Function at 0x140013ba0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x80
mov rax, qword [0x14005b0e8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [0x1417bba30]
xor ebp, ebp
mov qword [rsp + 0x60], rbp
mov dword [rsp + 0x68], ebp
cmp dword [rax + 0x3c], ebp
je 0x140013be6
lea rdx, str.NetworkDrives
lea rcx, str._DBG__ALLOC___s__n
call fcn.140001010
mov edx, 0x36
lea ecx, [rdx - 0x35]
call qword [sym.imp.msvcrt.dll_calloc]
mov rdi, rax
test rax, rax
je 0x140013e3c
mov edx, 8
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], r14
lea ecx, [rdx - 7]
call qword [sym.imp.msvcrt.dll_calloc]
mov edx, 8
mov qword [rdi + 0x18], rax
lea ecx, [rdx - 7]
call qword [sym.imp.msvcrt.dll_calloc]
lea rcx, [rdi + 0x28]
mov edx, 0xe
lea r8, str.NetworkDrives
mov qword [rdi + 8], rax
mov qword [rdi], rcx
call fcn.140031cc0
mov rcx, qword [0x1417bba30]
mov dword [rdi + 0x20], 2
cmp dword [rcx + 0x34], ebp
je 0x140013d0a
mov rsi, qword [rcx + 0x220]
mov ebx, ebp
mov rax, qword [rsi + 0x18]
cmp qword [rax], rbx
je 0x140013c8b
nop dword [rax]
inc ebx
lea rax, [rax + 8]
cmp qword [rax], rbp
jne 0x140013c80
cmp dword [rcx + 0x3c], ebp
je 0x140013ca2
mov r8, qword [rdi]
lea rcx, str._DBG__APPEND___s_______s__n
mov rdx, qword [rsi]
call fcn.140001010
mov rax, 0xffffffffffffffff
movsxd rbx, ebx
lea rcx, [rbx + 1]
add rcx, 1
lea edx, [rax + 9]
cmovb rcx, rax
call qword [sym.imp.msvcrt.dll_calloc]
mov r14, rax
test rax, rax
je 0x140013e4e
test rbx, rbx
jle 0x140013cf4
mov rdx, rbp
nop word [rax + rax]
mov rax, qword [rsi + 0x18]
mov rcx, qword [rax + rdx*8]
mov qword [r14 + rdx*8], rcx
inc rdx
cmp rdx, rbx
jl 0x140013ce0
mov qword [r14 + rbx*8], rdi
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.msvcrt.dll_free]
mov qword [rsi + 0x18], r14
mov qword [rdi + 0x10], rsi
lea rax, [rsp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x14003fd50]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140013df3
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x58], rbp
xor r9d, r9d
mov qword [rsp + 0x50], rbp
xor r8d, r8d
mov qword [rsp + 0x48], rbp
xor edx, edx
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140013df3
mov ebx, ebp
cmp dword [rsp + 0x68], ebx
jbe 0x140013df3
nop word [rax + rax]
mov r8, qword [0x1417bba30]
lea r9, [rsp + 0x6c]
mov rcx, qword [rsp + 0x60]
add r8, 0x250
mov qword [rsp + 0x38], rbp
mov edx, ebx
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x6c], 0x7fff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140013deb
mov r8, qword [0x1417bba30]
mov rcx, rdi
mov rdx, qword [rsp + 0x60]
add r8, 0x250
call fcn.140013950
inc ebx
cmp ebx, dword [rsp + 0x68]
jb 0x140013d90
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140013e03
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x98]
mov rax, rdi
mov rbx, qword [rsp + 0x90]
mov r14, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140029990
mov rbp, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
lea rdx, str.Failed_to_allocate_memory_in_NWL_NodeAlloc
mov ecx, 0xe
call fcn.140001650
int3
lea rdx, str.Failed_to_allocate_memory_in_NWL_NodeAppendChild
mov ecx, 0xe
call fcn.140001650
int3