Function at 0x14010f5c0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x9b0
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x9a0], rax
xor ebp, ebp
mov r14, rcx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x340]
mov rdi, rbp
mov r13, rbp
mov r15d, ebp
mov dword [rsp + 0x30], ebp
call fcn.1400012c0
lea rcx, [rsp + 0x460]
call fcn.1400012c0
lea r8, [rsp + 0x586]
mov r9d, 0x101
xor edx, edx
mov rcx, 0xffffffff80000000
mov r12d, ebp
mov word [rsp + 0x580], 0x66
mov word [rsp + 0x582], 0x6f
mov word [rsp + 0x584], 0x6f
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
je 0x14010f7dc
nop
nop
test eax, eax
jne 0x14010f7a5
cmp word [rsp + 0x586], 0x2e
jne 0x14010f7a5
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x790]
lea rdx, [rsp + 0x586]
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x34], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x14010f7a5
cmp word [rsp + 0x790], 0x2e
je 0x14010f7a5
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x790]
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x38], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x14010f7a5
cmp word [rsp + 0x80], bp
je 0x14010f7a5
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x340]
call fcn.1401782f0
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x460]
call fcn.1401782f0
mov r14, qword [rsp + 0x468]
mov rsi, qword [rsp + 0x348]
mov ecx, 0x38
call fcn.1400cf3f0
cmp byte [rsi], bpl
mov rdx, rsi
mov rbx, rax
je 0x14010f760
add rdx, 1
cmp byte [rdx], bpl
jne 0x14010f757
sub edx, esi
mov rcx, rsi
mov dword [rax + 8], edx
call fcn.14016dfd0
mov rcx, r14
mov qword [rbx], rax
call fcn.14016e020
test rdi, rdi
mov qword [rbx + 0x10], rbp
mov dword [rbx + 0x18], ebp
mov qword [rbx + 0x20], rax
mov eax, dword [0x14020e230]
mov dword [rbx + 0x28], eax
je 0x14010f797
mov qword [r13 + 0x30], rbx
jmp 0x14010f79a
mov rdi, rbx
mov qword [rbx + 0x30], rbp
mov r13, rbx
add r15d, 1
add r12d, 1
lea r8, [rsp + 0x586]
mov r9d, 0x101
mov edx, r12d
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x14010f670
mov r14, qword [rsp + 0x40]
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x460]
call fcn.140177510
lea rcx, [rsp + 0x340]
call fcn.140177510
test r15d, r15d
je 0x14010fad2
movsxd rcx, r15d
shl rcx, 3
call fcn.1400cf3f0
test rdi, rdi
mov rsi, rax
mov rcx, rax
je 0x14010f830
nop
nop
nop
mov qword [rcx], rdi
mov rdi, qword [rdi + 0x30]
add rcx, 8
test rdi, rdi
jne 0x14010f820
lea r8, [0x14010f4e0]
mov edx, r15d
mov rcx, rax
call fcn.1400e2d90
test r15d, r15d
mov rbx, rbp
jle 0x14010f933
mov edi, r15d
test rbx, rbx
je 0x14010f8a4
mov rax, qword [rsi + rbx*8]
mov r9, qword [rsi + rbx*8 - 8]
mov r10d, dword [r9 + 8]
mov r11d, dword [rax + 8]
mov rcx, qword [rax]
cmp r11d, r10d
mov r8d, r10d
cmovl r8d, r11d
test r8d, r8d
je 0x14010f896
mov r9, qword [r9]
sub r9, rcx
nop
movzx eax, byte [r9 + rcx]
movzx edx, byte [rcx]
sub edx, eax
jne 0x14010f89c
add rcx, 1
sub r8d, 1
