Function at 0x14000d810
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rax - 0x57]
sub rsp, 0xc0
mov qword [rbp + 0x37], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rsi, rdx
mov byte [rbp - 0x21], 0
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 1], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor ebx, ebx
or rdi, 0xffffffffffffffff
test eax, eax
je 0x14000d931
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 9], rbx
test rsi, rsi
je 0x14000d8d2
test rsi, 0xffffffffffff0000
jne 0x14000d8bb
movzx eax, si
mov dword [rbp - 0x19], eax
mov ecx, eax
call fcn.140003200
test rax, rax
je 0x14000d8e7
mov r8d, dword [rbp - 0x19]
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.14000a630
jmp 0x14000d8e3
xor eax, eax
mov rcx, rdi
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
or rdi, 0xffffffffffffffff
jmp 0x14000d8d4
xor ecx, ecx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rbp - 9]
call fcn.14000a480
mov rbx, qword [rbp - 9]
test rbx, rbx
jne 0x14000d8f0
xor ecx, ecx
jmp 0x14000d905
xor eax, eax
mov rcx, rdi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
or rdi, 0xffffffffffffffff
mov r8d, ecx
mov rdx, rbx
lea rcx, [rbp - 1]
call fcn.14000a480
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000d92f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor ebx, ebx
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x14000da26
mov r8d, 1
lea rdx, [0x140044da0]
lea rcx, [rbp - 1]
call fcn.14000ede0
mov rsi, qword [rbp + 0x6f]
test rsi, rsi
jne 0x14000d966
mov ecx, ebx
jmp 0x14000d977
xor eax, eax
mov rcx, rdi
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rbp - 1]
call fcn.14000ede0
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 0xf], rbx
test rsi, rsi
je 0x14000d9e1
test rsi, 0xffffffffffff0000
jne 0x14000d9cd
movzx edi, si
mov ecx, edi
call fcn.140003200
test rax, rax
je 0x14000d9f6
mov r8d, edi
mov rdx, rax
lea rcx, [rbp + 0xf]
call fcn.14000a630
jmp 0x14000d9f2
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x14000d9e3
xor ecx, ecx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rbp + 0xf]
call fcn.14000a480
mov rbx, qword [rbp + 0xf]
test rbx, rbx
jne 0x14000d9ff
xor ecx, ecx
jmp 0x14000da11
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rbx
mov rcx, qword [rbp + 0x77]
call fcn.14000a480
nop
jmp 0x14000dac0
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 7], rbx
test rsi, rsi
je 0x14000da80
test rsi, 0xffffffffffff0000
jne 0x14000da6d
movzx edi, si
mov ecx, edi
call fcn.140003200
test rax, rax
je 0x14000da95
mov r8d, edi
mov rdx, rax
lea rcx, [rbp + 7]
call fcn.14000a630
jmp 0x14000da91
xor eax, eax
mov rcx, rdi
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x14000da82
xor ecx, ecx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rbp + 7]
call fcn.14000a480
mov rbx, qword [rbp + 7]
test rbx, rbx
jne 0x14000da9e
xor ecx, ecx
jmp 0x14000dab0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rbx
mov rcx, qword [rbp + 0x77]
call fcn.14000a480
nop
lea rdx, [rbx - 0x18]
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000dade
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
movzx esi, byte [rbp + 0x7f]
movzx r8d, sil
mov rdi, qword [rbp - 1]
mov rdx, rdi
mov rcx, qword [rbp + 0x5f]
call fcn.14000d360
mov qword [rbp + 0x27], rax
test rax, rax
je 0x14000dc99
mov byte [rbp - 0x21], 1
xor edx, edx
mov dword [rbp - 0x15], edx
mov dword [rbp - 0x1d], edx
mov dword [rbp - 0x11], edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdx
lea rcx, [rbp - 0x15]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x1d]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [rbp - 0x11], 0
jbe 0x14000db73
mov r8, qword [rbp + 0x77]
add r8, 8
movzx r9d, sil
mov rdx, rdi
mov rcx, qword [rbp + 0x5f]
call fcn.14000d550
cmp dword [rbp - 0x1d], 0
jbe 0x14000dc8e
mov eax, dword [rbp - 0x15]
inc eax
mov dword [rbp - 0x15], eax
mov ecx, eax
mov eax, 2
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.14002560c
mov rsi, rax
mov qword [rbp + 0x1f], rax
test rax, rax
je 0x14000dc8e
xor edx, edx
mov word [rax], dx
mov eax, edx
mov dword [rbp - 0x19], edx
cmp dword [rbp - 0x1d], edx
jbe 0x14000dc86
nop
mov ecx, dword [rbp - 0x15]
mov dword [rbp + 0x17], ecx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x17]
mov r8, rsi
mov edx, eax
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000dc63
lea ecx, [rax + 0x48]
call fcn.140026be8
test rax, rax
je 0x14000dc06
mov rcx, rax
call fcn.14000c770
mov rsi, rax
movzx eax, byte [rbp + 0x7f]
mov byte [rsp + 0x20], al
mov r9, rsi
mov r8, qword [rbp + 0x1f]
mov rdx, rdi
mov rcx, qword [rbp + 0x5f]
call fcn.14000d810
mov rbx, qword [rbp + 0x77]
mov rax, qword [rbx + 0x30]
mov qword [rbp + 0x2f], rax
cmp rax, qword [rbx + 0x38]
jb 0x14000dc47
lea rdx, [rax + 1]
lea rcx, [rbx + 0x28]
call fcn.14000f180
test al, al
je 0x14000dc77
mov rax, qword [rbx + 0x28]
mov rcx, qword [rbp + 0x2f]
lea rcx, [rax + rcx*8]
test rcx, rcx
je 0x14000dc5b
mov qword [rcx], rsi
inc qword [rbx + 0x30]
mov rsi, qword [rbp + 0x1f]
mov eax, dword [rbp - 0x19]
inc eax
mov dword [rbp - 0x19], eax
cmp eax, dword [rbp - 0x1d]
jae 0x14000dc82
xor edx, edx
jmp 0x14000dbc0
mov ecx, 0x8007000e
call fcn.1400030f0
int3
or rbx, 0xffffffffffffffff
mov rcx, rsi
call fcn.1400268f8
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x14000dcb1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
movzx eax, byte [rbp - 0x21]
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret