Function at 0x18005f9ec
Capabilities:
Get file attributes
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x408]
sub rsp, 0x508
mov rax, qword [0x18008ab58]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
mov rax, qword [rbp + 0x470]
mov rbx, r8
mov qword [rbp - 0x60], rax
mov r14d, edx
mov rax, qword [rbp + 0x478]
mov r12, rcx
mov dword [rsp + 0x64], edx
lea rcx, [rbp - 0x50]
xor r15d, r15d
mov qword [rbp - 0x68], rax
xor edx, edx
mov qword [rsp + 0x78], rbx
mov r8d, 0x230
mov qword [rbp - 0x80], r15
mov r13d, r9d
call sub.msvcrt.dll_memset
mov r8, rbx
mov word [rbp + 0x1e0], r15w
mov rdx, r12
lea rcx, [rbp - 0x80]
mov esi, r15d
call fcn.18006014c
mov ebx, eax
test eax, eax
jne 0x1800600cd
mov rdi, qword [rbp - 0x80]
test rdi, rdi
je 0x1800600cd
mov r15d, dword [0x18008b2a0]
xor ebx, ebx
test rdi, rdi
je 0x18005fabe
mov rax, qword [rdi + 8]
mov rcx, rdi
mov rsi, qword [rdi]
mov qword [rsp + 0x78], rax
mov rdi, qword [rdi + 0x10]
mov qword [rbp - 0x80], rdi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov r8, qword [rsp + 0x78]
lea eax, [r13 - 4]
test eax, 0xfffffff7
mov dword [rsp + 0x68], ebx
lea rax, [rsp + 0x68]
mov r9d, r13d
cmovne rax, rbx
mov edx, r14d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.18006124c
mov ebx, eax
cmp eax, 0x20
ja 0x18005fb07
movabs rcx, 0x10000006c
bt rcx, rbx
jb 0x1800600f3
cmp ebx, 0x780
je 0x1800600f3
xor r15d, r15d
test eax, eax
jne 0x1800600c4
mov ecx, r13d
mov qword [rsp + 0x70], r15
sub ecx, 1
je 0x18005fde9
sub ecx, 3
je 0x18005fb3d
cmp ecx, 8
jne 0x180060077
cmp dword [rsp + 0x68], r15d
je 0x180060077
lea r9, [rbp - 0x70]
mov r8d, 0x20019
mov rdx, rsi
mov ecx, r13d
call fcn.18005cd24
mov ebx, eax
test eax, eax
jne 0x18005fdcf
mov rcx, qword [rbp - 0x70]
lea rax, [rbp - 0x78]
xor r14d, r14d
xor r9d, r9d
mov qword [rsp + 0x58], r14
xor r8d, r8d
mov qword [rsp + 0x50], r14
xor edx, edx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], r14d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x18005fbe4
mov r9, rsi
lea ecx, [r14 + 1]
mov r8d, 0x1c6d
mov edx, eax
call fcn.180038d90
mov eax, r14d
mov ecx, r14d
mov dword [rsp + 0x68], eax
mov ebx, r14d
mov dword [rbp - 0x78], ecx
jmp 0x18005fbeb
mov eax, dword [rsp + 0x68]
mov ecx, dword [rbp - 0x78]
test eax, eax
je 0x18005fdba
test ecx, ecx
je 0x18005fdba
mov rcx, qword [rbp - 0x70]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x1e0]
mov qword [rsp + 0x30], r14
mov edx, r15d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x60], 0x104
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x18005fd88
inc r15d
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rsi + rcx*2], r14w
jne 0x18005fc47
mov eax, dword [rsp + 0x60]
inc eax
add eax, ecx
xor ecx, ecx
mov dword [rsp + 0x60], eax
lea edx, [rax + 1]
add rdx, rdx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x18005fd81
mov edx, dword [rsp + 0x60]
lea rax, [rbp + 0x1e0]
inc edx
mov qword [rsp + 0x20], rax
mov r9, rsi
lea r8, str._s_s
mov rcx, r14
call qword [sym.imp.msvcrt.dll_swprintf_s]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
xor edi, edi
mov rax, qword [rbp - 0x68]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov rax, qword [rbp - 0x60]
mov rcx, r14
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], eax
mov byte [rsp + 0x20], 1
mov qword [rsp + 0x70], rdi
call fcn.180060ebc
mov ebx, eax
test eax, eax
jne 0x18005fd15
mov r8, qword [rsp + 0x70]
lea rcx, [rbp - 0x80]
mov rdx, r14
call fcn.18006014c
mov ebx, eax
test eax, eax
jne 0x18005fd33
xor r14d, r14d
jmp 0x18005fbfb
cmp eax, 5
jne 0x18005fd2f
mov r9, r14
lea ecx, [rax - 4]
mov edx, eax
mov r8d, 0x1c72
call fcn.180038d90
mov ebx, edi
test ebx, ebx
je 0x18005fd48
mov r9, r14
mov r8d, 0x1c77
mov edx, ebx
mov ecx, 1
call fcn.180038d90
cmp qword [rsp + 0x70], rdi
je 0x18005fd65
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_RtlDeleteSecurityObject]
nop dword [rax + rax]
mov qword [rsp + 0x70], rdi
mov rcx, r14
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
xor r14d, r14d
test ebx, ebx
je 0x18005fbfb
jmp 0x18005fdb6
mov ebx, 8
jmp 0x18005fd90
cmp edi, 0x103
je 0x18005fdb6
test edi, edi
je 0x18005fdb6
cmp edi, 0x103
je 0x18005fdb6
mov r9, rsi
mov r8d, 0x1c39
mov edx, edi
mov ecx, 1
call fcn.180038d90
test ebx, ebx
cmove ebx, edi
mov rdi, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x18006006f
mov r9, rsi
mov r8d, 0x1c6a
mov edx, eax
mov ecx, 1
call fcn.180038d90
jmp 0x180060077
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r15w
jne 0x18005fded
add eax, 4
xor ecx, ecx
mov dword [rsp + 0x60], eax
lea edx, [rax + 1]
add rdx, rdx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x18005fe22
lea ebx, [rax + 8]
jmp 0x180060072
mov edx, dword [rsp + 0x60]
lea r8, str._s.
inc edx
mov r9, rsi
mov rcx, r14
call qword [sym.imp.msvcrt.dll_swprintf_s]
nop dword [rax + rax]
lea rdx, [rbp - 0x50]
mov rcx, r14
call qword [sym.imp.msvcrt.dll__wfindfirst64]
nop dword [rax + rax]
mov rcx, r14
mov r15, rax
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
cmp r15, 0xffffffffffffffff
je 0x18006006f
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
bt eax, 0xa
jb 0x180060060
xor edx, edx
cmp word [rbp - 0x28], 0x2e
jne 0x18005feaf
movzx eax, word [rbp - 0x26]
test ax, ax
je 0x180060038
cmp ax, 0x2e
jne 0x18005feaf
cmp word [rbp - 0x24], dx
je 0x180060038
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rsi + rcx*2], dx
jne 0x18005feb3
lea r8, [rbp - 0x28]
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], dx
jne 0x18005fec4
inc ecx
add eax, ecx
xor ecx, ecx
mov dword [rsp + 0x60], eax
lea edx, [rax + 1]
add rdx, rdx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x180060057
mov edx, dword [rsp + 0x60]
lea rax, [rbp - 0x28]
inc edx
mov qword [rsp + 0x20], rax
mov r9, rsi
lea r8, str._s_s
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_swprintf_s]
nop dword [rax + rax]
mov cl, byte [rbp - 0x50]
lea rax, [rsp + 0x70]
mov r14d, dword [rsp + 0x64]
and cl, 0x10
mov rdx, qword [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], r14d
mov byte [rsp + 0x20], cl
mov rcx, rdi
mov qword [rsp + 0x70], rbx
call fcn.180060ebc
mov ebx, eax
test eax, eax
jne 0x18005ffeb
test byte [rbp - 0x50], 0x10
mov r8, qword [rsp + 0x70]
je 0x18005ff98
mov rdx, rdi
lea rcx, [rbp - 0x80]
call fcn.18006014c
mov ebx, eax
test eax, eax
jne 0x180060005
jmp 0x180060038
and qword [rsp + 0x20], 0
mov r9d, 1
mov edx, r14d
mov rcx, rdi
call fcn.18006124c
mov ebx, eax
cmp eax, 0x20
ja 0x18005ffc6
movabs rcx, 0x10000006c
bt rcx, rbx
jb 0x18005ffce
cmp ebx, 0x780
jne 0x180060005
mov eax, dword [0x18008b2a0]
mov rdx, qword gs:[0x58]
mov ecx, 0x18
mov rax, qword [rdx + rax*8]
mov dword [rcx + rax], ebx
jmp 0x180060003
cmp eax, 5
jne 0x180060005
mov r9, rdi
lea ecx, [rax - 4]
mov edx, eax
mov r8d, 0x1c72
call fcn.180038d90
xor ebx, ebx
cmp qword [rsp + 0x70], 0
je 0x180060025
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_RtlDeleteSecurityObject]
nop dword [rax + rax]
xor eax, eax
mov qword [rsp + 0x70], rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
test ebx, ebx
jne 0x18006005c
lea rdx, [rbp - 0x50]
mov rcx, r15
call qword [sym.imp.msvcrt.dll__wfindnext64]
nop dword [rax + rax]
xor edx, edx
test eax, eax
je 0x18005fe8b
jmp 0x18006005c
mov ebx, 8
mov rdi, qword [rbp - 0x80]
mov rcx, r15
call qword [sym.imp.msvcrt.dll__findclose]
nop dword [rax + rax]
xor r15d, r15d
mov r14d, dword [rsp + 0x64]
cmp rsi, r12
je 0x1800600b0
test rsi, rsi
je 0x180060090
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rsi, r15
cmp qword [rsp + 0x78], r15
je 0x1800600b0
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntdll.dll_RtlDeleteSecurityObject]
nop dword [rax + rax]
mov qword [rsp + 0x78], r15
mov r15d, dword [0x18008b2a0]
test rdi, rdi
jne 0x18005fa94
test ebx, ebx
je 0x1800600cd
lea rcx, [rbp - 0x80]
call fcn.18005f980
mov eax, ebx
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.180002a90
add rsp, 0x508
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword gs:[0x58]
mov ecx, 0x18
mov rax, qword [rax + r15*8]
mov dword [rcx + rax], ebx
cmp rsi, r12
je 0x1800600b7
test rsi, rsi
je 0x180060121
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
xor esi, esi
cmp qword [rsp + 0x78], rsi
je 0x1800600b7
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntdll.dll_RtlDeleteSecurityObject]
nop dword [rax + rax]
and qword [rsp + 0x78], rsi
jmp 0x1800600b7