Function at 0x14000f4b0
Capabilities:
Check if file exists
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x4b0], rbx
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov rsi, rcx
lea rax, [rbp + 0xb0]
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], 0x41
xor r13d, r13d
mov word [rbp + 0xb0], r13w
lea rdi, fcn.140019f80
mov qword [rbp + 0x98], rdi
lea r14, [0x14008bba0]
mov qword [rbp + 0x90], r14
mov dword [rbp + 0x138], r13d
mov qword [rbp + 0x140], r13
mov qword [rsp + 0x20], r13
mov r9d, 0xf003f
mov r8, qword [0x1400ca1d8]
lea rcx, [rbp + 0x90]
call fcn.140013ea0
test eax, eax
js 0x140036796
mov r15d, r13d
mov dword [rsp + 0x40], r13d
lea r12, [fcn.140013010]
nop dword [rax]
nop word [rax + rax]
mov dword [rsp + 0x44], 0x100
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov rcx, qword [rbp + 0x140]
test rcx, rcx
je 0x1400367b6
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x44]
lea r8, [rbp + 0x150]
mov edx, r15d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000fc5b
lea ebx, [rax + 1]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x103
je 0x14000fc9a
test ebx, ebx
je 0x140036ae4
lea rax, [rbp - 0x10]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x41
mov word [rbp - 0x10], r13w
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x30], r14
mov dword [rbp + 0x78], r13d
mov qword [rbp + 0x80], r13
mov qword [rsp + 0x20], r13
mov r9d, 0xf003f
lea r8, [rbp + 0x150]
mov rdx, qword [rbp + 0x140]
lea rcx, [rbp - 0x30]
call fcn.140013ea0
test eax, eax
js 0x140036abb
lea rax, [0x14008bb88]
mov qword [rsp + 0x50], rax
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
lea rcx, [0x1400c9e30]
cmp rax, r12
jne 0x1400367c9
call fcn.140013010
add rax, 0x18
mov qword [rsp + 0x58], rax
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
lea rcx, [0x1400c9e30]
cmp rax, r12
jne 0x1400367d5
call fcn.140013010
add rax, 0x18
mov qword [rsp + 0x60], rax
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
lea rcx, [0x1400c9e30]
cmp rax, r12
jne 0x1400367e1
call fcn.140013010
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 1
mov qword [rsp + 0x74], 1
mov dword [rbp - 0x80], 0xffffffff
mov qword [rbp - 0x7c], 0
mov dword [rsp + 0x7c], 1
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
lea rcx, [0x1400c9e30]
cmp rax, r12
jne 0x1400367ed
call fcn.140013010
add rax, 0x18
mov qword [rbp - 0x70], rax
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.140016190
mov rbx, qword [rbp - 0x70]
test eax, eax
js 0x14000fa71
mov r14, r13
mov rdi, qword [rsi]
cmp rdi, qword [rsi + 0x28]
je 0x14000f76d
test r14, r14
jne 0x14003680a
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x1400367f9
js 0x140036801
mov rdi, qword [rdi + 0x58]
jmp 0x14000f73e
test r14, r14
jne 0x14003680a
cmp qword [rsi + 0x10], 0
je 0x14000fba4
mov r14, qword [rsi + 0x10]
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r14
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
lea rcx, [0x1400c9e30]
cmp rax, r12
jne 0x14003684f
call fcn.140013010
lea r10, [rax + 0x18]
mov qword [r14], r10
test rbx, rbx
je 0x140036892
test rbx, 0xffffffffffff0000
je 0x14003685b
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rbx + rdi*2], 0
jne 0x14000f7d2
test edi, edi
je 0x140036892
mov r12d, dword [r10 - 0x10]
