Function at 0x1402cbd30
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1e8
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x8c], eax
mov rax, qword [rsp + 0x258]
mov r14, r9
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rax
mov rax, qword [r9]
xor r9d, r9d
mov qword [rsp + 0x78], r8
mov eax, dword [rax + 8]
shl eax, 0xa
sar eax, 0x12
test ax, ax
jle 0x1402cbd97
add dword [rsp + 0x8c], 1
mov r8, qword [rsp + 0x78]
xor r9d, r9d
mov rdx, qword [rsp + 0x48]
lea rax, [0x140486dcd]
mov rcx, rax
mov qword [rsp + 0x98], rax
call fcn.1400cae80
mov qword [rsp + 0x90], rax
mov rax, qword [r14 + 0x20]
mov rdx, rax
test rax, rax
je 0x1402cbdeb
nop word [rax + rax]
mov rdx, qword [rdx + 8]
test rdx, rdx
jne 0x1402cbdc8
nop dword [rax]
mov rdx, rax
mov rax, qword [rax + 8]
mov rdx, qword [rdx]
and byte [rdx + 0xb], 0x7f
test rax, rax
jne 0x1402cbdd8
lea rax, [rsp + 0xbc]
mov r12, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor edi, edi
lea rbx, [rsp + 0xd0]
mov qword [rsp + 0x68], rax
lea r15, [rsp + 0xc0]
nop dword [rax]
mov dword [rsp + 0xbc], 0x81
mov r9, qword [rsp + 0x68]
mov r8, rbx
mov edx, edi
mov qword [rsp + 0x38], 0
mov rcx, rsi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r12
test eax, eax
jne 0x1402cbf30
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rdx, rbx
mov rcx, rsi
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1402cbe88
add edi, 1
jmp 0x1402cbe18
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, rbx
call fcn.1402b36b0
mov r13, rax
test rax, rax
je 0x1402cbe7d
mov rdx, rax
mov rcx, r14
call fcn.14005d4d0
mov rbp, rax
test rax, rax
je 0x1402cc378
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x98]
xor r9d, r9d
mov r8, r13
call fcn.1400cae80
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0xc0]
mov r9, rbp
mov r8, rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x20], eax
call fcn.1402cbd30
mov rcx, qword [rsp + 0x58]
call fcn.14034efb0
mov rax, qword [rbp]
mov rcx, r13
or byte [rax + 0xb], 0x80
call fcn.14034efb0
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1402cbe7d
cmp eax, 0x103
je 0x1402cbf45
lea rdx, str.gregistrybackend:_error_enumerating_subkeys_for_cache.
mov ecx, eax
call fcn.14005f740
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x58], r14
mov r15, qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebp, ebp
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc0]
mov r14, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x60], rax
jmp 0x1402cc09b
mov eax, dword [rsp + 0xc0]
cmp eax, 1
je 0x1402cc240
lea r10, [rsp + 0xc8]
cmp eax, 4
jne 0x1402cc318
mov qword [rsp + 0x20], r10
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x80], r10
mov rcx, rsi
mov qword [rsp + 0x28], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, r12
mov dword [rsp + 0x68], eax
call fcn.14034efb0
mov eax, dword [rsp + 0x68]
mov r10, qword [rsp + 0x80]
test eax, eax
jne 0x1402cc2c0
cmp dword [rsp + 0xc0], 1
je 0x1402cc340
movdqa xmm0, xmmword [rsp + 0xc0]
mov rcx, qword [rsp + 0x60]
movaps xmmword [rsp + 0xa0], xmm0
call fcn.1402cbcb0
test r13, r13
je 0x1402cc280
movdqa xmm1, xmmword [rsp + 0xc0]
mov rdx, qword [rsp + 0x60]
mov rcx, r13
movaps xmmword [rsp + 0xa0], xmm1
call fcn.14005d540
test eax, eax
setne dl
mov rax, qword [r13]
or byte [rax + 0xb], 0x80
cmp qword [rsp + 0x50], 0
je 0x1402cc090
test dl, dl
je 0x1402cc090
cmp qword [rsp + 0x78], 0
je 0x1402cc330
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x98]
