Function at 0x14001004c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor r12d, r12d
mov sil, dl
mov rbx, rcx
test rcx, rcx
je 0x140010278
test dl, dl
je 0x14001008a
cmp dword [0x1401d301c], r12d
mov eax, r12d
sete al
jmp 0x1400100b8
test byte [rcx + 0x18], 0x10
jne 0x1400100b5
mov eax, dword [0x1401d3350]
test eax, eax
je 0x1400100a2
cmp eax, 2
sete al
jmp 0x1400100ac
cmp byte [0x1401d33a0], r12b
setne al
test al, al
mov eax, 1
jne 0x1400100b8
mov eax, r12d
test eax, eax
jne 0x140010278
lea rcx, [0x1401d1ff8]
mov dword [rbp + 0x30], r12d
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, 1
lock xadd dword [rbp - 0x28], eax
test eax, eax
jne 0x1400100fa
cmp dword [rbp - 0x24], r12d
jne 0x140010293
call qword [sym.imp.MSVCP140.dll__Thrd_id]
mov dword [rbp - 0x24], eax
mov eax, dword [rbp + 0x30]
mov edi, r12d
cmp edi, 4
jge 0x140010266
mov eax, dword [rbx + 0x1c]
lea rcx, [rbp - 0x20]
mov rdx, qword [rbx + 0x10]
mov r14b, r12b
movzx r15d, sil
mov r9d, r15d
mov qword [rbp + 0x40], r12
shl r9d, 5
mov dword [rsp + 0x20], eax
call fcn.14000e2fc
mov rcx, rax
mov eax, dword [rax]
mov dword [rbp + 0x30], eax
mov rax, qword [rcx + 8]
mov qword [rcx + 8], r12
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0x40], rax
test rcx, rcx
je 0x140010159
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400ee2b6.0]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140010173
mov qword [rbp - 0x18], r12
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400ee2b6.0]
mov eax, dword [rbp + 0x30]
test eax, eax
je 0x1400101e2
test sil, sil
je 0x1400101de
mov eax, dword [rbx + 0x1c]
lea r9d, [r15 + r15]
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x20], eax
call fcn.14000e2fc
mov rcx, rax
mov eax, dword [rax]
mov dword [rbp + 0x30], eax
mov rax, qword [rcx + 8]
mov qword [rcx + 8], r12
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0x40], rax
test rcx, rcx
je 0x1400101c1
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400ee2b6.0]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400101db
mov qword [rbp - 8], r12
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400ee2b6.0]
mov eax, dword [rbp + 0x30]
test eax, eax
jne 0x14001023e
mov rax, qword [rbp + 0x40]
xor r9d, r9d
mov rdx, qword [rbx]
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov rcx, qword [rax + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 0x30], eax
cmp eax, 0x3f2
je 0x140010219
cmp eax, 0x3fa
je 0x140010219
cmp eax, 6
jne 0x14001023e
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1401cd7f0]
movzx eax, word [rcx + 0xa]
and eax, 0x1f
shl rax, 5
mov qword [rax + rdx], r12
call fcn.14000b808
mov eax, dword [rbp + 0x30]
mov r14b, 1
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14001025b
mov qword [rbp + 0x40], r12
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400ee2b6.0]
mov eax, dword [rbp + 0x30]
inc edi
test r14b, r14b
jne 0x140010100
test eax, eax
lea rcx, [rbp - 0x30]
sete bl
call fcn.14000ba40
mov al, bl
jmp 0x14001027a
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor edx, edx
mov ecx, 0x131f4c4
call fcn.14000ad28
int3