Function at 0x10005f04c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x5b0
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x5a0], rax
xor r12d, r12d
lea rax, [rsp + 0x68]
mov rbp, rcx
lea rdx, [0x100024a90]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
mov edi, r12d
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x60], r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, r12d
jne 0x10005f1aa
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [0x100029938]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, r12d
jne 0x10005f1aa
mov dword [rsp + 0x40], 0x80
mov esi, r12d
mov qword [rsp + 0x48], r12
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x80]
mov edx, esi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
cmp eax, r12d
jne 0x10005f19f
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x80]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x80
inc esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, r12d
jne 0x10005f19f
mov rdx, qword [rsp + 0x48]
mov rcx, rbp
call fcn.10005ea04
cmp eax, r12d
jge 0x10005f18f
lea r8, [rsp + 0x80]
lea rdx, [0x10002c308]
mov ecx, 4
call fcn.1000527f4
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10005f0f8
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
cmp rcx, r12
je 0x10005f1ba
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, r12d
je 0x10005f1d6
cmp ebx, 0x103
je 0x10005f1d6
movzx edi, bx
or edi, 0x80070000
cmp ebx, r12d
cmovle edi, ebx
cmp dword [rbp + 0x28], 3
jne 0x10005f39d
lea rax, [0x10002c338]
lea r9, [0x100024a90]
lea r8, [0x100025e98]
lea rcx, [rsp + 0x390]
mov edx, 0x105
mov qword [rsp + 0x20], rax
call fcn.10003a080
cmp eax, r12d
jl 0x10005f3bd
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x390]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x10005f3bd
mov dword [rsp + 0x40], 0x80
mov esi, r12d
mov qword [rsp + 0x58], r12
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x80]
mov edx, esi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
cmp eax, r12d
jne 0x10005f392
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
lea rdx, [rsp + 0x80]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x80
inc esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, r12d
jne 0x10005f392
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x180]
lea rdx, [0x100024ee0]
xor r8d, r8d
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x70], 0x20a
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x10005f382
cmp dword [rsp + 0x50], 1
jne 0x10005f382
lea rax, [rsp + 0x180]
cmp rax, r12
je 0x10005f357
mov rbx, qword [rbp + 8]
jmp 0x10005f352
mov rdx, qword [rbx]
cmp rdx, r12
je 0x10005f34e
mov rdx, qword [rdx + 0x30]
lea rcx, [rsp + 0x180]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r12d
je 0x10005f382
mov rbx, qword [rbx + 8]
cmp rbx, r12
jne 0x10005f32f
mov rdx, qword [rsp + 0x58]
mov rcx, rbp
call fcn.10005ea04
cmp eax, r12d
jge 0x10005f382
lea r8, [rsp + 0x80]
lea rdx, [0x10002c358]
mov ecx, 4
call fcn.1000527f4
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10005f25b
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, r12d
je 0x10005f3bd
cmp ebx, 0x103
je 0x10005f3bd
movzx eax, bx
or eax, 0x80070000
cmp ebx, r12d
cmovle eax, ebx
cmp eax, r12d
jl 0x10005f3c0
mov eax, r12d
cmp edi, r12d
jge 0x10005f3c7
mov eax, edi
mov rcx, qword [rsp + 0x5a0]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret