Function at 0x14001268c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x130
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov r14, r9
mov r13, r8
mov r12, rdx
xor ebx, ebx
mov r15d, ebx
mov dword [rsp + 0x74], ebx
mov qword [rbp - 0x70], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14001276f
mov ecx, dword [rsp + 0x68]
inc ecx
lea eax, [rbx + 2]
mul rcx
lea rcx, [rbx - 1]
cmovo rax, rcx
mov rcx, rax
call fcn.1400011c8
mov rsi, rax
test rax, rax
je 0x14001276f
mov ecx, dword [rsp + 0x68]
mov word [rax + rcx*2], bx
mov ecx, dword [rsp + 0x60]
add ecx, 2
call fcn.1400011c8
mov rdi, rax
test rax, rax
jne 0x14001278c
mov rcx, rsi
call fcn.1400011d4
xor eax, eax
mov rbx, qword [rsp + 0x188]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [rsp + 0x60]
mov byte [rax + rdi], bl
mov eax, dword [rsp + 0x60]
inc eax
mov byte [rax + rdi], bl
mov eax, dword [rsp + 0x60]
lea ecx, [rax + rax*2]
lea eax, [rcx + rcx]
mov dword [rbp - 0x50], eax
lea ecx, [rax + 0x41]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400011c8
mov rbx, rax
test rax, rax
jne 0x1400127d9
mov rcx, rdi
call fcn.1400011d4
jmp 0x140012767
mov rax, qword [r12]
mov edx, dword [rax - 8]
add edx, dword [rsp + 0x6c]
mov eax, dword [rsp + 0x68]
add eax, 6
add edx, eax
mov eax, dword [rsp + 0x60]
lea rcx, [rax + rax*2]
lea rdx, [rdx + rcx*2]
add rdx, 0x41
mov eax, 2
mul rdx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400011c8
mov r12, rax
mov qword [rbp - 0x48], rax
test rax, rax
jne 0x14001282e
mov rcx, rbx
call fcn.1400011d4
jmp 0x1400127cf
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], 0xffffffffffff0002
xor r14d, r14d
mov dword [rbp - 0xc], r14d
mov dword [rbp - 0x20], 5
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x78], r14d
lea rax, [rsp + 0x64]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x70]
mov r8, rsi
xor edx, edx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [rbp - 0x80], eax
test eax, eax
je 0x1400128a2
cmp eax, 0x103
jne 0x140012b7e
mov r9d, 0x20
cmp eax, 0x103
je 0x140012a4c
mov eax, dword [rsp + 0x7c]
test eax, eax
je 0x140012a2c
cmp eax, 2
jbe 0x140012a1e
cmp eax, 3
je 0x140012969
cmp eax, 4
je 0x14001294e
cmp eax, 5
je 0x140012928
cmp eax, 7
jne 0x140012a2c
mov rdx, rbx
mov rax, qword [rbp - 0x50]
add eax, 0x3f
lea r8, [rbx + rax*2]
mov rcx, rdi
sub rcx, rbx
movzx eax, word [rcx + rdx]
test ax, ax
jne 0x140012909
cmp word [rcx + rdx + 2], r14w
je 0x14001291f
cmp rdx, r8
jae 0x14001291f
test ax, ax
jne 0x140012916
mov eax, r9d
mov word [rdx], ax
add rdx, 2
jmp 0x1400128f8
mov word [rdx], r14w
jmp 0x1400129ef
mov eax, dword [rdi]
mov r9d, eax
shr r9d, 0x10
movzx r8d, ax
mov dword [rsp + 0x20], eax
lea rdx, str._04X_04X___lu_
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x1400129ef
mov r9d, dword [rdi]
mov r8d, r9d
lea rdx, str._08X___lu_
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x1400129ef
mov eax, dword [rsp + 0x60]
lea r8, [rax + rax*2]
lea r8, [r8*2 + 1]
xor edx, edx
mov rcx, rbx
call sub.msvcrt.dll_memset
xor eax, eax
cmp dword [rsp + 0x64], eax
jbe 0x1400129ec
lea r12d, [rax + 0x20]
mov r8d, r14d
lea r13d, [r14 + r14*2]
lea rdx, [rbx + r13*2]
mov r9d, 0x10
cmp byte [r8 + rdi], r9b
jae 0x1400129b5
lea eax, [r9 + 0x20]
mov word [rdx], ax
lea eax, [r13 + 1]
lea rdx, [rbx + rax*2]
movzx ecx, byte [r8 + rdi]
mov r8d, r9d
call qword [sym.imp.msvcrt.dll__itow]
inc r14d
mov eax, dword [rsp + 0x64]
cmp r14d, eax
jae 0x1400129e1
lea eax, [r13 + 2]
mov word [rbx + rax*2], r12w
mov eax, dword [rsp + 0x64]
cmp r14d, eax
jb 0x14001298f
mov r12, qword [rbp - 0x48]
mov r13, qword [rbp + 0x80]
xor r14d, r14d
mov rax, qword [rbp + 0x78]
mov rcx, r12
mov r8, qword [rax]
cmp word [rsi], r14w
jne 0x140012a35
mov r9, rbx
cmp dword [rbp - 0x68], 1
lea rdx, str._s___s
je 0x140012a16
lea rdx, str._s___no_name_____s
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x140012a64
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1400129ef
lea rdx, str._cannot_coerce_data_to_string_
jmp 0x140012a21
mov qword [rsp + 0x20], rbx
mov r9, rsi
lea rdx, str._s___s____s
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x140012a64
mov word [rsi], r14w
mov word [rbx], r14w
mov rax, qword [rbp + 0x78]
mov rdx, qword [rax]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov qword [rbp - 8], r12
mov ecx, 0x28
call fcn.140017718
mov r14, rax
mov qword [rbp - 0x38], rax
xor eax, eax
test r14, r14
je 0x140012ac0
mov rdx, rbx
lea rcx, [rbp - 0x78]
call sub.MFC42u.dll_CDaoException::CDaoException
nop
or r15d, 1
mov dword [rsp + 0x74], r15d
mov rdx, rsi
lea rcx, [rbp - 0x60]
call sub.MFC42u.dll_CDaoException::CDaoException
nop
or r15d, 2
mov dword [rsp + 0x74], r15d
lea r9, [rbp - 0x78]
lea r8, [rbp - 0x60]
mov rdx, qword [rbp + 0x78]
mov rcx, r14
call fcn.1400122c4
xor r14d, r14d
mov qword [rbp + 0x10], rax
test r15b, 2
je 0x140012adb
and r15d, 0xfffffffd
lea rcx, [rbp - 0x60]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
test r15b, 1
je 0x140012aee
and r15d, 0xfffffffe
lea rcx, [rbp - 0x78]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
cmp qword [rbp + 0x10], r14
je 0x140012b6d
lea r9, [rbp - 0x30]
xor r8d, r8d
mov edx, CAsyncSocket::OnClose
mov rax, qword [rbp + 0x70]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rbp - 0x70], rax
mov r14d, dword [rsp + 0x78]
inc r14d
mov dword [rsp + 0x78], r14d
mov ecx, dword [rsp + 0x60]
mov dword [rsp + 0x64], ecx
mov ecx, dword [rsp + 0x68]
inc ecx
mov dword [rsp + 0x70], ecx
lea rax, [rsp + 0x64]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
mov r8, rsi
mov edx, r14d
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [rbp - 0x80], eax
xor r14d, r14d
jmp 0x140012b70
mov eax, dword [rbp - 0x80]
test eax, eax
mov r9d, 0x20
je 0x1400128a8
mov rcx, rsi
call fcn.1400011d4
mov rcx, rdi
call fcn.1400011d4
mov rcx, rbx
call fcn.1400011d4
mov rcx, r12
call fcn.1400011d4
mov ecx, dword [rsp + 0x6c]
inc ecx
mov r12d, 2
mov eax, r12d
mul rcx
lea rcx, [r12 - 3]
cmovo rax, rcx
mov rcx, rax
call fcn.1400011c8
mov rbx, rax
test rax, rax
je 0x140012c89
mov edi, r14d
mov r9d, dword [rsp + 0x6c]
inc r9d
mov r8, rax
xor edx, edx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x140012c81
mov r14, qword [rbp - 0x70]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140012c61
mov rdx, rbx
lea rcx, [rbp - 0x70]
call sub.MFC42u.dll_CDaoException::CDaoException
nop
mov r9, r14
mov r8, qword [rbp - 0x78]
lea rdx, [rbp - 0x70]
mov rsi, qword [rbp + 0x70]
mov rcx, rsi
call fcn.14001268c
nop
lea rcx, [rbp - 0x70]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
mov r9, r14
mov r8, r12
mov edx, 0x1102
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
mov r9d, dword [rsp + 0x6c]
inc r9d
mov r8, rbx
mov edx, edi
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x140012bf2
mov rcx, rbx
call fcn.1400011d4
mov eax, 1
jmp 0x140012771