Function at 0x14010f260
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x9b0
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x9a0], rax
xor ebp, ebp
mov r14, rcx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x340]
mov rdi, rbp
mov r13, rbp
mov r15d, ebp
mov dword [rsp + 0x30], ebp
call fcn.14017d460
lea rcx, [rsp + 0x460]
call fcn.14017d460
lea r8, [rsp + 0x586]
mov r9d, 0x101
xor edx, edx
mov rcx, 0xffffffff80000000
mov r12d, ebp
mov word [rsp + 0x580], 0x66
mov word [rsp + 0x582], 0x6f
mov word [rsp + 0x584], 0x6f
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
je 0x14010f47c
nop
nop
test eax, eax
jne 0x14010f445
cmp word [rsp + 0x586], 0x2e
jne 0x14010f445
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x790]
lea rdx, [rsp + 0x586]
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x34], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x14010f445
cmp word [rsp + 0x790], 0x2e
je 0x14010f445
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x790]
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x38], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x14010f445
cmp word [rsp + 0x80], bp
je 0x14010f445
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x340]
call fcn.140177f70
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x460]
call fcn.140177f70
mov r14, qword [rsp + 0x468]
mov rsi, qword [rsp + 0x348]
mov ecx, 0x38
call fcn.1400cf700
cmp byte [rsi], bpl
mov rdx, rsi
mov rbx, rax
je 0x14010f400
add rdx, 1
cmp byte [rdx], bpl
jne 0x14010f3f7
sub edx, esi
mov rcx, rsi
mov dword [rax + 8], edx
call fcn.14016dc70
mov rcx, r14
mov qword [rbx], rax
call fcn.14016dcc0
test rdi, rdi
mov qword [rbx + 0x10], rbp
mov dword [rbx + 0x18], ebp
mov qword [rbx + 0x20], rax
mov eax, dword [0x14020e268]
mov dword [rbx + 0x28], eax
je 0x14010f437
mov qword [r13 + 0x30], rbx
jmp 0x14010f43a
mov rdi, rbx
mov qword [rbx + 0x30], rbp
mov r13, rbx
add r15d, 1
add r12d, 1
lea r8, [rsp + 0x586]
mov r9d, 0x101
mov edx, r12d
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x14010f310
mov r14, qword [rsp + 0x40]
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x460]
call fcn.1400012c0
lea rcx, [rsp + 0x340]
call fcn.1400012c0
test r15d, r15d
je 0x14010f772
movsxd rcx, r15d
shl rcx, 3
call fcn.1400cf700
test rdi, rdi
mov rsi, rax
mov rcx, rax
je 0x14010f4d0
nop
nop
nop
mov qword [rcx], rdi
mov rdi, qword [rdi + 0x30]
add rcx, 8
test rdi, rdi
jne 0x14010f4c0
lea r8, [0x14010f180]
mov edx, r15d
mov rcx, rax
call fcn.1400e2df0
test r15d, r15d
mov rbx, rbp
jle 0x14010f5d3
mov edi, r15d
test rbx, rbx
je 0x14010f544
mov rax, qword [rsi + rbx*8]
mov r9, qword [rsi + rbx*8 - 8]
mov r10d, dword [r9 + 8]
mov r11d, dword [rax + 8]
mov rcx, qword [rax]
cmp r11d, r10d
mov r8d, r10d
cmovl r8d, r11d
test r8d, r8d
je 0x14010f536
mov r9, qword [r9]
sub r9, rcx
nop
movzx eax, byte [r9 + rcx]
movzx edx, byte [rcx]
sub edx, eax
jne 0x14010f53c
add rcx, 1
sub r8d, 1
jne 0x14010f520
mov edx, r11d
sub edx, r10d
test edx, edx
je 0x14010f5c5
mov rcx, qword [rsi + rbx*8]
lea r8, [rsp + 0x80]
mov r9d, 0x2b8
mov rcx, qword [rcx + 0x20]
mov edx, 0x80
mov dword [rsp + 0x20], 0x4411
call fcn.1400daf40
test rax, rax
je 0x14010f5c5
lea rcx, [rsp + 0x298]
call fcn.140176690
mov rcx, qword [rsi + rbx*8]
mov qword [rcx + 0x10], rax
mov rax, qword [rsi + rbx*8]
mov rdx, qword [rax + 0x10]
mov rcx, rdx
cmp byte [rdx], bpl
je 0x14010f59f
add rcx, 1
cmp byte [rcx], bpl
jne 0x14010f596
sub ecx, edx
mov dword [rax + 0x18], ecx
mov rcx, qword [rsi + rbx*8]
mov eax, dword [rsp + 0x88]
mov dword [rcx + 0x28], eax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14010f5c5
call qword [sym.imp.USER32.dll_DestroyIcon]
add rbx, 1
sub rdi, 1
jne 0x14010f4f1
lea r8, [0x14010f1d0]
mov edx, r15d
mov rcx, rsi
call fcn.1400e2df0
lea rcx, [rsp + 0x80]
call fcn.14017d460
mov rcx, qword [r14 + 0x10]
mov edx, 0x41f
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [rsp + 0x30]
test edi, edi
mov r15, rax
jle 0x14010f719
mov r14, rdi
test rbp, rbp
je 0x14010f6a1
mov rdx, qword [rsi + rbp*8]
mov rcx, qword [rsi + rbp*8 - 8]
lea rbx, [0x1401b0f62]
mov rax, qword [rdx + 0x10]
mov r12d, dword [rcx + 0x18]
mov r13d, dword [rdx + 0x18]
test rax, rax
lea rdi, [0x1401b0f62]
mov r9d, r12d
cmovne rbx, rax
mov rax, qword [rcx + 0x10]
mov edx, r13d
test rax, rax
mov rcx, rbx
cmovne rdi, rax
mov r8, rdi
call fcn.14000dba0
test eax, eax
mov r11d, eax
jne 0x14010f69c
cmp r13d, r12d
mov ecx, r12d
cmovl ecx, r13d
test ecx, ecx
je 0x14010f696
sub rdi, rbx
nop
nop
movzx eax, byte [rdi + rbx]
movzx r11d, byte [rbx]
sub r11d, eax
jne 0x14010f69c
add rbx, 1
sub ecx, 1
jne 0x14010f680
mov r11d, r13d
sub r11d, r12d
test r11d, r11d
je 0x14010f702
mov rdx, qword [rsi + rbp*8]
cmp dword [rdx + 0x18], 0
je 0x14010f702
mov rdx, qword [rdx + 0x10]
lea rcx, [rsp + 0x80]
call fcn.14017d760
mov rcx, qword [rsi + rbp*8]
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x48], 7
mov qword [rsp + 0x50], 0xffffffffffffffff
mov eax, dword [rcx + 0x28]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x64], eax
mov eax, dword [rcx + 0x28]
mov edx, 0x40b
mov rcx, r15
mov dword [rsp + 0x68], eax
call qword [sym.imp.USER32.dll_SendMessageW]
add rbp, 1
sub r14, 1
jne 0x14010f613
mov edi, dword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
lea rcx, [rsp + 0x80]
call fcn.1400012c0
test edi, edi
jle 0x14010f76a
mov rbx, rsi
nop
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14010f741
call fcn.1400cf780
mov rcx, qword [rbx]
mov rcx, qword [rcx + 0x20]
call fcn.1400cf780
mov rcx, qword [rbx]
mov rcx, qword [rcx]
call fcn.1400cf780
mov rcx, qword [rbx]
call fcn.1400cf780
add rbx, 8
sub rdi, 1
jne 0x14010f730
mov rcx, rsi
call fcn.1400cf780
mov dword [r14 + 0x28], 1
mov rcx, qword [rsp + 0x9a0]
xor rcx, rsp
call fcn.1401a8ec0
lea r11, [rsp + 0x9b0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret