Function at 0x140007c74
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x47]
sub rsp, 0xc8
xor r14d, r14d
mov rbx, r8
mov dword [rbp - 0x51], r14d
mov rax, rdx
mov dword [rbp - 0x5d], r14d
mov rsi, rcx
mov dword [rbp - 0x55], r14d
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], r14
mov dword [rbp - 0x61], r14d
mov dword [rbp - 0x59], r14d
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x21], r14
test rcx, rcx
je 0x14000837c
test rax, rax
je 0x14000837c
test rbx, rbx
je 0x14000837c
test r9, r9
je 0x14000837c
mov r15, qword [rbp + 0x7f]
test r15, r15
je 0x14000837c
mov r13d, dword [rbp + 0x6f]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r13d
call fcn.1400083a8
mov edi, eax
cmp dword [rbp + 0x77], r14d
je 0x140008381
test eax, eax
jne 0x140008381
lea r12d, [r14 + 1]
cmp r13d, r12d
ja 0x140007d3b
cmp dword [r15], r12d
jne 0x140007d3b
xor eax, eax
jmp 0x14000838a
mov qword [rsp + 0x58], r14
lea rax, [rbp - 0x61]
mov qword [rsp + 0x50], r14
xor r9d, r9d
mov qword [rsp + 0x48], r14
xor r8d, r8d
mov qword [rsp + 0x40], r14
xor edx, edx
mov qword [rsp + 0x38], r14
mov rcx, rsi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x5d]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140008381
mov eax, dword [rbp - 0x61]
cmp dword [rbp - 0x5d], r14d
je 0x140007da3
test eax, eax
jne 0x140007da3
mov edi, 0x100
mov dword [rbp - 0x61], edi
jmp 0x140007db1
mov edi, 0x100
cmp eax, edi
jae 0x140007db1
add eax, eax
mov dword [rbp - 0x61], eax
mov qword [rsp + 0x58], r14
lea rax, [rbp - 0x59]
mov qword [rsp + 0x50], r14
xor r9d, r9d
mov qword [rsp + 0x48], r14
xor r8d, r8d
mov qword [rsp + 0x40], r14
xor edx, edx
mov qword [rsp + 0x38], r14
mov rcx, rbx
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x55]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x140007e0c
mov ecx, ebx
call fcn.140002874
mov eax, ebx
jmp 0x14000838a
mov edx, dword [rbp - 0x55]
mov eax, dword [rbp - 0x59]
test edx, edx
je 0x140007e1e
test eax, eax
jne 0x140007e1e
mov eax, edi
jmp 0x140007e24
cmp eax, edi
jae 0x140007e24
add eax, eax
mov ecx, dword [rbp - 0x61]
cmp r13d, r12d
ja 0x140007e3d
cmp dword [rbp - 0x5d], edx
jne 0x140007e35
cmp ecx, eax
je 0x140007e3d
mov dword [r15], r12d
jmp 0x140007d34
add eax, r12d
add ecx, r12d
mov dword [rbp - 0x59], eax
mov dword [rbp - 0x61], ecx
cmp eax, ecx
jbe 0x140007e52
mov dword [rbp - 0x61], eax
jmp 0x140007e55
mov dword [rbp - 0x59], ecx
call fcn.14000ecac
mov qword [rbp - 0x11], rax
mov r12, rax
test rax, rax
jne 0x140007e6d
mov ebx, 0xe
jmp 0x140007dfe
call fcn.14000ecac
mov qword [rbp - 0x31], rax
test rax, rax
jne 0x140007e86
lea rcx, [rbp - 0x11]
call fcn.14000ecdc
jmp 0x140007e66
mov ecx, dword [rbp - 0x61]
add ecx, ecx
call fcn.14000c800
mov qword [rbp - 9], rax
mov rsi, rax
test rax, rax
jne 0x140007ea7
lea rcx, [rbp - 0x31]
call fcn.14000ecdc
jmp 0x140007e7b
mov edi, r14d
mov ebx, 0xe
cmp dword [rbp - 0x5d], r14d
jbe 0x140007f25
mov r15, qword [rbp + 0x4f]
test edi, edi
je 0x140007ec2
cmp edi, 5
jne 0x140007f21
mov eax, dword [rbp - 0x61]
lea r9, [rbp - 0x51]
mov ecx, eax
mov dword [rbp - 0x51], eax
xor eax, eax
add rcx, rcx
and qword [rsp + 0x38], rax
mov rdi, rsi
and qword [rsp + 0x30], rax
mov r8, rsi
and qword [rsp + 0x28], rax
mov edx, r14d
and qword [rsp + 0x20], rax
rep stosb byte [rdi], al
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140007f18
mov rdx, rsi
mov rcx, r12
call fcn.14000ee68
cmp eax, 0xffffffff
cmove edi, ebx
inc r14d
cmp r14d, dword [rbp - 0x5d]
jb 0x140007eb9
mov r15, qword [rbp + 0x7f]
xor r14d, r14d
cmp dword [rbp - 0x55], r14d
jbe 0x140007fa6
mov r15, qword [rbp - 0x31]
mov r13, qword [rbp + 0x5f]
test edi, edi
je 0x140007f3f
cmp edi, 5
jne 0x140007f9e
mov eax, dword [rbp - 0x59]
lea r9, [rbp - 0x51]
mov ecx, eax
mov dword [rbp - 0x51], eax
xor eax, eax
add rcx, rcx
and qword [rsp + 0x38], rax
mov rdi, rsi
and qword [rsp + 0x30], rax
mov r8, rsi
and qword [rsp + 0x28], rax
mov edx, r14d
and qword [rsp + 0x20], rax
rep stosb byte [rdi], al
mov rcx, r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140007f95
mov rdx, rsi
mov rcx, r15
call fcn.14000ee68
cmp eax, 0xffffffff
cmove edi, ebx
inc r14d
cmp r14d, dword [rbp - 0x55]
jb 0x140007f36
mov r15, qword [rbp + 0x7f]
mov r13d, dword [rbp + 0x6f]
lea rcx, [rbp - 9]
call fcn.14000cca4
test edi, edi
jne 0x140008018
mov rcx, qword [rbp + 0x57]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
nop dword [rax + rax]
mov ecx, eax
mov eax, dword [rbp - 0x61]
add eax, 5
add ecx, eax
mov dword [rbp - 0x61], ecx
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
nop dword [rax + rax]
mov ecx, eax
mov eax, dword [rbp - 0x59]
add eax, 5
add ecx, eax
mov dword [rbp - 0x59], ecx
mov ecx, dword [rbp - 0x61]
add ecx, ecx
call fcn.14000c800
mov qword [rbp - 0x29], rax
test rax, rax
jne 0x140008004
mov edi, ebx
jmp 0x140008018
mov ecx, dword [rbp - 0x59]
add ecx, ecx
call fcn.14000c800
test rax, rax
mov qword [rbp - 0x21], rax
cmove edi, ebx
xor esi, esi
cmp dword [rbp - 0x5d], esi
jbe 0x140008269
mov r14, qword [rbp - 0x31]
test edi, edi
jne 0x140008269
xor r8d, r8d
mov edx, esi
mov rcx, r12
call fcn.14000f370
test rax, rax
jne 0x140008045
xor ebx, ebx
jmp 0x140008052
cmp dword [rax + 4], 0x20000
jne 0x140008041
mov rbx, qword [rax + 0x10]
mov r8, rbx
mov rcx, r14
call fcn.14000f200
mov dword [rbp - 0x39], eax
cmp eax, 0xffffffff
je 0x14000828d
lea ecx, [r13 - 2]
test ecx, 0xfffffffd
jne 0x140008087
mov rcx, qword [rbp + 0x57]
mov r8d, 3
mov rdx, rbx
call fcn.14000957c
mov rdi, qword [rbp - 0x29]
mov r8d, dword [rbp - 0x61]
mov rcx, rdi
mov rdx, qword [rbp + 0x57]
call fcn.14000eae0
mov r8d, dword [rbp - 0x61]
lea rdx, [0x140010780]
mov rcx, rdi
call fcn.14000e978
mov r8d, dword [rbp - 0x61]
mov rdx, rbx
mov rcx, rdi
call fcn.14000e978
mov rdi, qword [rbp - 0x21]
mov r8d, dword [rbp - 0x59]
mov rcx, rdi
mov rdx, qword [rbp + 0x67]
call fcn.14000eae0
mov r8d, dword [rbp - 0x59]
lea rdx, [0x140010780]
mov rcx, rdi
call fcn.14000e978
mov r8d, dword [rbp - 0x59]
mov rdx, rbx
mov rcx, rdi
call fcn.14000e978
mov eax, dword [rbp + 0x8f]
lea rcx, [rbp - 0x49]
or eax, 0x20019
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x4f]
mov r9d, eax
xor r8d, r8d
mov dword [rbp - 0x19], eax
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14000816f
mov r9d, dword [rbp - 0x19]
lea rax, [rbp - 0x41]
mov rcx, qword [rbp + 0x5f]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x14000816f
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x140008173
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
xor ecx, ecx
mov qword [rbp - 0x49], rcx
jmp 0x140008173
mov rcx, qword [rbp - 0x49]
cmp edi, 5
jne 0x1400081b1
xor ecx, ecx
xor edi, edi
call fcn.140002874
mov rax, qword [rbp + 0x97]
mov edx, esi
mov rcx, r12
mov dword [rax], 1
call fcn.14000f008
mov edx, dword [rbp - 0x39]
mov rcx, r14
call fcn.14000f008
or eax, 0xffffffff
add dword [rbp - 0x5d], eax
add dword [rbp - 0x55], eax
jmp 0x14000828f
test edi, edi
jne 0x140008269
mov rdx, qword [rbp + 0x97]
mov eax, dword [rbp + 0x87]
mov r9, qword [rbp - 0x21]
inc eax
mov r8, qword [rbp - 0x41]
mov qword [rsp + 0x48], rdx
mov edx, dword [rbp + 0x8f]
mov dword [rsp + 0x40], edx
mov rdx, qword [rbp - 0x29]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp + 0x77]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r13d
call fcn.140007c74
mov rcx, qword [rbp - 0x49]
mov edi, eax
test rcx, rcx
je 0x140008219
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
and qword [rbp - 0x49], 0
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x140008233
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
and qword [rbp - 0x41], 0
test edi, edi
jne 0x140008255
mov edx, esi
mov rcx, r12
call fcn.14000f008
mov edx, dword [rbp - 0x39]
mov rcx, r14
call fcn.14000f008
or eax, 0xffffffff
add dword [rbp - 0x5d], eax
add dword [rbp - 0x55], eax
cmp dword [r15], 1
jne 0x14000828f
cmp r13d, 2
jae 0x14000828f
and dword [rbp - 0x5d], 0
and dword [rbp - 0x55], 0
xor ebx, ebx
cmp dword [rbp - 0x5d], ebx
jbe 0x1400082c4
lea esi, [rbx + 1]
test edi, edi
jne 0x1400082c4
xor r8d, r8d
mov edx, ebx
mov rcx, r12
call fcn.14000f370
test rax, rax
jne 0x140008299
xor edx, edx
jmp 0x1400082a6
inc esi
cmp esi, dword [rbp - 0x5d]
jae 0x140008269
jmp 0x140008027
cmp dword [rax + 4], 0x20000
jne 0x140008289
mov rdx, qword [rax + 0x10]
lea eax, [r13 - 3]
cmp eax, esi
ja 0x1400082ba
mov rcx, qword [rbp + 0x57]
mov r8d, esi
call fcn.14000957c
add ebx, esi
mov dword [r15], esi
cmp ebx, dword [rbp - 0x5d]
jb 0x140008273
xor ebx, ebx
cmp dword [rbp - 0x55], ebx
jbe 0x140008319
test edi, edi
jne 0x140008319
mov rcx, qword [rbp - 0x31]
xor r8d, r8d
mov edx, ebx
call fcn.14000f370
test rax, rax
jne 0x1400082e6
xor edx, edx
jmp 0x1400082f3
cmp dword [rax + 4], 0x20000
jne 0x1400082e2
mov rdx, qword [rax + 0x10]
lea eax, [r13 - 3]
cmp eax, 1
ja 0x14000830b
mov rcx, qword [rbp + 0x67]
mov r8d, 2
call fcn.14000957c
inc ebx
mov dword [r15], 1
cmp ebx, dword [rbp - 0x55]
jb 0x1400082cb
lea rcx, [rbp - 9]
call fcn.14000cca4
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x14000833c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
and qword [rbp - 0x49], 0
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x140008356
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
and qword [rbp - 0x41], 0
lea rcx, [rbp - 0x29]
call fcn.14000cca4
lea rcx, [rbp - 0x21]
call fcn.14000cca4
lea rcx, [rbp - 0x11]
call fcn.14000ecdc
lea rcx, [rbp - 0x31]
call fcn.14000ecdc
jmp 0x140008381
mov edi, 0x57
mov ecx, edi
call fcn.140002874
mov eax, edi
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret