Function at 0x465640
Capabilities:
Query or enumerate registry key

Disassembly:
sub rsp, 0x1a8
mov qword [rsp + 0x1a0], rbx
mov qword [rsp + 0x198], rbp
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x188], rdi
mov qword [rsp + 0x180], r12
mov qword [rsp + 0x178], r13
mov qword [rsp + 0x170], r14
mov r13, r8
mov qword [rsp + 0x50], 0xfffffffffffffffe
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov rbp, rbx
mov qword [rsp + 0x48], rbx
mov r14d, ebx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4658b2
mov r9d, 0x104
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x4658a0
mov r12, qword [rsp + 0x40]
nop
nop
nop
inc r14d
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rsi, rcx
je 0x465791
cmp rcx, rbp
jbe 0x46576a
test rbx, rbx
je 0x46572c
mov rcx, rbx
call fcn.0049bb84
mov rcx, r12
call fcn.0049bb84
lea rcx, [rsi + 5]
call fcn.00486ab0
mov rbx, rax
mov qword [rsp + 0x38], rax
lea r8, [rsi + 5]
xor edx, edx
mov rcx, rax
call fcn.00499630
lea rcx, [rsi + 5]
call fcn.00486ab0
mov r12, rax
mov qword [rsp + 0x40], rax
lea r8, [rsi + 5]
xor edx, edx
mov rcx, rax
call fcn.00499630
mov rbp, rsi
mov qword [rsp + 0x48], rsi
lea rcx, [rsp + 0x60]
lea rax, [rsp + 0x60]
mov rdx, rbx
sub rdx, rax
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x465782
jmp 0x4657f1
cmp rbp, 1
jae 0x4657e4
test rbx, rbx
je 0x4657ac
mov rcx, rbx
call fcn.0049bb84
mov rcx, r12
call fcn.0049bb84
mov ecx, 6
call fcn.00486ab0
mov rbx, rax
mov qword [rsp + 0x38], rax
xor eax, eax
mov dword [rbx], eax
mov word [rbx + 4], ax
mov ecx, 6
call fcn.00486ab0
mov r12, rax
mov qword [rsp + 0x40], rax
xor eax, eax
mov dword [r12], eax
mov word [r12 + 4], ax
mov ebp, 1
mov qword [rsp + 0x48], rbp
mov byte [rbx], 0
mov rcx, rbx
call fcn.0048acd0
mov rcx, rax
call fcn.00487800
mov rdi, rax
mov rdx, rax
mov rax, rbx
sub rax, rdx
nop
movzx ecx, byte [rdx]
mov byte [rax + rdx], cl
inc rdx
test cl, cl
jne 0x465810
mov rcx, rdi
call fcn.00487200
mov rsi, qword [r13]
cmp rsi, 0x1f4
jae 0x46587d
lea rax, [rsi + 1]
mov qword [r13], rax
cmp rsi, 0xffffffffffffffff
je 0x46587d
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
add rcx, 4
call fcn.00486ab0
mov qword [r13 + rsi*8 + 0x200], rax
mov rdx, rbx
sub rax, rbx
nop
nop
movzx ecx, byte [rdx]
mov byte [rax + rdx], cl
inc rdx
test cl, cl
jne 0x465870
mov r9d, 0x104
lea r8, [rsp + 0x60]
mov edx, r14d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x4656f0
jmp 0x4658a5
mov r12, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4658b7
mov r12, qword [rsp + 0x40]
mov rdi, qword [r13]
test rbx, rbx
je 0x4658d4
mov rcx, r12
call fcn.0049bb84
mov rcx, rbx
call fcn.0049bb84
mov eax, edi
jmp 0x4658d6
mov eax, edi
mov rbx, qword [rsp + 0x1a0]
mov rbp, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x190]
mov rdi, qword [rsp + 0x188]
mov r12, qword [rsp + 0x180]
mov r13, qword [rsp + 0x178]
mov r14, qword [rsp + 0x170]
add rsp, 0x1a8
ret