Function at 0x14001b620
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rax, qword [0x1400950a0]
xor rax, rsp
mov qword [rbp + 0x470], rax
mov rsi, r8
mov rbx, rcx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x38], r8
xor r14d, r14d
mov dword [rsp + 0x60], r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [rsp + 0x60], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x260]
call fcn.1400412c0
mov dword [rsp + 0x68], 0x104
mov dword [rsp + 0x64], r14d
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14001b6a5
mov rdx, qword [rsi]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001baeb
lea rax, [rbp - 0x70]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x260]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14001baeb
lea r9, [rbp + 0x5a]
mov r8d, dword [rsp + 0x64]
nop dword [rax]
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x14001b750
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
lea rax, [rbp + 0x5a]
cmp r9, rax
je 0x14001b7b4
lea r8, [rbp + 0x5a]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp - 0x30]
call fcn.140007c80
mov dword [rsp + 0x60], 7
mov rcx, qword [rsi + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 9
jb 0x14001bb6c
mov rax, rsi
cmp qword [rsi + 0x18], 8
jb 0x14001b7e4
mov rax, qword [rsi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.Reg_key:
lea rcx, [rbp + 0x10]
call fcn.14000a370
mov dword [rsp + 0x60], 0xf
mov r8d, 5
lea rdx, str._has
lea rcx, [rbp + 0x10]
call fcn.14000b440
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov dword [rsp + 0x60], 0x1f
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.14001c720
mov dword [rsp + 0x60], 0x3f
mov r8d, 8
lea rdx, str._subkeys
lea rcx, [rbp - 0x10]
call fcn.14000b440
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov dword [rsp + 0x60], 0x7f
lea rcx, [rbp - 0x68]
call fcn.14002f820
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x14001b8f8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b8f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bb72
call fcn.14003e780
mov qword [rbp], r14
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r14w
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x14001b94a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b944
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bb78
call fcn.14003e780
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x14001b98a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b985
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bb7e
call fcn.14003e780
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r14w
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001b9db
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b9d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bb84
call fcn.14003e780
mov edi, r14d
cmp dword [rsp + 0x64], r14d
jbe 0x14001baeb
nop dword [rax]
mov dword [rsp + 0x6c], 0xff
lea rax, [rbp - 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x6c]
lea r8, [rbp + 0x60]
mov edx, edi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001badf
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
lea rax, [rbp + 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14001ba50
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x30]
call fcn.140007c80
nop
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x14001ba93
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rbp - 0x30], r14w
add qword [rbx + 8], 0x20
jmp 0x14001baa3
lea r8, [rbp - 0x30]
mov rcx, rbx
call fcn.14001c4c0
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001badf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bada
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bb60
call fcn.14003e780
inc edi
cmp edi, dword [rsp + 0x64]
jb 0x14001b9f0
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14001bb26
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14001bb21
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001bb66
mov rcx, r8
call fcn.14003e780
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 7
mov word [rsi], r14w
mov rax, rbx
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.14003e760
lea r11, [rsp + 0x580]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1400512b4
nop
call fcn.1400512b4
nop
call fcn.140001350
nop
call fcn.1400512b4
nop
call fcn.1400512b4
nop
call fcn.1400512b4
nop
call fcn.1400512b4
int3