Function at 0x1400391a0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov r12, rdx
mov r13, rcx
xor ebx, ebx
mov dword [rbp + 0x77], ebx
mov dword [rbp + 0x67], ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14003921d
mov dword [r12], eax
mov byte [r12 + 0x18], bl
jmp 0x14003951d
mov eax, dword [rbp + 0x67]
inc eax
mov dword [rbp + 0x67], eax
mov ecx, eax
mov eax, 2
mul rcx
mov rdi, rax
mov rax, 0xffffffffffffffff
cmovb rdi, rax
mov rcx, rdi
call fcn.14000d790
mov r14, rax
test rax, rax
je 0x14003925c
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.1400a6950
jmp 0x14003925f
mov r14, rbx
mov qword [rbp - 0x19], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x11], xmm0
mov r15, rbx
mov qword [rbp - 1], rbx
mov ecx, dword [rbp + 0x77]
mov qword [rbp + 0x7f], rcx
test ecx, ecx
je 0x140039291
lea rdx, [rbp + 0x7f]
lea rcx, [rbp - 0x11]
call fcn.140056630
mov ecx, dword [rbp + 0x77]
mov r15, qword [rbp - 1]
mov esi, ebx
mov rdi, qword [rbp - 9]
test ecx, ecx
je 0x14003932c
nop
mov eax, dword [rbp + 0x67]
mov dword [rbp + 0x7f], eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x7f]
mov r8, r14
mov edx, esi
mov rcx, qword [r13]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400393aa
mov qword [rbp - 0x21], r14
cmp rdi, r15
je 0x140039305
mov r8d, dword [rbp + 0x7f]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbx
mov rdx, r14
mov rcx, rdi
call fcn.140030bc0
add rdi, 0x20
mov qword [rbp - 9], rdi
jmp 0x140039321
lea r9, [rbp + 0x7f]
lea r8, [rbp - 0x21]
mov rdx, rdi
lea rcx, [rbp - 0x11]
call fcn.14005c530
mov r15, qword [rbp - 1]
mov rdi, qword [rbp - 9]
inc esi
cmp esi, dword [rbp + 0x77]
jb 0x1400392a0
mov qword [r12], rbx
mov qword [r12 + 8], rbx
mov qword [r12 + 0x10], rbx
mov rsi, rdi
mov r13, qword [rbp - 0x11]
sub rsi, r13
sar rsi, 5
test rsi, rsi
je 0x1400394cc
movabs rax, 0x7ffffffffffffff
cmp rsi, rax
ja 0x140039541
shl rsi, 5
test rsi, rsi
je 0x140039476
cmp rsi, 0x1000
jb 0x14003946b
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x14003954d
call fcn.14000d790
test rax, rax
je 0x140039553
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140039476
mov dword [r12], eax
mov byte [r12 + 0x18], 0
mov r13, qword [rbp - 0x11]
test r13, r13
je 0x140039454
mov rsi, r13
cmp r13, rdi
je 0x140039423
nop dword [rax]
mov rax, qword [rsi + 0x18]
cmp rax, 7
jbe 0x14003940b
mov rcx, qword [rsi]
lea rax, [rax*2 + 2]
cmp rax, 0x1000
jb 0x140039405
mov rdx, qword [rcx - 8]
sub rcx, rdx
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140039547
mov rcx, rdx
call fcn.14000da60
nop
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 7
mov word [rsi], bx
add rsi, 0x20
cmp rsi, rdi
jne 0x1400393d0
sub r15, r13
and r15, 0xffffffffffffffe0
mov rax, r13
cmp r15, 0x1000
jb 0x14003944b
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039547
mov rcx, r13
call fcn.14000da60
nop
test r14, r14
je 0x14003951d
mov rcx, r14
call fcn.14000da60
nop
jmp 0x14003951d
mov rcx, rsi
call fcn.14000d790
mov rbx, rax
mov qword [r12], rbx
mov qword [r12 + 8], rbx
lea rcx, [rsi + rbx]
mov qword [r12 + 0x10], rcx
mov qword [rbp + 0x7f], r12
mov rsi, r13
mov qword [rbp + 7], rbx
mov qword [rbp + 0xf], rbx
mov qword [rbp + 0x17], r12
cmp r13, rdi
je 0x1400394bc
mov rdx, rsi
mov rcx, rbx
call fcn.140051930
add rbx, 0x20
mov qword [rbp + 0xf], rbx
add rsi, 0x20
cmp rsi, rdi
jne 0x1400394a0
mov rdx, rbx
mov rcx, rbx
call fcn.140030cf0
mov qword [r12 + 8], rbx
mov byte [r12 + 0x18], 1
test r13, r13
je 0x14003950f
mov rdx, rdi
mov rcx, r13
call fcn.140030cf0
sub r15, r13
and r15, 0xffffffffffffffe0
mov rax, r13
cmp r15, 0x1000
jb 0x140039506
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003953b
mov rcx, r13
call fcn.14000da60
nop
test r14, r14
je 0x14003951d
mov rcx, r14
call fcn.14000da60
nop
mov rax, r12
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140087d64
nop
call fcn.140002050
nop
call fcn.140087d64
nop
call fcn.140001160
int3
call fcn.140087d64
int3