jne 0x14010f880
mov edx, r11d
sub edx, r10d
test edx, edx
je 0x14010f925
mov rcx, qword [rsi + rbx*8]
lea r8, [rsp + 0x80]
mov r9d, 0x2b8
mov rcx, qword [rcx + 0x20]
mov edx, 0x80
mov dword [rsp + 0x20], 0x4411
call fcn.1400db260
test rax, rax
je 0x14010f925
lea rcx, [rsp + 0x298]
call fcn.1401769b0
mov rcx, qword [rsi + rbx*8]
mov qword [rcx + 0x10], rax
mov rax, qword [rsi + rbx*8]
mov rdx, qword [rax + 0x10]
mov rcx, rdx
cmp byte [rdx], bpl
je 0x14010f8ff
add rcx, 1
cmp byte [rcx], bpl
jne 0x14010f8f6
sub ecx, edx
mov dword [rax + 0x18], ecx
mov rcx, qword [rsi + rbx*8]
mov eax, dword [rsp + 0x88]
mov dword [rcx + 0x28], eax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14010f925
call qword [sym.imp.USER32.dll_DestroyIcon]
add rbx, 1
sub rdi, 1
jne 0x14010f851
lea r8, [0x14010f530]
mov edx, r15d
mov rcx, rsi
call fcn.1400e2d90
lea rcx, [rsp + 0x80]
call fcn.1400012c0
mov rcx, qword [r14 + 0x10]
mov edx, 0x41f
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [rsp + 0x30]
test edi, edi
mov r15, rax
jle 0x14010fa79
mov r14, rdi
test rbp, rbp
je 0x14010fa01
mov rdx, qword [rsi + rbp*8]
mov rcx, qword [rsi + rbp*8 - 8]
lea rbx, [0x1401b0f62]
mov rax, qword [rdx + 0x10]
mov r12d, dword [rcx + 0x18]
mov r13d, dword [rdx + 0x18]
test rax, rax
lea rdi, [0x1401b0f62]
mov r9d, r12d
cmovne rbx, rax
mov rax, qword [rcx + 0x10]
mov edx, r13d
test rax, rax
mov rcx, rbx
cmovne rdi, rax
mov r8, rdi
call fcn.14000db90
test eax, eax
mov r11d, eax
jne 0x14010f9fc
cmp r13d, r12d
mov ecx, r12d
cmovl ecx, r13d
test ecx, ecx
je 0x14010f9f6
sub rdi, rbx
nop
nop
movzx eax, byte [rdi + rbx]
movzx r11d, byte [rbx]
sub r11d, eax
jne 0x14010f9fc
add rbx, 1
sub ecx, 1
jne 0x14010f9e0
mov r11d, r13d
sub r11d, r12d
test r11d, r11d
je 0x14010fa62
mov rdx, qword [rsi + rbp*8]
cmp dword [rdx + 0x18], 0
je 0x14010fa62
mov rdx, qword [rdx + 0x10]
lea rcx, [rsp + 0x80]
call fcn.14017d970
mov rcx, qword [rsi + rbp*8]
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x48], 7
mov qword [rsp + 0x50], 0xffffffffffffffff
mov eax, dword [rcx + 0x28]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x64], eax
mov eax, dword [rcx + 0x28]
mov edx, 0x40b
mov rcx, r15
mov dword [rsp + 0x68], eax
call qword [sym.imp.USER32.dll_SendMessageW]
add rbp, 1
sub r14, 1
jne 0x14010f973
mov edi, dword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
lea rcx, [rsp + 0x80]
call fcn.140177510
test edi, edi
jle 0x14010faca
mov rbx, rsi
nop
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14010faa1
call fcn.1400cf470
mov rcx, qword [rbx]
mov rcx, qword [rcx + 0x20]
call fcn.1400cf470
mov rcx, qword [rbx]
mov rcx, qword [rcx]
call fcn.1400cf470
mov rcx, qword [rbx]
call fcn.1400cf470
add rbx, 8
sub rdi, 1
jne 0x14010fa90
mov rcx, rsi
call fcn.1400cf470
mov dword [r14 + 0x28], 1
mov rcx, qword [rsp + 0x9a0]
xor rcx, rsp
call fcn.1401a8fd0
lea r11, [rsp + 0x9b0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret