Function at 0x140019da0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x3a0
mov qword [rsp + 0x388], 0xfffffffffffffffe
mov rax, qword [0x1403710d8]
xor rax, rsp
mov qword [rsp + 0x390], rax
lea rcx, [rsp + 0x80]
call fcn.140012e10
nop
lea rax, str.profile
mov qword [rsp + 0x20], rax
lea r9, [0x140295fd0]
mov r8, qword [rsp + 0x3b0]
mov r8, qword [r8 + 0x98]
lea rdx, [0x140295fb8]
lea rcx, [rsp + 0x80]
call fcn.140013e60
lea rcx, [rsp + 0x68]
call fcn.14001b3d0
nop
lea rcx, [rsp + 0x80]
call fcn.140267cb0
mov r9d, 0x20119
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x68]
call fcn.14001b470
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x140019eb8
cmp dword [rsp + 0x60], 2
je 0x140019e89
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
mov r9d, dword [rsp + 0x60]
mov r8, qword [rsp + 0x80]
lea rdx, str._CEnumUserInfo::LoadProfilePath__RegOpenKeyEx__s___err__u_
lea rcx, [0x1403749c0]
call fcn.14002d6f0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x364], eax
lea rcx, [rsp + 0x68]
call fcn.14001b400
nop
lea rcx, [rsp + 0x80]
call fcn.140012ea0
mov eax, dword [rsp + 0x364]
jmp 0x14001a481
mov dword [rsp + 0x78], 0
lea rcx, [rsp + 0x68]
call fcn.140267cb0
mov rcx, rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x140019f8c
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
mov r8d, dword [rsp + 0x60]
lea rdx, str._CEnumUserInfo::LoadProfilePath__RegQueryInfoKey____err__u_
lea rcx, [0x1403749c0]
call fcn.14002d6f0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x368], eax
lea rcx, [rsp + 0x68]
call fcn.14001b400
nop
lea rcx, [rsp + 0x80]
call fcn.140012ea0
mov eax, dword [rsp + 0x368]
jmp 0x14001a481
mov rcx, qword [rsp + 0x3b0]
call fcn.14001b190
mov rcx, qword [rsp + 0x3b0]
call fcn.14001b2d0
mov dword [rsp + 0x88], 0
jmp 0x140019fc4
mov eax, dword [rsp + 0x88]
add eax, 1
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x78]
cmp dword [rsp + 0x88], eax
jae 0x14001a457
xor eax, eax
mov word [rsp + 0xb0], ax
lea rdi, [rsp + 0xb2]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x2c8], 0x104
lea rcx, [rsp + 0x68]
call fcn.140267cb0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c8]
lea r8, [rsp + 0xb0]
mov edx, dword [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x14001a08f
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
mov r9d, dword [rsp + 0x60]
lea r8, [rsp + 0xb0]
lea rdx, str._CEnumUserInfo::LoadProfilePath__RegEnumKeyEx__s___err__u_
lea rcx, [0x1403749c0]
call fcn.14002d6f0
jmp 0x140019fb3
lea rcx, [rsp + 0xa0]
call fcn.140012e10
nop
lea r9, [rsp + 0xb0]
mov r8, qword [rsp + 0x80]
lea rdx, [0x1402941f8]
lea rcx, [rsp + 0xa0]
call fcn.140013e60
lea rcx, [rsp + 0x90]
call fcn.14001b3d0
nop
lea rcx, [rsp + 0xa0]
call fcn.140267cb0
mov r9d, 0x20119
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x90]
call fcn.14001b470
mov dword [rsp + 0x8c], eax
cmp dword [rsp + 0x8c], 0
je 0x14001a195
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
mov r9d, dword [rsp + 0x8c]
mov r8, qword [rsp + 0xa0]
lea rdx, str._CEnumUserInfo::LoadProfilePath__RegOpenKeyEx__s___err__u_
lea rcx, [0x1403749c0]
call fcn.14002d6f0
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x36c], eax
lea rcx, [rsp + 0x90]
call fcn.14001b400
nop
lea rcx, [rsp + 0xa0]
call fcn.140012ea0
nop
lea rcx, [rsp + 0x68]
call fcn.14001b400
nop
lea rcx, [rsp + 0x80]
call fcn.140012ea0
mov eax, dword [rsp + 0x36c]
jmp 0x14001a481
mov ecx, 0xa2c
call sub.MSVCR90.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x370], rax
mov rax, qword [rsp + 0x370]
mov qword [rsp + 0x2c0], rax
cmp qword [rsp + 0x2c0], 0
je 0x14001a437
mov r8d, 0xa2c
xor edx, edx
mov rcx, qword [rsp + 0x2c0]
call sub.MSVCR90.dll_memset
lea r8, [rsp + 0xb0]
mov edx, 0x104
mov rcx, qword [rsp + 0x2c0]
call fcn.14000af60
mov rax, qword [rsp + 0x2c0]
add rax, 0x208
mov qword [rsp + 0x2d0], rax
mov dword [rsp + 0x2d8], 0x104
lea rax, str.ProfileImagePath
mov qword [rsp + 0x2e0], rax
lea rax, str._USERPROFILE_ALLUSERS_
mov qword [rsp + 0x2e8], rax
mov rax, qword [rsp + 0x2c0]
add rax, 0x410
mov qword [rsp + 0x2f0], rax
mov dword [rsp + 0x2f8], 0x104
lea rax, str.AppData
mov qword [rsp + 0x300], rax
lea rax, str._APPDATA_ALLUSERS_
mov qword [rsp + 0x308], rax
mov rax, qword [rsp + 0x2c0]
add rax, 0x618
mov qword [rsp + 0x310], rax
mov dword [rsp + 0x318], 0x104
lea rax, str.Local_AppData
mov qword [rsp + 0x320], rax
lea rax, str._LOCALAPPDATA_ALLUSERS_
mov qword [rsp + 0x328], rax
mov rax, qword [rsp + 0x2c0]
add rax, 0x820
mov qword [rsp + 0x330], rax
mov dword [rsp + 0x338], 0x104
lea rax, str.Temp
mov qword [rsp + 0x340], rax
lea rax, str._TEMP_ALLUSERS_
mov qword [rsp + 0x348], rax
mov qword [rsp + 0x350], 0
jmp 0x14001a313
mov rax, qword [rsp + 0x350]
add rax, 1
mov qword [rsp + 0x350], rax
cmp qword [rsp + 0x350], 4
jae 0x14001a415
mov rax, qword [rsp + 0x350]
imul rax, rax, 0x20
lea rax, [rsp + rax + 0x2d0]
mov qword [rsp + 0x358], rax
mov r9, qword [rsp + 0x358]
add r9, 8
mov r8, qword [rsp + 0x358]
mov r8, qword [r8]
mov rdx, qword [rsp + 0x358]
mov rdx, qword [rdx + 0x10]
lea rcx, [rsp + 0x90]
call fcn.14001b500
mov dword [rsp + 0x360], eax
cmp dword [rsp + 0x360], 0
jne 0x14001a3c9
mov rdx, qword [rsp + 0x358]
mov rdx, qword [rdx]
lea rcx, [rsp + 0x378]
call fcn.140012e40
nop
lea r8, [rsp + 0x378]
mov rdx, qword [rsp + 0x358]
mov rdx, qword [rdx + 0x18]
mov rcx, qword [rsp + 0x3b0]
call fcn.140019b00
nop
lea rcx, [rsp + 0x378]
call fcn.140012ea0
jmp 0x14001a410
cmp dword [rsp + 0x360], 2
je 0x14001a410
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
mov r9d, dword [rsp + 0x360]
mov r8, qword [rsp + 0x358]
mov r8, qword [r8 + 0x10]
lea rdx, str._EnumUserInfo::LoadProfilePath__RegQueryValue__s___err__u_
lea rcx, [0x1403749c0]
call fcn.14002d6f0
jmp 0x14001a2ff
mov rcx, qword [rsp + 0x3b0]
add rcx, 0x50
lea r8, [rsp + 0x2c0]
mov rdx, qword [rsp + 0x2c0]
call fcn.14001c6a0
nop
lea rcx, [rsp + 0x90]
call fcn.14001b400
nop
lea rcx, [rsp + 0xa0]
call fcn.140012ea0
jmp 0x140019fb3
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x380], eax
lea rcx, [rsp + 0x68]
call fcn.14001b400
nop
lea rcx, [rsp + 0x80]
call fcn.140012ea0
mov eax, dword [rsp + 0x380]
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.14028a900
add rsp, 0x3a0
pop rdi
ret