mov r15, rbx
sub r15, r10
sar r15, 1
mov ecx, 1
sub ecx, dword [r10 - 8]
mov eax, dword [r10 - 0xc]
sub eax, edi
or eax, ecx
jge 0x14000f811
mov edx, edi
mov rcx, r14
call fcn.140012d00
mov r10, qword [r14]
movsxd rdx, edi
add rdx, rdx
mov r9, rdx
mov rcx, r10
cmp r15, r12
jbe 0x140036882
mov r8, rbx
call qword [sym.imp.msvcrt.dll_memcpy_s]
test edi, edi
js 0x140036a84
mov rax, qword [r14]
cmp edi, dword [rax - 0xc]
jg 0x140036a84
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [r14]
mov word [rax + rcx*2], r13w
lea r15, [r14 + 8]
mov qword [rbp - 0x40], r15
lea rax, [0x14008bb88]
mov qword [r15], rax
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
lea r13, [fcn.140013010]
lea rcx, [0x1400c9e30]
cmp rax, r13
jne 0x1400368a0
call fcn.140013010
add rax, 0x18
mov qword [r15 + 8], rax
lea rdi, [r15 + 0x10]
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
lea rcx, [0x1400c9e30]
cmp rax, r13
jne 0x1400368ac
call fcn.140013010
add rax, 0x18
mov qword [rdi], rax
mov rax, qword [0x1400c9e30]
mov rax, qword [rax + 0x18]
lea rcx, [fcn.140013010]
cmp rax, rcx
lea rcx, [0x1400c9e30]
jne 0x1400368b8
call fcn.140013010
add rax, 0x18
mov qword [r15 + 0x18], rax
mov rdx, qword [rsp + 0x58]
lea rcx, [rdx - 0x18]
mov r12, qword [r15 + 8]
sub r12, 0x18
cmp rcx, r12
jne 0x1400368c4
mov rdx, qword [rsp + 0x60]
lea rcx, [rdx - 0x18]
mov r12, qword [rdi]
sub r12, 0x18
cmp rcx, r12
jne 0x14003690d
mov rdx, qword [rsp + 0x68]
lea rcx, [rdx - 0x18]
mov r12, qword [r15 + 0x18]
sub r12, 0x18
cmp rcx, r12
jne 0x140036951
mov eax, dword [rsp + 0x70]
mov dword [r15 + 0x20], eax
mov eax, dword [rsp + 0x74]
mov dword [r15 + 0x24], eax
mov eax, dword [rsp + 0x78]
mov dword [r15 + 0x28], eax
mov eax, dword [rsp + 0x7c]
mov dword [r15 + 0x2c], eax
mov eax, dword [rbp - 0x80]
mov dword [r15 + 0x30], eax
mov eax, dword [rbp - 0x7c]
mov dword [r15 + 0x34], eax
mov eax, dword [rbp - 0x78]
mov dword [r15 + 0x38], eax
mov dword [r14 + 0x48], 1
lea r12, [r14 + 0x60]
xor r13d, r13d
mov qword [r12], r13
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0x50]
mov qword [rsi + 0x10], rcx
mov dword [r14 + 0x48], r13d
lea rcx, [r14 + 0x50]
test rcx, rcx
je 0x140036ab0
mov rax, qword [rsi + 0x28]
mov qword [rcx], rax
lea rcx, [r14 + 0x58]
test rcx, rcx
je 0x140036aa5
mov rax, qword [rsi + 0x28]
mov qword [rcx], rax
test r12, r12
je 0x140036a9a
mov rax, qword [rsi + 0x28]
mov qword [r12], rax
inc qword [rsi + 8]
mov r15d, r13d
mov rdi, qword [rsi]
cmp rdi, qword [rsi + 0x28]
je 0x14000f9f7
mov r15, rdi
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jle 0x140036996
mov rdi, qword [rdi + 0x58]
jmp 0x14000f9d4
mov qword [r12], r15
test r15, r15
je 0x14000fc6b
mov rdx, qword [r15]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jle 0x14003699f
mov qword [r15 + 0x58], r14
mov dword [r14 + 0x48], r13d
mov rax, qword [rsi]
cmp r14, rax
je 0x14000fa3c
mov r10, r14
mov r9, r14
mov rdx, qword [r14 + 0x60]
cmp dword [rdx + 0x48], 0
je 0x14000fb42
mov dword [rax + 0x48], 1
mov rcx, qword [rsi]
add rcx, 0x60
je 0x140036a8f
mov rax, qword [rsi + 0x28]
mov qword [rcx], rax
mov r15d, dword [rsp + 0x40]
lea r12, [fcn.140013010]
lea r14, [0x14008bba0]
lea rdi, fcn.140019f80
inc r15d
mov dword [rsp + 0x40], r15d
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000faaa
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
lea r8, [fcn.140012fb0]
cmp rax, r8
jne 0x140036a14
call fcn.140012fb0
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x140036a20
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x140036a36
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x140036a4c
mov qword [rbp - 0x30], r14
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x14000fb14
cmp dword [rbp + 0x78], 0
je 0x14000fb14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea rax, [0x14008bc60]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdi
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14000f580
lea rax, [rbp - 0x10]
cmp rcx, rax
je 0x14000f580
jmp 0x140036a62
mov rcx, qword [rdx + 0x60]
mov rax, qword [rcx + 0x50]
cmp rdx, rax
je 0x1400369a8
test rax, rax
je 0x14000fb62
cmp dword [rax + 0x48], 0
je 0x14000fc73
cmp r14, qword [rdx + 0x50]
je 0x140036a03
mov rax, qword [r14 + 0x60]
mov dword [rax + 0x48], 1
mov rax, qword [r14 + 0x60]
mov rcx, qword [rax + 0x60]
mov dword [rcx + 0x48], r13d
mov rdx, qword [r14 + 0x60]
mov rdx, qword [rdx + 0x60]
mov rcx, rsi
call fcn.14000e270
mov rax, qword [rsi]
cmp r14, rax
jne 0x14000fa28
jmp 0x14000fa3c
cmp qword [rsi + 0x28], 0
jne 0x14000fc03
mov ecx, 0x68
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rsi + 0x28], rax
test rax, rax
je 0x140036a6e
xor edx, edx
lea r8d, [rdx + 0x68]
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [rsi + 0x28]
mov dword [rax + 0x48], 1
mov rax, qword [rsi + 0x28]
mov qword [rax + 0x58], rax
mov rcx, qword [rsi + 0x28]
mov rax, qword [rcx + 0x58]
mov qword [rcx + 0x50], rax
mov rcx, qword [rsi + 0x28]
mov rax, qword [rcx + 0x50]
mov qword [rcx + 0x60], rax
mov rax, qword [rsi + 0x28]
mov qword [rsi], rax
lea rcx, [rsi + 0x18]
mov r8d, 0x68
mov rdx, qword [rsi + 0x20]
call fcn.14001a1f0
test rax, rax
je 0x140036a79
mov rdx, qword [rsi + 0x20]
imul r8, rdx, 0x68
add r8, 0xffffffffffffffa0
add r8, rax
sub rdx, 1
js 0x14000f781
nop dword [rax + rax]
mov rax, qword [rsi + 0x10]
mov qword [r8 + 0x50], rax
mov qword [rsi + 0x10], r8
sub r8, 0x68
sub rdx, 1
jns 0x14000fc40
jmp 0x14000f781
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov ebx, r13d
jmp 0x14000f5d8
mov qword [rsi], r14
jmp 0x14000fa1c
mov dword [rdx + 0x48], 1
mov dword [rax + 0x48], 1
mov rax, qword [r14 + 0x60]
mov rcx, qword [rax + 0x60]
mov dword [rcx + 0x48], r13d
mov rax, qword [r14 + 0x60]
mov r14, qword [rax + 0x60]
jmp 0x14000fb93
lea rcx, [rbp + 0x90]
call fcn.140013e30
mov eax, r13d
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.14002cdb0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop
cmp eax, 2
je 0x14000fc9a
test eax, eax
jg 0x140036aec
mov r13d, eax
jmp 0x14000fc9a
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov ebx, r13d
jmp 0x14000f5d8
call qword [case.0x140006f84.0]
nop
jmp 0x14000f66f
call qword [case.0x140006f84.0]
nop
jmp 0x14000f698
call qword [case.0x140006f84.0]
nop
jmp 0x14000f6c1
call qword [case.0x140006f84.0]
nop
jmp 0x14000f712
mov r14, rdi
jmp 0x14000f73e
mov rdi, qword [rdi + 0x50]
jmp 0x14000f73e
mov rdx, r14
mov rcx, rsi
call fcn.140075e50
mov rdi, rax
test rax, rax
je 0x140036832
mov rdx, qword [rax]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140036832
