Function at 0x14000e810
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rax - 0x57]
sub rsp, 0xc0
mov qword [rbp + 0x37], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rsi, rdx
mov byte [rbp - 0x21], 0
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 1], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor ebx, ebx
or rdi, 0xffffffffffffffff
test eax, eax
je 0x14000e931
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 9], rbx
test rsi, rsi
je 0x14000e8d2
test rsi, 0xffffffffffff0000
jne 0x14000e8bb
movzx eax, si
mov dword [rbp - 0x19], eax
mov ecx, eax
call fcn.140004200
test rax, rax
je 0x14000e8e7
mov r8d, dword [rbp - 0x19]
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.14000b630
jmp 0x14000e8e3
xor eax, eax
mov rcx, rdi
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
or rdi, 0xffffffffffffffff
jmp 0x14000e8d4
xor ecx, ecx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rbp - 9]
call fcn.14000b480
mov rbx, qword [rbp - 9]
test rbx, rbx
jne 0x14000e8f0
xor ecx, ecx
jmp 0x14000e905
xor eax, eax
mov rcx, rdi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
or rdi, 0xffffffffffffffff
mov r8d, ecx
mov rdx, rbx
lea rcx, [rbp - 1]
call fcn.14000b480
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e92f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor ebx, ebx
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x14000ea26
mov r8d, 1
lea rdx, [0x140045da0]
lea rcx, [rbp - 1]
call fcn.14000fde0
mov rsi, qword [rbp + 0x6f]
test rsi, rsi
jne 0x14000e966
mov ecx, ebx
jmp 0x14000e977
xor eax, eax
mov rcx, rdi
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rbp - 1]
call fcn.14000fde0
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 0xf], rbx
test rsi, rsi
je 0x14000e9e1
test rsi, 0xffffffffffff0000
jne 0x14000e9cd
movzx edi, si
mov ecx, edi
call fcn.140004200
test rax, rax
je 0x14000e9f6
mov r8d, edi
mov rdx, rax
lea rcx, [rbp + 0xf]
call fcn.14000b630
jmp 0x14000e9f2
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x14000e9e3
xor ecx, ecx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rbp + 0xf]
call fcn.14000b480
mov rbx, qword [rbp + 0xf]
test rbx, rbx
jne 0x14000e9ff
xor ecx, ecx
jmp 0x14000ea11
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rbx
mov rcx, qword [rbp + 0x77]
call fcn.14000b480
nop
jmp 0x14000eac0
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 7], rbx
test rsi, rsi
je 0x14000ea80
test rsi, 0xffffffffffff0000
jne 0x14000ea6d
movzx edi, si
mov ecx, edi
call fcn.140004200
test rax, rax
je 0x14000ea95
mov r8d, edi
mov rdx, rax
lea rcx, [rbp + 7]
call fcn.14000b630
jmp 0x14000ea91
xor eax, eax
mov rcx, rdi
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x14000ea82
xor ecx, ecx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rbp + 7]
call fcn.14000b480
mov rbx, qword [rbp + 7]
test rbx, rbx
jne 0x14000ea9e
xor ecx, ecx
jmp 0x14000eab0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rbx
mov rcx, qword [rbp + 0x77]
call fcn.14000b480
nop
lea rdx, [rbx - 0x18]
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000eade
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
movzx esi, byte [rbp + 0x7f]
movzx r8d, sil
mov rdi, qword [rbp - 1]
mov rdx, rdi
mov rcx, qword [rbp + 0x5f]
call fcn.14000e360
mov qword [rbp + 0x27], rax
test rax, rax
je 0x14000ec99
mov byte [rbp - 0x21], 1
xor edx, edx
mov dword [rbp - 0x15], edx
mov dword [rbp - 0x1d], edx
mov dword [rbp - 0x11], edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdx
lea rcx, [rbp - 0x15]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x1d]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [rbp - 0x11], 0
jbe 0x14000eb73
mov r8, qword [rbp + 0x77]
add r8, 8
movzx r9d, sil
mov rdx, rdi
mov rcx, qword [rbp + 0x5f]
call fcn.14000e550
cmp dword [rbp - 0x1d], 0
jbe 0x14000ec8e
mov eax, dword [rbp - 0x15]
inc eax
mov dword [rbp - 0x15], eax
mov ecx, eax
mov eax, 2
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.14002660c
mov rsi, rax
mov qword [rbp + 0x1f], rax
test rax, rax
je 0x14000ec8e
xor edx, edx
mov word [rax], dx
mov eax, edx
mov dword [rbp - 0x19], edx
cmp dword [rbp - 0x1d], edx
jbe 0x14000ec86
nop
mov ecx, dword [rbp - 0x15]
mov dword [rbp + 0x17], ecx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x17]
mov r8, rsi
mov edx, eax
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000ec63
lea ecx, [rax + 0x48]
call fcn.140027be8
test rax, rax
je 0x14000ec06
mov rcx, rax
call fcn.14000d770
mov rsi, rax
movzx eax, byte [rbp + 0x7f]
mov byte [rsp + 0x20], al
mov r9, rsi
mov r8, qword [rbp + 0x1f]
mov rdx, rdi
mov rcx, qword [rbp + 0x5f]
call fcn.14000e810
mov rbx, qword [rbp + 0x77]
mov rax, qword [rbx + 0x30]
mov qword [rbp + 0x2f], rax
cmp rax, qword [rbx + 0x38]
jb 0x14000ec47
lea rdx, [rax + 1]
lea rcx, [rbx + 0x28]
call fcn.140010180
test al, al
je 0x14000ec77
mov rax, qword [rbx + 0x28]
mov rcx, qword [rbp + 0x2f]
lea rcx, [rax + rcx*8]
test rcx, rcx
je 0x14000ec5b
mov qword [rcx], rsi
inc qword [rbx + 0x30]
mov rsi, qword [rbp + 0x1f]
mov eax, dword [rbp - 0x19]
inc eax
mov dword [rbp - 0x19], eax
cmp eax, dword [rbp - 0x1d]
jae 0x14000ec82
xor edx, edx
jmp 0x14000ebc0
mov ecx, 0x8007000e
call fcn.1400040f0
int3
or rbx, 0xffffffffffffffff
mov rcx, rsi
call fcn.1400278f8
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x14000ecb1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
movzx eax, byte [rbp - 0x21]
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret