Function at 0x14001b810
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rax, qword [0x14009a0a0]
xor rax, rsp
mov qword [rbp + 0x470], rax
mov rsi, r8
mov rbx, rcx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x38], r8
xor r14d, r14d
mov dword [rsp + 0x60], r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [rsp + 0x60], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x260]
call fcn.140043bc0
mov dword [rsp + 0x68], 0x104
mov dword [rsp + 0x64], r14d
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14001b895
mov rdx, qword [rsi]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001bcdb
lea rax, [rbp - 0x70]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x260]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14001bcdb
lea r9, [rbp + 0x5a]
mov r8d, dword [rsp + 0x64]
nop dword [rax]
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x14001b940
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
lea rax, [rbp + 0x5a]
cmp r9, rax
je 0x14001b9a4
lea r8, [rbp + 0x5a]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp - 0x30]
call fcn.140007cf0
mov dword [rsp + 0x60], 7
mov rcx, qword [rsi + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 9
jb 0x14001bd5c
mov rax, rsi
cmp qword [rsi + 0x18], 8
jb 0x14001b9d4
mov rax, qword [rsi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.Reg_key:
lea rcx, [rbp + 0x10]
call fcn.14000a3f0
mov dword [rsp + 0x60], 0xf
mov r8d, 5
lea rdx, str._has
lea rcx, [rbp + 0x10]
call fcn.14000b4c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov dword [rsp + 0x60], 0x1f
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.14001c910
mov dword [rsp + 0x60], 0x3f
mov r8d, 8
lea rdx, str._subkeys
lea rcx, [rbp - 0x10]
call fcn.14000b4c0
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov dword [rsp + 0x60], 0x7f
lea rcx, [rbp - 0x68]
call fcn.140030880
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x14001bae8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bae3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bd62
call fcn.140041080
mov qword [rbp], r14
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r14w
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x14001bb3a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bb34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bd68
call fcn.140041080
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x14001bb7a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bb75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bd6e
call fcn.140041080
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r14w
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001bbcb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bbc6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bd74
call fcn.140041080
mov edi, r14d
cmp dword [rsp + 0x64], r14d
jbe 0x14001bcdb
nop dword [rax]
mov dword [rsp + 0x6c], 0xff
lea rax, [rbp - 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x6c]
lea r8, [rbp + 0x60]
mov edx, edi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001bccf
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
lea rax, [rbp + 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14001bc40
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x30]
call fcn.140007cf0
nop
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x14001bc83
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rbp - 0x30], r14w
add qword [rbx + 8], 0x20
jmp 0x14001bc93
lea r8, [rbp - 0x30]
mov rcx, rbx
call fcn.14001c6b0
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001bccf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bcca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bd50
call fcn.140041080
inc edi
cmp edi, dword [rsp + 0x64]
jb 0x14001bbe0
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14001bd16
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14001bd11
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001bd56
mov rcx, r8
call fcn.140041080
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 7
mov word [rsi], r14w
mov rax, rbx
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.140041060
lea r11, [rsp + 0x580]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140053bb4
nop
call fcn.140053bb4
nop
call fcn.140001380
nop
call fcn.140053bb4
nop
call fcn.140053bb4
nop
call fcn.140053bb4
nop
call fcn.140053bb4
int3