Function at 0x14001b5e0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rax, qword [0x1400920a0]
xor rax, rsp
mov qword [rbp + 0x470], rax
mov rsi, r8
mov rbx, rcx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x38], r8
xor r14d, r14d
mov dword [rsp + 0x60], r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [rsp + 0x60], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x260]
call fcn.14003f840
mov dword [rsp + 0x68], 0x104
mov dword [rsp + 0x64], r14d
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14001b665
mov rdx, qword [rsi]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001baab
lea rax, [rbp - 0x70]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x260]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14001baab
lea r9, [rbp + 0x5a]
mov r8d, dword [rsp + 0x64]
nop dword [rax]
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x14001b710
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
lea rax, [rbp + 0x5a]
cmp r9, rax
je 0x14001b774
lea r8, [rbp + 0x5a]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp - 0x30]
call fcn.140007c30
mov dword [rsp + 0x60], 7
mov rcx, qword [rsi + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 9
jb 0x14001bb2c
mov rax, rsi
cmp qword [rsi + 0x18], 8
jb 0x14001b7a4
mov rax, qword [rsi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.Reg_key:
lea rcx, [rbp + 0x10]
call fcn.14000a330
mov dword [rsp + 0x60], 0xf
mov r8d, 5
lea rdx, str._has
lea rcx, [rbp + 0x10]
call fcn.14000b400
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov dword [rsp + 0x60], 0x1f
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.14001c6d0
mov dword [rsp + 0x60], 0x3f
mov r8d, 8
lea rdx, str._subkeys
lea rcx, [rbp - 0x10]
call fcn.14000b400
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov dword [rsp + 0x60], 0x7f
lea rcx, [rbp - 0x68]
call fcn.14002e270
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x14001b8b8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b8b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bb32
call fcn.14003cd00
mov qword [rbp], r14
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r14w
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x14001b90a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b904
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bb38
call fcn.14003cd00
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x14001b94a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b945
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bb3e
call fcn.14003cd00
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r14w
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001b99b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b996
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bb44
call fcn.14003cd00
mov edi, r14d
cmp dword [rsp + 0x64], r14d
jbe 0x14001baab
nop dword [rax]
mov dword [rsp + 0x6c], 0xff
lea rax, [rbp - 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x6c]
lea r8, [rbp + 0x60]
mov edx, edi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001ba9f
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
lea rax, [rbp + 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14001ba10
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x30]
call fcn.140007c30
nop
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x14001ba53
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rbp - 0x30], r14w
add qword [rbx + 8], 0x20
jmp 0x14001ba63
lea r8, [rbp - 0x30]
mov rcx, rbx
call fcn.14001c470
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001ba9f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ba9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bb20
call fcn.14003cd00
inc edi
cmp edi, dword [rsp + 0x64]
jb 0x14001b9b0
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14001bae6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14001bae1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001bb26
mov rcx, r8
call fcn.14003cd00
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 7
mov word [rsi], r14w
mov rax, rbx
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.14003cce0
lea r11, [rsp + 0x580]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14004f834
nop
call fcn.14004f834
nop
call fcn.140001350
nop
call fcn.14004f834
nop
call fcn.14004f834
nop
call fcn.14004f834
nop
call fcn.14004f834
int3