Function at 0x14005d39c
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [rsp + 0xc0], 0xfffffffffffffffe
movabs rax, 0xffffe7a3dd31c000
add rax, rcx
mov qword [rsp + 0xa0], rax
xor edi, edi
mov r15, rdi
mov r13, rdi
mov qword [r11 - 0x80], rdi
mov r14, rdi
mov qword [r11 - 0x78], rdi
mov qword [r11 - 0x70], rdi
mov dword [rsp + 0x68], edi
lea rbx, str.P5_n_
mov rcx, qword [str.P5_n_]
cmp rcx, rbx
je 0x14005d421
test byte [rcx + 0x1c], 4
je 0x14005d421
cmp byte [rcx + 0x19], 5
jb 0x14005d421
mov edx, 0xa3
lea r8, [0x140008ef8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ffa8
mov r9d, 0x20019
xor r8d, r8d
lea r12, [0x14000adf0]
mov rdx, r12
mov rcx, 0xffffffff80000002
call fcn.14007ac98
mov rsi, rax
mov qword [rsp + 0xa8], rax
cmp rax, rdi
jne 0x14005d495
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [str.P5_n_]
cmp rcx, rbx
je 0x14005d48e
test byte [rcx + 0x1c], 4
je 0x14005d48e
cmp byte [rcx + 0x19], 3
jb 0x14005d48e
mov edx, 0xa4
mov qword [rsp + 0x20], r12
mov r9d, eax
lea r8, [0x140008ef8]
mov rcx, qword [rcx + 0x10]
call fcn.140058098
nop
mov eax, edi
jmp 0x14005d82c
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x110]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r12d, eax
mov dword [rsp + 0x128], eax
cmp eax, edi
je 0x14005d536
mov rcx, qword [str.P5_n_]
cmp rcx, rbx
je 0x14005d805
test byte [rcx + 0x1c], 4
je 0x14005d805
cmp byte [rcx + 0x19], 2
jb 0x14005d805
mov edx, 0xa5
lea rax, [0x14000adf0]
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea r8, [0x140008ef8]
mov rcx, qword [rcx + 0x10]
call fcn.140058098
jmp 0x14005d805
mov eax, dword [rsp + 0x110]
inc eax
mov dword [rsp + 0x110], eax
mov ecx, eax
add rcx, rcx
mov eax, 0xffffffff
cmp rcx, rax
jbe 0x14005d560
mov r12d, 0x216
jmp 0x14005d805
mov ecx, ecx
call fcn.140076a54
mov r15, rax
mov qword [rsp + 0x78], rax
cmp rax, rdi
jne 0x14005d5ac
mov rcx, qword [str.P5_n_]
cmp rcx, rbx
je 0x14005d5a1
test byte [rcx + 0x1c], 4
je 0x14005d5a1
cmp byte [rcx + 0x19], 2
jb 0x14005d5a1
mov edx, 0xa6
lea r8, [0x140008ef8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ffa8
mov r12d, 8
jmp 0x14005d805
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x120], eax
mov eax, edi
mov edx, eax
inc eax
mov dword [rsp + 0x6c], eax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x120]
mov r8, r15
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, edi
jne 0x14005d7b4
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r15
mov rcx, rsi
call fcn.14007ac98
mov qword [rsp + 0x70], rax
cmp rax, rdi
jne 0x14005d653
mov rcx, qword [str.P5_n_]
cmp rcx, rbx
je 0x14005d79d
test byte [rcx + 0x1c], 4
je 0x14005d79d
cmp byte [rcx + 0x19], 3
jb 0x14005d79d
mov edx, 0xa7
mov r9, r15
lea r8, [0x140008ef8]
mov rcx, qword [rcx + 0x10]
call fcn.14001011c
jmp 0x14005d79d
lea r8, [rsp + 0x60]
lea rdx, [0x14000ae40]
mov rcx, rax
call fcn.14007b0b4
mov qword [rsp + 0x60], rax
cmp rax, rdi
je 0x14005d682
mov rcx, qword [rsp + 0xa0]
cmp qword [rax], rcx
jae 0x14005d78a
lea r8, [rsp + 0x118]
lea rdx, [0x14000ae60]
mov rcx, r15
call qword [sym.imp.msvcrt.dll_swscanf]
mov r8d, 1
cmp eax, r8d
jne 0x14005d743
cmp r13, rdi
je 0x14005d6f8
mov rcx, r14
sub rcx, r13
sar rcx, 2
mov rax, qword [rsp + 0x98]
sub rax, r13
sar rax, 2
cmp rcx, rax
jae 0x14005d6f8
lea rdx, [r14 + 4]
mov rcx, r8
cmp rcx, rdi
jbe 0x14005d6eb
mov eax, dword [rsp + 0x118]
mov dword [r14], eax
sub rcx, r8
add r14, 4
jmp 0x14005d6d3
mov r14, rdx
mov qword [rsp + 0x90], rdx
jmp 0x14005d720
lea r9, [rsp + 0x118]
mov rdx, r14
lea rcx, [rsp + 0x80]
call fcn.14005dbac
mov r14, qword [rsp + 0x90]
mov r13, qword [rsp + 0x88]
mov rax, qword [rsp + 0x60]
jmp 0x14005d78a
mov rcx, qword [str.P5_n_]
cmp rcx, rbx
je 0x14005d777
test byte [rcx + 0x1c], 4
je 0x14005d785
cmp byte [rcx + 0x19], 3
jb 0x14005d77e
mov edx, 0xa9
lea r8, [0x140008ef8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ffa8
mov rax, qword [rsp + 0x60]
jmp 0x14005d78a
mov rax, qword [rsp + 0x60]
jmp 0x14005d78a
mov rax, qword [rsp + 0x60]
jmp 0x14005d78a
mov rax, qword [rsp + 0x60]
mov rcx, rax
call fcn.140076afc
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x120], eax
mov eax, dword [rsp + 0x6c]
jmp 0x14005d5bc
cmp r13, rdi
je 0x14005d7ec
mov rsi, r14
sub rsi, r13
sar rsi, 2
cmp rsi, rdi
je 0x14005d7ec
lea rbx, [r14 - 4]
mov ecx, dword [rbx]
mov dword [rsp + 0x118], ecx
call fcn.14007bbb0
cmp rsi, rdi
je 0x14005d7b4
mov r14, rbx
mov qword [rsp + 0x90], rbx
jmp 0x14005d7b4
jmp 0x14005d805
mov rcx, r15
call fcn.140076afc
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp r13, rdi
je 0x14005d829
mov rcx, r13
call fcn.14008c058
mov eax, r12d
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret