Function at 0x1400321a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x84a8]
mov eax, 0x85a8
call fcn.140070d90
sub rsp, rax
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rbp + 0x8490], rax
mov rbx, r9
mov qword [rsp + 0x78], rbx
mov r12, r8
mov rdi, rdx
mov qword [rsp + 0x70], rdx
mov r13, rcx
mov qword [rbp - 0x50], rbx
mov r14, qword [rbp + 0x8510]
mov r15, qword [rbp + 0x8518]
mov qword [rbp - 0x78], r15
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x280]
call fcn.140072740
mov dword [rbp - 0x80], 0x104
xor esi, esi
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x64], 0x3fff
lea rax, [rbp - 0x58]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x64]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x280]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], si
cmp r12, 0xffffffff80000000
jne 0x1400322b3
lea r8d, [rsi + 0x12]
lea rdx, str.HKEY_CLASSES_ROOT_
jmp 0x140032311
cmp r12, 0xffffffff80000001
jne 0x1400322cb
mov r8d, 0x12
lea rdx, str.HKEY_CURRENT_USER_
jmp 0x140032311
cmp r12, 0xffffffff80000002
jne 0x1400322e3
mov r8d, 0x13
lea rdx, str.HKEY_LOCAL_MACHINE_
jmp 0x140032311
cmp r12, 0xffffffff80000003
jne 0x1400322fb
mov r8d, 0xb
lea rdx, str.HKEY_USERS_
jmp 0x140032311
cmp r12, 0xffffffff80000005
jne 0x14003231a
mov r8d, 0x14
lea rdx, str.HKEY_CURRENT_CONFIG_
lea rcx, [rbp - 0x48]
call fcn.1400027d0
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14003286d
mov r15d, esi
nop dword [rax]
mov dword [rbp - 0x7c], 0xff
lea rax, [rbp - 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x7c]
lea r8, [rbp + 0x80]
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14003285b
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], si
mov qword [rbp - 8], rsi
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], 7
mov word [rbp - 8], si
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140032511
movabs rax, 0x7ffffffffffffffe
mov rdx, qword [rbp - 0x38]
sub rax, rdx
cmp rax, rcx
jb 0x140032c2a
lea r9, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae r9, qword [rbp - 0x48]
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400323d8
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x58]
call fcn.140018a00
nop
mov r8d, 1
lea rdi, [0x1400bc204]
mov rdx, rdi
lea rcx, [rbp + 0x58]
call fcn.140014b80
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rax, [rbp + 0x80]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140032442
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x18]
call fcn.140014b80
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm1
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x1400324bb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400324b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032c1e
call fcn.140070654
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], si
mov rdx, qword [rbp + 0x70]
cmp rdx, 8
jb 0x140032588
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003250a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032c24
call fcn.140070654
jmp 0x140032588
lea rax, [rbp + 0x80]
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140032520
movabs rax, 0x7ffffffffffffffe
mov rdx, qword [rbp - 0x38]
sub rax, rdx
cmp rax, rcx
jb 0x140032c4e
lea r9, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae r9, qword [rbp - 0x48]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x38]
call fcn.140018a00
movups xmm0, xmmword [rbp + 0x38]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rbp + 0x48]
movups xmmword [rbp - 0x18], xmm1
lea rdi, [0x1400bc204]
mov rcx, qword [rbx + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 1
jb 0x140032c48
mov r9, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400325b0
mov r9, qword [rbx]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x38]
call fcn.140018a00
nop
lea rax, [rbp + 0x80]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400325e0
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x38]
call fcn.140014b80
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x18], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp + 0x10]
cmp rdx, 8
jb 0x140032661
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032654
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032c30
call fcn.140070654
movups xmm0, xmmword [rbp + 0x58]
movups xmm1, xmmword [rbp + 0x18]
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm1
mov rdx, qword [rbp + 0x50]
cmp rdx, 8
jb 0x1400326a9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400326a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032c36
call fcn.140070654
mov r11, qword [r14 + 8]
mov r10, qword [r14]
cmp r10, r11
je 0x14003273e
mov rdi, qword [rbp - 0x10]
mov rsi, qword [rbp - 0x18]
mov rbx, qword [rbp - 0x28]
nop word [rax + rax]
lea rax, [rbp - 0x28]
cmp rdi, 8
cmovae rax, rbx
mov rcx, qword [r10 + 0x10]
mov r9, r10
cmp qword [r10 + 0x18], 8
jb 0x1400326ed
mov r9, qword [r10]
cmp rcx, rsi
jne 0x14003272a
test rcx, rcx
je 0x140032735
movzx edx, word [r9]
movzx r8d, word [rax]
cmp dx, r8w
jb 0x14003272a
sub r9, rax
cmp dx, r8w
ja 0x14003272a
cmp rcx, 1
je 0x140032735
dec rcx
add rax, 2
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jae 0x14003270c
add r10, 0x20
cmp r10, r11
je 0x14003273e
jmp 0x1400326d0
cmp r10, r11
jne 0x1400327c4
cmp r11, qword [r14 + 0x10]
je 0x140032757
lea rdx, [rbp - 0x28]
mov rcx, r11
call fcn.1400025c0
add qword [r14 + 8], 0x20
jmp 0x140032766
lea r8, [rbp - 0x28]
mov rdx, r11
mov rcx, r14
call fcn.140017190
test r12, r12
je 0x140032794
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x38]
call fcn.1400025c0
mov rcx, qword [rbp - 0x78]
mov qword [rsp + 0x20], rcx
mov r9, r14
mov r8, rax
mov rdx, r12
mov rcx, r13
call fcn.140032c70
jmp 0x1400327bc
lea r8, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae r8, qword [rbp - 8]
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
lea rcx, str.QueryKey:__s_________hkey_is_NULL________________s
call fcn.1400262b0
mov rbx, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x10]
mov rdx, qword [rbp + 0x10]
cmp rdx, 8
jb 0x140032804
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400327ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032c3c
call fcn.140070654
xor esi, esi
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], 7
mov word [rbp - 8], si
cmp rdi, 8
jb 0x140032851
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140032849
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032c42
mov rcx, rbx
call fcn.140070654
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
inc r15d
cmp r15d, dword [rsp + 0x60]
jb 0x140032330
mov r15, qword [rbp - 0x78]
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x140032b50
mov r14d, esi
nop dword [rax]
mov dword [rsp + 0x64], 0x3fff
mov word [rbp + 0x490], si
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x64]
lea r8, [rbp + 0x490]
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140032b3c
mov rcx, qword [rbx + 0x10]
movabs rax, 0x7ffffffffffffffe
mov rdx, qword [rbp - 0x38]
sub rax, rdx
cmp rax, rcx
jb 0x140032c66
lea r9, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae r9, qword [rbp - 0x48]
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400328fc
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x18]
call fcn.140018a00
nop
mov r8d, 1
lea rdx, [0x1400bc204]
lea rcx, [rbp + 0x18]
call fcn.140014b80
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rax, [rbp + 0x490]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140032963
lea rdx, [rbp + 0x490]
lea rcx, [rbp - 0x28]
call fcn.140014b80
movups xmm0, xmmword [rax]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 8], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x1400329dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400329d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032c54
call fcn.140070654
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], si
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x140032a2c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032a27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032c5a
call fcn.140070654
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], si
mov rbx, qword [r15 + 8]
mov r10, qword [r15]
cmp r10, rbx
je 0x140032aca
mov rdi, qword [rbp + 0x10]
mov rsi, qword [rbp + 8]
mov r11, qword [rbp - 8]
nop dword [rax + rax]
lea rax, [rbp - 8]
cmp rdi, 8
cmovae rax, r11
mov rcx, qword [r10 + 0x10]
mov r9, r10
cmp qword [r10 + 0x18], 8
jb 0x140032a7d
mov r9, qword [r10]
cmp rcx, rsi
jne 0x140032aba
test rcx, rcx
je 0x140032ac5
movzx edx, word [r9]
movzx r8d, word [rax]
cmp dx, r8w
jb 0x140032aba
sub r9, rax
cmp dx, r8w
ja 0x140032aba
cmp rcx, 1
je 0x140032ac5
dec rcx
add rax, 2
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jae 0x140032a9c
add r10, 0x20
cmp r10, rbx
je 0x140032aca
jmp 0x140032a60
cmp r10, rbx
jne 0x140032afa
cmp rbx, qword [r15 + 0x10]
je 0x140032ae3
lea rdx, [rbp - 8]
mov rcx, rbx
call fcn.1400025c0
add qword [r15 + 8], 0x20
jmp 0x140032af2
lea r8, [rbp - 8]
mov rdx, rbx
mov rcx, r15
call fcn.140017190
mov r11, qword [rbp - 8]
mov rdi, qword [rbp + 0x10]
cmp rdi, 8
jb 0x140032b35
lea rdx, [rdi*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x140032b2d
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032c60
mov rcx, r11
call fcn.140070654
xor esi, esi
mov rdi, qword [rsp + 0x70]
inc r14d
cmp r14d, dword [rsp + 0x68]
jae 0x140032b50
mov rbx, qword [rsp + 0x78]
jmp 0x140032880
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x140032b90
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032b8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032c12
call fcn.140070654
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], si
mov rbx, qword [rsp + 0x78]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140032be0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140032bdb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140032c18
mov rcx, r8
call fcn.140070654
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rcx, qword [rbp + 0x8490]
xor rcx, rsp
call fcn.140070140
add rsp, 0x85a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14007d0fc
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
int3
call fcn.1400020a0
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
nop
call fcn.1400020a0
int3
call fcn.1400020a0
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
int3
call fcn.1400020a0
int3