Function at 0x14001b6c0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rax, qword [0x1400920a0]
xor rax, rsp
mov qword [rbp + 0x470], rax
mov rsi, r8
mov rbx, rcx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x38], r8
xor r14d, r14d
mov dword [rsp + 0x60], r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [rsp + 0x60], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x260]
call fcn.14003f8d0
mov dword [rsp + 0x68], 0x104
mov dword [rsp + 0x64], r14d
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14001b745
mov rdx, qword [rsi]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001bb8b
lea rax, [rbp - 0x70]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x260]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14001bb8b
lea r9, [rbp + 0x5a]
mov r8d, dword [rsp + 0x64]
nop dword [rax]
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x14001b7f0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
lea rax, [rbp + 0x5a]
cmp r9, rax
je 0x14001b854
lea r8, [rbp + 0x5a]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp - 0x30]
call fcn.140007c30
mov dword [rsp + 0x60], 7
mov rcx, qword [rsi + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 9
jb 0x14001bc0c
mov rax, rsi
cmp qword [rsi + 0x18], 8
jb 0x14001b884
mov rax, qword [rsi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.Reg_key:
lea rcx, [rbp + 0x10]
call fcn.14000a330
mov dword [rsp + 0x60], 0xf
mov r8d, 5
lea rdx, str._has
lea rcx, [rbp + 0x10]
call fcn.14000b400
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov dword [rsp + 0x60], 0x1f
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.14001c7b0
mov dword [rsp + 0x60], 0x3f
mov r8d, 8
lea rdx, str._subkeys
lea rcx, [rbp - 0x10]
call fcn.14000b400
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov dword [rsp + 0x60], 0x7f
lea rcx, [rbp - 0x68]
call fcn.14002e330
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x14001b998
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b993
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bc12
call fcn.14003cd90
mov qword [rbp], r14
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r14w
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x14001b9ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b9e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bc18
call fcn.14003cd90
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x14001ba2a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ba25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bc1e
call fcn.14003cd90
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r14w
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001ba7b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ba76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bc24
call fcn.14003cd90
mov edi, r14d
cmp dword [rsp + 0x64], r14d
jbe 0x14001bb8b
nop dword [rax]
mov dword [rsp + 0x6c], 0xff
lea rax, [rbp - 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x6c]
lea r8, [rbp + 0x60]
mov edx, edi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001bb7f
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
lea rax, [rbp + 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14001baf0
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x30]
call fcn.140007c30
nop
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x14001bb33
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rbp - 0x30], r14w
add qword [rbx + 8], 0x20
jmp 0x14001bb43
lea r8, [rbp - 0x30]
mov rcx, rbx
call fcn.14001c550
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001bb7f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bb7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bc00
call fcn.14003cd90
inc edi
cmp edi, dword [rsp + 0x64]
jb 0x14001ba90
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14001bbc6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14001bbc1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001bc06
mov rcx, r8
call fcn.14003cd90
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 7
mov word [rsi], r14w
mov rax, rbx
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.14003cd70
lea r11, [rsp + 0x580]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14004f8c4
nop
call fcn.14004f8c4
nop
call fcn.140001350
nop
call fcn.14004f8c4
nop
call fcn.14004f8c4
nop
call fcn.14004f8c4
nop
call fcn.14004f8c4
int3