Function at 0x1400134c0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rbx, rcx
xor edx, edx
lea rcx, [rbp + 0x1a0]
mov r8d, 0x208
call fcn.1400452a0
xor r12d, r12d
mov dword [rsp + 0x70], 0x104
mov rdx, rbx
mov dword [rbp + 0x400], r12d
lea rcx, [rbp + 0x3f8]
mov qword [rbp + 0x3f8], r12
call fcn.140011c30
mov r14, qword [rbp + 0x3f8]
lea rax, [rsp + 0x68]
mov rdx, r14
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140013571
test r14, r14
je 0x140013882
mov rdi, 0xffffffffffffffff
nop word [rax + rax]
cmp word [r14 + rdi*2 + 2], r12w
lea rdi, [rdi + 1]
jne 0x140013560
jmp 0x14001386c
mov rcx, qword [rsp + 0x68]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x70]
lea rax, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rdx, [rbp + 0x1a0]
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov rdi, 0xffffffffffffffff
test eax, eax
jne 0x14001384f
mov eax, dword [rbp + 0x400]
test eax, eax
je 0x14001384f
mov r15d, r12d
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x74]
mov qword [rsp + 0x30], r12
lea r8, [rbp - 0x60]
mov qword [rsp + 0x28], r12
mov edx, r15d
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x74], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001383f
mov rcx, rdi
inc rcx
cmp word [r14 + rcx*2], r12w
jne 0x140013642
lea rdx, [rbp - 0x60]
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r12w
jne 0x140013653
add rcx, rax
lea rcx, [rcx*2 + 2]
call fcn.1400462e4
mov rsi, rax
test rax, rax
je 0x1400136c2
mov r8, rax
mov rdx, r14
sub r8, r14
nop
movzx ecx, word [rdx]
mov word [r8 + rdx], cx
lea rdx, [rdx + 2]
test cx, cx
jne 0x140013680
add rax, 0xfffffffffffffffe
cmp word [rax + 2], r12w
lea rax, [rax + 2]
jne 0x140013695
lea r8, [rbp - 0x60]
xor edx, edx
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x1400136b0
lea rax, [rsp + 0x60]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, rsi
mov ebx, eax
call fcn.1400462d0
test ebx, ebx
jne 0x14001383f
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x3f8]
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x408]
mov dword [rbp + 0x408], 1
lea rdx, [0x140083b50]
mov dword [rbp + 0x3f8], 0x400
call fcn.1400277c0
test eax, eax
jne 0x140013834
mov eax, dword [rbp + 0x3f8]
test eax, eax
je 0x140013834
mov ecx, eax
and rcx, 0xfffffffffffffffe
add rcx, 2
call fcn.1400462e4
mov rbx, rax
test rax, rax
je 0x140013834
mov ecx, dword [rbp + 0x3f8]
lea r8, [rbp + 0x408]
shr rcx, 1
lea rdx, [0x140083b50]
mov r9, rbx
mov word [rax + rcx*2], r12w
lea rax, [rbp + 0x3f8]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.1400277c0
mov rcx, rdi
nop dword [rax + rax]
cmp word [rbx + rcx*2 + 2], r12w
lea rcx, [rcx + 1]
jne 0x1400137a0
lea rcx, [rcx*2 + 2]
call fcn.1400462e4
mov rsi, rax
test rax, rax
je 0x140013812
mov rdx, rbx
sub rax, rbx
nop word [rax + rax]
movzx ecx, word [rdx]
mov word [rax + rdx], cx
lea rdx, [rdx + 2]
test cx, cx
jne 0x1400137d0
mov rcx, rsi
call fcn.14002af50
test al, al
je 0x1400138a0
mov r8, rdi
inc r8
cmp word [rsi + r8*2], r12w
jne 0x1400137f3
add r8, r8
xor edx, edx
mov rcx, rsi
call fcn.1400452a0
mov rcx, rsi
call fcn.1400462d0
mov r8, rdi
inc r8
cmp word [rbx + r8*2], r12w
jne 0x140013815
add r8, r8
xor edx, edx
mov rcx, rbx
call fcn.1400452a0
mov rcx, rbx
call fcn.1400462d0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r15d
cmp r15d, dword [rbp + 0x400]
jb 0x140013600
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x140013882
nop
cmp word [r14 + rdi*2 + 2], r12w
lea rdi, [rdi + 1]
jne 0x140013860
lea r8, [rdi + rdi]
xor edx, edx
mov rcx, r14
call fcn.1400452a0
mov rcx, r14
call fcn.1400462d0
xor eax, eax
add rsp, 0x4b0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp word [rbx + rdi*2 + 2], r12w
lea rdi, [rdi + 1]
jne 0x1400138a0
lea r8, [rdi + rdi]
xor edx, edx
mov rcx, rbx
call fcn.1400452a0
mov rcx, rbx
call fcn.1400462d0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rsi
jmp 0x140013884