Function at 0x14000bce0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
push r13
lea rbp, [rsp - 0x3e8]
sub rsp, 0x4e8
mov rdi, r8
lea rcx, [rbp + 0x1c0]
mov rbx, rdx
mov r8d, 0x208
xor edx, edx
call fcn.1400376d0
lea rax, [rsp + 0x60]
mov dword [rsp + 0x68], 0x104
xor r13d, r13d
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov dword [rbp + 0x428], r13d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x58]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x68]
lea rax, [rbp - 0x70]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rdx, [rbp + 0x1c0]
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x64]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x428]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14000c036
cmp dword [rbp + 0x428], r13d
je 0x14000c02b
mov qword [rsp + 0x518], rsi
lea rcx, [0x1400729c0]
mov qword [rsp + 0x4e0], r12
mov qword [rsp + 0x4d8], r14
mov qword [rsp + 0x4d0], r15
call fcn.140008e10
lea rcx, [0x1400729d0]
mov qword [rbp - 0x50], rax
mov rbx, rax
call fcn.140008e10
lea rcx, [0x1400729e0]
mov qword [rsp + 0x70], rax
mov rdi, rax
call fcn.140008e10
lea rcx, [0x1400729f0]
mov qword [rsp + 0x78], rax
mov rsi, rax
call fcn.140008e10
lea rcx, [0x140072a00]
mov qword [rbp - 0x80], rax
mov r14, rax
call fcn.140008e10
mov r15, rax
mov qword [rbp - 0x78], rax
mov r12d, r13d
cmp dword [rbp + 0x428], r13d
jbe 0x14000bfcb
nop
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x58]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x6c]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x40]
mov qword [rsp + 0x28], r13
mov edx, r12d
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x6c], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000bfbb
mov r8, qword [rsp + 0x60]
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.14001f360
mov r8, qword [rsp + 0x60]
lea rdx, [rbp - 0x40]
mov rcx, rdi
mov r13, rax
call fcn.14001f360
mov r8, qword [rsp + 0x60]
lea rdx, [rbp - 0x40]
mov rcx, rsi
mov rdi, rax
call fcn.14001f360
mov r8, qword [rsp + 0x60]
lea rdx, [rbp - 0x40]
mov rcx, r14
mov rsi, rax
call fcn.14001f360
mov r8, qword [rsp + 0x60]
lea rdx, [rbp - 0x40]
mov rcx, r15
mov r14, rax
call fcn.14001f360
mov r15, rax
test r13, r13
je 0x14000bf86
mov ecx, 0x28
call fcn.140038534
mov rbx, rax
test rax, rax
je 0x14000bf71
mov qword [rax], r13
test rdi, rdi
jne 0x14000bf25
lea rcx, [0x140072a10]
call fcn.140008e10
mov rdi, rax
mov qword [rbx + 8], rdi
test rsi, rsi
jne 0x14000bf3d
lea rcx, [0x140072a10]
call fcn.140008e10
mov rsi, rax
mov qword [rbx + 0x10], rsi
test r14, r14
jne 0x14000bf55
lea rcx, [0x140072a10]
call fcn.140008e10
mov r14, rax
mov qword [rbx + 0x18], r14
test r15, r15
jne 0x14000bf6d
lea rcx, [0x140072a10]
call fcn.140008e10
mov r15, rax
mov qword [rbx + 0x20], r15
mov rcx, qword [rbp + 0x410]
mov rdx, rbx
call fcn.140004950
mov rbx, qword [rbp - 0x50]
jmp 0x14000bfa6
mov rcx, rdi
call fcn.140038520
mov rcx, rsi
call fcn.140038520
mov rcx, r14
call fcn.140038520
mov rcx, r15
call fcn.140038520
mov r15, qword [rbp - 0x78]
xor r13d, r13d
mov r14, qword [rbp - 0x80]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
inc r12d
cmp r12d, dword [rbp + 0x428]
jb 0x14000be50
mov rcx, rbx
call fcn.140038520
mov rcx, rdi
call fcn.140038520
mov rcx, rsi
call fcn.140038520
mov rcx, r14
call fcn.140038520
mov rcx, r15
call fcn.140038520
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15, qword [rsp + 0x4d0]
mov r14, qword [rsp + 0x4d8]
mov r12, qword [rsp + 0x4e0]
mov rsi, qword [rsp + 0x518]
add rsp, 0x4e8
pop r13
pop rdi
pop rbx
pop rbp
ret
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x4e8
pop r13
pop rdi
pop rbx
pop rbp
ret