mov r14, rdi
jmp 0x14003680a
test r14, r14
je 0x14000f776
lea rcx, [r14 + 8]
lea rdx, [rsp + 0x50]
call fcn.140016340
nop
jmp 0x14000fa63
call qword [case.0x140006f84.0]
nop
jmp 0x14000f7b1
movzx edi, bx
mov ecx, edi
call fcn.140054b64
test rax, rax
je 0x14000f851
mov r8d, edi
mov rdx, rax
mov rcx, r14
call fcn.140056308
nop
jmp 0x14000f851
lea r8, [r10 + r15*2]
call qword [sym.imp.msvcrt.dll_memmove_s]
nop
jmp 0x14000f82f
mov rcx, r14
call fcn.140055b08
nop
jmp 0x14000f851
call qword [case.0x140006f84.0]
nop
jmp 0x14000f88a
call qword [case.0x140006f84.0]
nop
jmp 0x14000f8b6
call qword [case.0x140006f84.0]
nop
jmp 0x14000f8e4
mov eax, dword [r12 + 0x10]
shr eax, 0x1f
test al, al
jne 0x1400368fa
mov rax, qword [r12]
cmp qword [rcx], rax
jne 0x1400368fa
call fcn.14000ec90
mov rdi, rax
mov rcx, r12
call fcn.140013dd0
lea rax, [rdi + 0x18]
mov qword [r15 + 8], rax
lea rdi, [r15 + 0x10]
jmp 0x14000f906
mov r8d, dword [rdx - 0x10]
lea rcx, [r15 + 8]
call fcn.140012c40
nop
jmp 0x14000f906
mov eax, dword [r12 + 0x10]
shr eax, 0x1f
test al, al
jne 0x14003693f
mov rax, qword [r12]
cmp qword [rcx], rax
jne 0x14003693f
call fcn.14000ec90
mov rdi, rax
mov rcx, r12
call fcn.140013dd0
lea rax, [rdi + 0x18]
mov qword [r15 + 0x10], rax
jmp 0x14000f91f
mov r8d, dword [rdx - 0x10]
mov rcx, rdi
call fcn.140012c40
nop
jmp 0x14000f91f
mov eax, dword [r12 + 0x10]
shr eax, 0x1f
test al, al
jne 0x140036983
mov rax, qword [r12]
cmp qword [rcx], rax
jne 0x140036983
call fcn.14000ec90
mov rdi, rax
mov rcx, r12
call fcn.140013dd0
lea rax, [rdi + 0x18]
mov qword [r15 + 0x18], rax
jmp 0x14000f939
mov r8d, dword [rdx - 0x10]
lea rcx, [r15 + 0x18]
call fcn.140012c40
nop
jmp 0x14000f939
mov rdi, qword [rdi + 0x50]
jmp 0x14000f9d4
mov qword [r15 + 0x50], r14
jmp 0x14000fa1c
mov rax, qword [rcx + 0x58]
test rax, rax
je 0x1400369bb
cmp dword [rax + 0x48], 0
je 0x14000fc73
mov r11, qword [rdx + 0x58]
cmp r14, r11
jne 0x1400369cc
mov rcx, rsi
call fcn.14000e270
mov r14, rdx
cmp r9, r11
cmovne r14, r10
mov rax, qword [r14 + 0x60]
mov dword [rax + 0x48], 1
mov rax, qword [r14 + 0x60]
mov rcx, qword [rax + 0x60]
mov dword [rcx + 0x48], r13d
mov rdx, qword [r14 + 0x60]
mov rdx, qword [rdx + 0x60]
mov rcx, rsi
call fcn.140079d58
nop
jmp 0x14000fb93
mov r14, rdx
mov rcx, rsi
call fcn.140079d58
nop
jmp 0x14000fb6c
call qword [case.0x140006f84.0]
nop
jmp 0x14000faaa
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140006f84.0]
nop
jmp 0x14000fac4
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140006f84.0]
nop
jmp 0x14000fade
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140006f84.0]
nop
jmp 0x14000faf8
call qword [sym.imp.msvcrt.dll_free]
nop
jmp 0x14000f580
mov ecx, 0x8007000e
call fcn.14004a3b0
int3
mov ecx, 0x8007000e
call fcn.14004a3b0
nop
mov ecx, 0x80070057
call fcn.14004a3b0
nop
mov ecx, 0x80004005
call fcn.14004a3b0
int3
mov ecx, 0x80004005
call fcn.14004a3b0
int3
mov ecx, 0x80004005
call fcn.14004a3b0
int3
mov ecx, 0x80004005
call fcn.14004a3b0
nop
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jg 0x140036aca
mov r13d, eax
jmp 0x140036ad5
movzx r13d, ax
or r13d, 0x80070000
lea rcx, [rbp - 0x30]
call fcn.140013e30
nop
jmp 0x14000fc9a
test eax, eax
jle 0x1400367ae
movzx r13d, ax
or r13d, 0x80070000
jmp 0x14000fc9a