Function at 0x14010d680
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x9b0
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x9a0], rax
xor ebp, ebp
mov r14, rcx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x340]
mov rdi, rbp
mov r13, rbp
mov r15d, ebp
mov dword [rsp + 0x30], ebp
call fcn.1400012c0
lea rcx, [rsp + 0x460]
call fcn.1400012c0
lea r8, [rsp + 0x586]
mov r9d, 0x101
xor edx, edx
mov rcx, 0xffffffff80000000
mov r12d, ebp
mov word [rsp + 0x580], 0x66
mov word [rsp + 0x582], 0x6f
mov word [rsp + 0x584], 0x6f
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
je 0x14010d89c
nop
nop
test eax, eax
jne 0x14010d865
cmp word [rsp + 0x586], 0x2e
jne 0x14010d865
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x790]
lea rdx, [rsp + 0x586]
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x34], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x14010d865
cmp word [rsp + 0x790], 0x2e
je 0x14010d865
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x790]
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x38], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x14010d865
cmp word [rsp + 0x80], bp
je 0x14010d865
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x340]
call fcn.140175db0
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x460]
call fcn.140175db0
mov r14, qword [rsp + 0x468]
mov rsi, qword [rsp + 0x348]
mov ecx, 0x38
call fcn.1400ce030
cmp byte [rsi], bpl
mov rdx, rsi
mov rbx, rax
je 0x14010d820
add rdx, 1
cmp byte [rdx], bpl
jne 0x14010d817
sub edx, esi
mov rcx, rsi
mov dword [rax + 8], edx
call fcn.14016bad0
mov rcx, r14
mov qword [rbx], rax
call fcn.14016bb20
test rdi, rdi
mov qword [rbx + 0x10], rbp
mov dword [rbx + 0x18], ebp
mov qword [rbx + 0x20], rax
mov eax, dword [0x14020b158]
mov dword [rbx + 0x28], eax
je 0x14010d857
mov qword [r13 + 0x30], rbx
jmp 0x14010d85a
mov rdi, rbx
mov qword [rbx + 0x30], rbp
mov r13, rbx
add r15d, 1
add r12d, 1
lea r8, [rsp + 0x586]
mov r9d, 0x101
mov edx, r12d
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x14010d730
mov r14, qword [rsp + 0x40]
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x460]
call fcn.140175010
lea rcx, [rsp + 0x340]
call fcn.140175010
test r15d, r15d
je 0x14010db92
movsxd rcx, r15d
shl rcx, 3
call fcn.1400ce030
test rdi, rdi
mov rsi, rax
mov rcx, rax
je 0x14010d8f0
nop
nop
nop
mov qword [rcx], rdi
mov rdi, qword [rdi + 0x30]
add rcx, 8
test rdi, rdi
jne 0x14010d8e0
lea r8, [0x14010d5a0]
mov edx, r15d
mov rcx, rax
call fcn.1400e1740
test r15d, r15d
mov rbx, rbp
jle 0x14010d9f3
mov edi, r15d
test rbx, rbx
je 0x14010d964
mov rax, qword [rsi + rbx*8]
mov r9, qword [rsi + rbx*8 - 8]
mov r10d, dword [r9 + 8]
mov r11d, dword [rax + 8]
mov rcx, qword [rax]
cmp r11d, r10d
mov r8d, r10d
cmovl r8d, r11d
test r8d, r8d
je 0x14010d956
mov r9, qword [r9]
sub r9, rcx
nop
movzx eax, byte [r9 + rcx]
movzx edx, byte [rcx]
sub edx, eax
jne 0x14010d95c
add rcx, 1
sub r8d, 1
jne 0x14010d940
mov edx, r11d
sub edx, r10d
test edx, edx
je 0x14010d9e5
mov rcx, qword [rsi + rbx*8]
lea r8, [rsp + 0x80]
mov r9d, 0x2b8
mov rcx, qword [rcx + 0x20]
mov edx, 0x80
mov dword [rsp + 0x20], 0x4411
call fcn.1400d9d40
test rax, rax
je 0x14010d9e5
lea rcx, [rsp + 0x298]
call fcn.1401744b0
mov rcx, qword [rsi + rbx*8]
mov qword [rcx + 0x10], rax
mov rax, qword [rsi + rbx*8]
mov rdx, qword [rax + 0x10]
mov rcx, rdx
cmp byte [rdx], bpl
je 0x14010d9bf
add rcx, 1
cmp byte [rcx], bpl
jne 0x14010d9b6
sub ecx, edx
mov dword [rax + 0x18], ecx
mov rcx, qword [rsi + rbx*8]
mov eax, dword [rsp + 0x88]
mov dword [rcx + 0x28], eax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14010d9e5
call qword [sym.imp.USER32.dll_DestroyIcon]
add rbx, 1
sub rdi, 1
jne 0x14010d911
lea r8, [0x14010d5f0]
mov edx, r15d
mov rcx, rsi
call fcn.1400e1740
lea rcx, [rsp + 0x80]
call fcn.1400012c0
mov rcx, qword [r14 + 0x10]
mov edx, 0x41f
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [rsp + 0x30]
test edi, edi
mov r15, rax
jle 0x14010db39
mov r14, rdi
test rbp, rbp
je 0x14010dac1
mov rdx, qword [rsi + rbp*8]
mov rcx, qword [rsi + rbp*8 - 8]
lea rbx, [0x1401aef92]
mov rax, qword [rdx + 0x10]
mov r12d, dword [rcx + 0x18]
mov r13d, dword [rdx + 0x18]
test rax, rax
lea rdi, [0x1401aef92]
mov r9d, r12d
cmovne rbx, rax
mov rax, qword [rcx + 0x10]
mov edx, r13d
test rax, rax
mov rcx, rbx
cmovne rdi, rax
mov r8, rdi
call fcn.14000db10
test eax, eax
mov r11d, eax
jne 0x14010dabc
cmp r13d, r12d
mov ecx, r12d
cmovl ecx, r13d
test ecx, ecx
je 0x14010dab6
sub rdi, rbx
nop
nop
movzx eax, byte [rdi + rbx]
movzx r11d, byte [rbx]
sub r11d, eax
jne 0x14010dabc
add rbx, 1
sub ecx, 1
jne 0x14010daa0
mov r11d, r13d
sub r11d, r12d
test r11d, r11d
je 0x14010db22
mov rdx, qword [rsi + rbp*8]
cmp dword [rdx + 0x18], 0
je 0x14010db22
mov rdx, qword [rdx + 0x10]
lea rcx, [rsp + 0x80]
call fcn.14017b470
mov rcx, qword [rsi + rbp*8]
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x48], 7
mov qword [rsp + 0x50], 0xffffffffffffffff
mov eax, dword [rcx + 0x28]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x64], eax
mov eax, dword [rcx + 0x28]
mov edx, 0x40b
mov rcx, r15
mov dword [rsp + 0x68], eax
call qword [sym.imp.USER32.dll_SendMessageW]
add rbp, 1
sub r14, 1
jne 0x14010da33
mov edi, dword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
lea rcx, [rsp + 0x80]
call fcn.140175010
test edi, edi
jle 0x14010db8a
mov rbx, rsi
nop
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14010db61
call fcn.1400ce0b0
mov rcx, qword [rbx]
mov rcx, qword [rcx + 0x20]
call fcn.1400ce0b0
mov rcx, qword [rbx]
mov rcx, qword [rcx]
call fcn.1400ce0b0
mov rcx, qword [rbx]
call fcn.1400ce0b0
add rbx, 8
sub rdi, 1
jne 0x14010db50
mov rcx, rsi
call fcn.1400ce0b0
mov dword [r14 + 0x28], 1
mov rcx, qword [rsp + 0x9a0]
xor rcx, rsp
call fcn.1401a6ae0
lea r11, [rsp + 0x9b0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret