Function at 0x14001fd84
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x770]
sub rsp, 0x870
mov rax, qword [0x14004ba88]
xor rax, rsp
mov qword [rbp + 0x760], rax
and qword [rsp + 0x38], 0
mov rdi, rcx
mov edx, dword [rcx]
sub edx, 1
je 0x14001fe0d
sub edx, 1
je 0x14001fe04
sub edx, 1
je 0x14001fdfb
sub edx, 1
je 0x14001fdf2
cmp edx, 1
je 0x14001fde9
mov ebx, 0x80070057
mov edx, 0x6b9
jmp 0x14001ff3a
mov rcx, 0xffffffff80000003
jmp 0x14001fe14
mov rcx, 0xffffffff80000002
jmp 0x14001fe14
mov rcx, 0xffffffff80000001
jmp 0x14001fe14
mov rcx, 0xffffffff80000005
jmp 0x14001fe14
mov rcx, 0xffffffff80000000
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x40], rax
lea rdx, [rdi + 4]
lea rax, [rsp + 0x48]
mov byte [rsp + 0x50], 1
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
nop dword [rax + rax]
cmp byte [rsp + 0x50], 0
mov r14d, eax
je 0x14001fe96
mov rsi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov r15, qword [rsi]
test r15, r15
je 0x14001fe93
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, r15
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov qword [rsi], r12
test r14d, r14d
je 0x14001fea5
mov r9d, r14d
mov edx, 0x6c7
jmp 0x14001fefd
mov esi, 0x800
lea rcx, [rsp + 0x60]
mov r8d, esi
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + 0x104]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], esi
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
nop dword [rax + rax]
test eax, eax
je 0x14001ff17
mov r9d, eax
mov edx, 0x6d3
mov rcx, qword [rbp + 0x798]
lea r8, str.onecore_amcoreoctagon_broker_sourcelib_assists.cpp
call fcn.140018acc
mov ebx, eax
jmp 0x14001ffa3
mov eax, dword [rsp + 0x34]
mov dword [rdi + 0x204], eax
sub eax, 1
je 0x14001ff66
sub eax, 3
je 0x14001ff59
cmp eax, 7
je 0x14001ff52
mov ebx, 0x80004005
mov edx, 0x6e5
mov rcx, qword [rbp + 0x798]
lea r8, str.onecore_amcoreoctagon_broker_sourcelib_assists.cpp
mov r9d, ebx
call fcn.140005160
jmp 0x14001ffa3
mov rax, qword [rsp + 0x60]
jmp 0x14001ff5d
mov eax, dword [rsp + 0x60]
mov qword [rdi + 0x208], rax
jmp 0x14001ffa1
mov eax, dword [rsp + 0x30]
lea rdx, [rsp + 0x60]
cmp eax, esi
mov ecx, 0x7ff
cmova eax, ecx
lea rcx, [rdi + 0x210]
mov r8d, eax
mov ebx, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
sub rsi, rbx
lea rcx, [rdi + 0x210]
add rcx, rbx
mov r8, rsi
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001ffb9
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.1400341a0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret