Function at 0x1400d5b1c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov rax, r8
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x80], rdx
mov r14, rcx
xor r13d, r13d
test rdx, rdx
je 0x1400d5b65
mov dword [rdx], r13d
test rax, rax
je 0x1400d5b6d
mov dword [r8], r13d
mov qword [rsp + 0x68], r13
mov edx, 2
mov ecx, 0xffff
call fcn.140113de8
mov r12, rax
test rax, rax
je 0x1400d5e2c
mov r15d, r13d
mov dword [rsp + 0x60], r13d
mov edx, 0x966
mov rcx, qword [r14 + 8]
call fcn.140028904
mov rdi, rax
mov edx, 0x967
mov rcx, qword [r14 + 8]
call fcn.140028904
mov rbx, rax
lea rdx, [r14 + 0x18]
lea rcx, [rbp - 0x48]
call fcn.14011dbd4
nop
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov esi, 0x14b
mov r8d, esi
mov edx, 0x966
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8d, esi
mov edx, 0x967
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Directory_shell
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d5d89
xor edx, edx
mov r8d, 0x248
lea rcx, [rbp - 0x30]
call fcn.14012d4b0
mov dword [rsp + 0x70], 0x104
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x30]
mov edx, r13d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400d5d7b
lea rax, [rbp - 0x30]
or rsi, 0xffffffffffffffff
xor ecx, ecx
inc rsi
cmp word [rax + rsi*2], cx
jne 0x1400d5c85
lea r8, str.command
mov edx, 0x124
lea rcx, [rbp - 0x30]
call fcn.140001e48
xor eax, eax
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x30]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d5d6b
mov dword [rsp + 0x64], 0x1fffa
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
test eax, eax
jne 0x1400d5d60
mov eax, dword [rsp + 0x64]
shr rax, 1
mov word [r12 + rax*2], cx
mov word [rbp + rsi*2 - 0x30], cx
mov sil, cl
lea rcx, [rbp - 0x70]
call fcn.1401170c0
nop
xor r8d, r8d
lea rdx, [rbp - 0x70]
mov rcx, r12
call fcn.1401188b8
mov r15, rax
test rax, rax
je 0x1400d5d52
lea rcx, [rbp - 0x70]
call fcn.140054ee8
mov rcx, rax
call fcn.140117814
test al, al
jne 0x1400d5eb8
mov r15d, dword [rsp + 0x60]
lea rcx, [rbp - 0x70]
call fcn.1401170e4
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r13d
cmp r13d, 0x200
jb 0x1400d5c2d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r13d, r13d
lea rsi, [0x1401759d0]
mov r8, rsi
test rdi, rdi
cmovne r8, rdi
mov edx, 0x966
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
test rdi, rdi
je 0x1400d5dc5
cmp word [rdi], r13w
je 0x1400d5dc5
mov edx, 0x966
mov r8, rdi
mov rcx, qword [r14 + 8]
call fcn.1400ca264
test rbx, rbx
cmovne rsi, rbx
mov r8, rsi
mov esi, 0x967
mov edx, esi
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
test rbx, rbx
je 0x1400d5df9
cmp word [rbx], r13w
je 0x1400d5df9
mov edx, esi
mov r8, rbx
mov rcx, qword [r14 + 8]
call fcn.1400ca264
test rdi, rdi
je 0x1400d5e06
mov rcx, rdi
call fcn.140113e18
test rbx, rbx
je 0x1400d5e13
mov rcx, rbx
call fcn.140113e18
mov rcx, r12
call fcn.140113e18
test r15d, r15d
setg bl
lea rcx, [rbp - 0x48]
call fcn.14011dbf0
mov al, bl
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.14012bda0
mov rbx, qword [rsp + 0x388]
add rsp, 0x330
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, str._inside
lea rcx, [rbp - 0x70]
call fcn.14011863c
test al, al
jne 0x1400d5ed1
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea rax, [0x140184a70]
mov qword [rsp + 0x20], rax
lea r9, [0x140180288]
lea r8, [0x140184a88]
lea rdx, [0x140180298]
lea rcx, [rbp - 0x70]
call fcn.140118d90
test al, al
jne 0x1400d5ed4
xor r8d, r8d
lea rdx, [rbp - 0x70]
mov rcx, r15
call fcn.1401188b8
mov r15, rax
test rax, rax
jne 0x1400d5e56
jmp 0x1400d5ed4
mov sil, 1
mov rax, qword [rbp - 0x80]
test sil, sil
cmovne rax, qword [rbp - 0x78]
test rax, rax
je 0x1400d5ee7
inc dword [rax]
mov r15d, dword [rsp + 0x60]
inc r15d
mov dword [rsp + 0x60], r15d
movzx edx, sil
xor edx, 1
add edx, 0x966
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x143
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov rax, rbx
test sil, sil
cmovne rax, rdi
test rax, rax
jne 0x1400d5d57
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.1401145e0
test sil, sil
je 0x1400d5f48
mov rdi, rax
jmp 0x1400d5d57
mov rbx, rax
jmp 0x1400d5d57