Function at 0x14000721b
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14007ea50
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x968
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x18a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x988]
mov rax, qword [0x140289140]
xor rax, rbp
mov qword [rbp + 0x918], rax
lea rcx, [0x1402ac2b2]
call fcn.140007f72
nop
mov rcx, qword [rbp + 0x940]
call fcn.1400019c9
lea rcx, [rbp + 8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14007ecf2
mov dword [rbp + 0x24], 0
xor eax, eax
cmp eax, 1
je 0x14007ece5
mov dword [rbp + 0x584], pe_nt_image_headers64
mov dword [rbp + 0x5a4], 0x400
lea rax, [rbp + 0x5a4]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x170]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x5c4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x584]
lea r8, [rbp + 0x50]
mov edx, dword [rbp + 0x24]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x14007eb44
jmp 0x14007ece5
lea rdx, [0x14022c4b8]
lea rcx, [0x14028c490]
call fcn.140001bae
lea rdx, [rbp + 0x50]
mov rcx, rax
call fcn.140001bae
lea rdx, [0x14022c4b4]
mov rcx, rax
call fcn.140001bae
nop
cmp dword [rbp + 0x5c4], 1
jne 0x14007ec33
lea rdx, [0x14022c4c8]
lea rcx, [0x14028c490]
call fcn.140001bae
nop
mov dword [rbp + 0x5e4], 0
jmp 0x14007ebae
mov eax, dword [rbp + 0x5e4]
inc eax
mov dword [rbp + 0x5e4], eax
mov eax, dword [rbp + 0x5a4]
cmp dword [rbp + 0x5e4], eax
jae 0x14007ec1a
mov eax, dword [rbp + 0x5e4]
movzx ecx, byte [rbp + rax + 0x170]
call fcn.140003abc
movzx eax, al
test eax, eax
je 0x14007ebf3
mov eax, dword [rbp + 0x5e4]
movzx edx, byte [rbp + rax + 0x170]
lea rcx, [0x14028c490]
call fcn.140006285
nop
jmp 0x14007ec18
mov ecx, 4
call fcn.140003297
nop
mov dl, 0x2e
lea rcx, [0x14028c490]
call fcn.140006285
nop
mov ecx, 7
call fcn.140003297
nop
jmp 0x14007eba0
lea rdx, [0x14022c4b4]
lea rcx, [0x14028c490]
call fcn.140001bae
nop
jmp 0x14007ecd8
cmp dword [rbp + 0x5c4], 3
jne 0x14007ecd8
lea rdx, [0x14022c4c8]
lea rcx, [0x14028c490]
call fcn.140001bae
nop
mov dword [rbp + 0x604], 0
jmp 0x14007ec6e
mov eax, dword [rbp + 0x604]
inc eax
mov dword [rbp + 0x604], eax
mov eax, dword [rbp + 0x5a4]
cmp dword [rbp + 0x604], eax
jae 0x14007ecc4
mov eax, dword [rbp + 0x604]
movzx ecx, byte [rbp + rax + 0x170]
call fcn.140003abc
movzx eax, al
test eax, eax
je 0x14007ecb3
mov eax, dword [rbp + 0x604]
movzx edx, byte [rbp + rax + 0x170]
lea rcx, [0x14028c490]
call fcn.140006285
nop
jmp 0x14007ecc2
mov dl, 0x2e
lea rcx, [0x14028c490]
call fcn.140006285
nop
jmp 0x14007ec60
lea rdx, [0x14022c4b4]
lea rcx, [0x14028c490]
call fcn.140001bae
nop
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
jmp 0x14007ead7
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x14007ed24
lea rdx, [0x14022c4e8]
lea rcx, [0x14028c490]
call fcn.140001bae
mov rdx, qword [rbp + 0x940]
mov rcx, rax
call fcn.1400071da
lea rdx, [0x14022c4b4]
mov rcx, rax
call fcn.140001bae
nop
lea rcx, [rbp - 0x40]
lea rdx, [0x140225d70]
call fcn.140006b90
mov rcx, qword [rbp + 0x918]
xor rcx, rbp
call fcn.1400044d0
lea rsp, [rbp + 0x928]
pop rdi
pop rbp
ret