0x4d8]
add rsp, 0x480
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
nop
cmp eax, 2
je 0x14001206d
test eax, eax
jg 0x14003541b
mov r14d, eax
jmp 0x14001206d
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov ebx, r14d
jmp 0x140011735
mov r14, qword [rsp + 0x58]
jmp 0x140011ba8
mov rsi, rbx
mov qword [rsp + 0x48], rbx
mov rdi, qword [rsp + 0x40]
jmp 0x140011878
mov rdx, rsi
mov rcx, rdi
call fcn.140024a70
mov rbx, rax
test rax, rax
je 0x1400352fe
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400249b8
test al, al
je 0x1400352fe
mov rsi, rbx
jmp 0x1400352d5
test rsi, rsi
je 0x140011939
lea rcx, [rsi + 0x38]
call fcn.140008a00
lea rdx, [rbp - 0x60]
lea rcx, [rsi + 0x38]
call fcn.1400261f4
xor r14d, r14d
jmp 0x140011d51
xor r14d, r14d
jmp 0x140011b96
mov rsi, qword [rsp + 0x48]
xor r14d, r14d
jmp 0x140011c2a
mov rsi, rcx
mov rdx, rcx
mov rcx, rdi
call fcn.1400143e0
nop
jmp 0x140011e89
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400244c5.0]
nop
jmp 0x140011d8e
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
or dil, dil
adc eax, 0x6d76c
nop
jmp 0x140011daa
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400244c5.0]
nop
jmp 0x140011dda
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400244c5.0]
nop
jmp 0x140011e18
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400244c5.0]
nop
jmp 0x140011e33
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
nop
jmp 0x1400116d3
mov ecx, 0x80070057
call fcn.14004494c
nop
mov ecx, 0x80004005
call fcn.14004494c
nop
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jg 0x1400353f9
mov r14d, eax
jmp 0x140035404
movzx r14d, ax
or r14d, 0x80070000
lea rcx, [rbp - 0x10]
call fcn.140014250
nop
jmp 0x14001206d
test eax, eax
jle 0x140035298
movzx r14d, ax
or r14d, 0x80070000
jmp 0x14001206d