xor r9d, r9d
mov r8, rdi
call fcn.1400cae80
mov rdx, rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x10]
call fcn.1400bc8e0
nop dword [rax + rax]
mov rcx, rdi
add ebp, 1
call fcn.14034efb0
mov dword [rsp + 0xb8], 0x81
mov r9, qword [rsp + 0x48]
mov r8, rbx
mov edx, ebp
mov qword [rsp + 0x38], 0
mov rcx, rsi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r15
test eax, eax
jne 0x1402cc198
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, rbx
call fcn.1402b36b0
mov rdi, rax
test rax, rax
je 0x1402cc090
cmp byte [rax], 0
je 0x1402cc090
mov rcx, qword [rsp + 0x58]
mov rdx, rax
call fcn.14005d4d0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, rdi
mov r13, rax
mov dword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
call fcn.1402b3210
xor r8d, r8d
mov qword [rsp + 0x28], r14
mov rcx, rsi
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x70]
mov r12, rax
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1402cbf88
cmp eax, 2
je 0x1402cc184
mov r8, qword [rsp + 0x90]
mov r9, rdi
lea rdx, str.Unable_to_query_value__s__s
mov ecx, eax
call fcn.14005f740
mov rcx, r12
call fcn.14034efb0
jmp 0x1402cc090
mov r14, qword [rsp + 0x58]
cmp eax, 0x103
je 0x1402cc1b2
lea rdx, str.gregistrybackend:_error_enumerating_values_for_cache
mov ecx, eax
call fcn.14005f740
mov rbx, qword [r14 + 0x20]
mov rdi, qword [rsp + 0x50]
test rbx, rbx
jne 0x1402cc1cd
jmp 0x1402cc217
test rbx, rbx
je 0x1402cc217
mov rsi, rbx
mov rbx, qword [rbx + 8]
mov rax, qword [rsi]
movzx eax, byte [rax + 0xb]
test al, al
js 0x1402cc1c8
lea rdx, [rsp + 0xc0]
mov rcx, rsi
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc8], 0
call fcn.140060430
mov rax, qword [rdi]
mov rcx, rsi
mov rdx, qword [rax + 0x40]
call fcn.14005ec80
test rbx, rbx
jne 0x1402cc1cd
mov rcx, qword [rsp + 0x90]
add rsp, 0x1e8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.14034efb0
mov edx, dword [rsp + 0xbc]
test edx, edx
je 0x1402cc3b8
mov rcx, rdx
mov qword [rsp + 0x68], rdx
call sub.msvcrt.dll_malloc
mov rdx, qword [rsp + 0x68]
test rax, rax
mov r10, rax
je 0x1402cc3d9
mov qword [rsp + 0xc8], r10
jmp 0x1402cbfa9
mov r9d, dword [rsp + 0x8c]
mov r8, qword [rsp + 0x60]
mov rdx, rdi
movdqa xmm2, xmmword [rsp + 0xc0]
mov rcx, qword [rsp + 0x58]
movaps xmmword [rsp + 0xa0], xmm2
call fcn.14005f0e0
mov edx, 1
mov r13, rax
jmp 0x1402cc042
cmp eax, 2
jne 0x1402cc2e0
cmp dword [rsp + 0xc0], 4
je 0x1402cc090
mov rcx, r10
call fcn.14034efb0
jmp 0x1402cc090
mov r8, qword [rsp + 0x90]
mov r9, rdi
lea rdx, str.Unable_to_query_value__s__s
mov ecx, eax
mov qword [rsp + 0x68], r10
call fcn.14005f740
cmp dword [rsp + 0xc0], 4
mov r10, qword [rsp + 0x68]
je 0x1402cc090
jmp 0x1402cc2d3
mov edx, dword [rsp + 0xbc]
xor r10d, r10d
test rdx, rdx
je 0x1402cc26d
jmp 0x1402cc24f
mov rcx, rdi
call fcn.1400e4a90
mov rdx, rax
jmp 0x1402cc07d
mov rcx, qword [rsp + 0xc8]
xor r8d, r8d
mov edx, 0xffffffff
call fcn.1402b36b0
mov rcx, qword [rsp + 0xc8]
mov r12, rax
call fcn.14034efb0
mov qword [rsp + 0xc8], r12
jmp 0x1402cbffb
mov r9d, dword [rsp + 0x8c]
lea r8, [rsp + 0xa0]
mov rdx, r13
mov rcx, r14
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
call fcn.14005f0e0
mov rbp, rax
jmp 0x1402cbeb7
lea rcx, [0x140485f2e]
call fcn.1400e4a90
mov rcx, r12
mov qword [rsp + 0xc8], rax
call fcn.14034efb0
jmp 0x1402cbffb
mov qword [rsp + 0x20], rdx
lea r9, str..._glib_gmem.c:136
lea r8, str._s:_failed_to_allocate__llu_bytes
mov edx, 4
lea rcx, str.GLib
call fcn.1400d2190
jmp 0x1402cc3fd