Function at 0x14000b1e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov qword [rbp - 0x20], 0xfffffffffffffffe
xor r15d, r15d
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x70], r15
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x78]
call fcn.140008520
xor r14b, r14b
lea rcx, [rsp + 0x30]
call fcn.140006930
lea rcx, [rsp + 0x30]
call fcn.140006c00
mov qword [rax], 7
lea rcx, [rsp + 0x30]
call fcn.140006920
mov word [rbp + 0x68], r15w
mov qword [rax + 0x10], r15
cmp qword [rax + 0x18], 8
jb 0x14000b25b
mov rax, qword [rax]
lea rdx, [rbp + 0x68]
mov rcx, rax
call fcn.1400044f0
nop
or rsi, 0xffffffffffffffff
mov rdi, qword [rbp + 0x70]
test rdi, rdi
je 0x14000b30d
xor edx, edx
mov r8d, 0x80
lea rcx, [rsp + 0x60]
call fcn.1401d5b10
mov dword [rbp + 0x68], 0x80
mov dword [rbp + 0x60], r15d
lea rax, [rbp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x60]
xor r8d, r8d
lea rdx, str.LoggingType
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b30d
lea edx, [rsi + 0x41]
lea rcx, [rsp + 0x60]
call fcn.1401dba14
cmp word [rsp + 0x60], 0
jne 0x14000b2de
mov r8, r15
jmp 0x14000b2fb
lea rax, [rsp + 0x60]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000b2f0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.1400069c0
mov r14b, 1
mov rbx, qword [rbp + 0x78]
test rbx, rbx
je 0x14000b3af
test r14b, r14b
jne 0x14000b3af
xor edx, edx
mov r8d, 0x80
lea rcx, [rsp + 0x60]
call fcn.1401d5b10
mov dword [rbp + 0x68], 0x80
mov dword [rbp + 0x60], r15d
lea rax, [rbp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x60]
xor r8d, r8d
lea rdx, str.LoggingType
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b3af
lea edx, [rax + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1401dba14
cmp word [rsp + 0x60], 0
jne 0x14000b388
mov rsi, r15
jmp 0x14000b39a
lea rax, [rsp + 0x60]
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14000b390
mov r8, rsi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.1400069c0
mov r14b, 1
mov esi, 1
test r14b, r14b
je 0x14000b475
lea rcx, [rsp + 0x30]
call fcn.140006d50
cmp qword [rax], 0
je 0x14000b475
lea r9d, [rsi + 4]
xor r8d, r8d
lea rdx, str.EVENT
lea rcx, [rsp + 0x30]
call fcn.14000c810
mov esi, r15d
cmp rax, 0xffffffffffffffff
setne sil
mov r9d, 4
xor r8d, r8d
lea rdx, str.FILE
lea rcx, [rsp + 0x30]
call fcn.14000c810
mov r14d, esi
or r14d, 8
cmp rax, 0xffffffffffffffff
cmove r14d, esi
mov r9d, 7
xor r8d, r8d
lea rdx, str.CONSOLE
lea rcx, [rsp + 0x30]
call fcn.14000c810
mov esi, r14d
or esi, 0x10
cmp rax, 0xffffffffffffffff
cmove esi, r14d
mov r9d, 5
xor r8d, r8d
lea rdx, str.DEBUG
lea rcx, [rsp + 0x30]
call fcn.14000c810
mov ecx, esi
or ecx, 2
cmp rax, 0xffffffffffffffff
cmove ecx, esi
mov esi, 1
test ecx, ecx
cmovne esi, ecx
mov r14d, r15d
xor edx, edx
lea r8d, [rdx + 0x50]
lea rcx, [rsp + 0x60]
call fcn.1401d5b10
test esi, esi
je 0x14000b5ce
lea r13, vtable.HP::Shared::ChpLogListenerDebug.0
lea rdi, vtable.HP::Shared::ChpLogListenerConsole.0
nop
test sil, 1
je 0x14000b4d7
and esi, 0xfffffffe
mov ecx, 0x20
call fcn.1400103f8
mov qword [rbp - 0x18], rax
test rax, rax
je 0x14000b4c9
mov rcx, rax
call fcn.14000aff0
mov rcx, rax
jmp 0x14000b4cc
mov rcx, r15
movsxd rax, r14d
mov qword [rsp + rax*8 + 0x60], rcx
inc r14d
test sil, 8
je 0x14000b510
and esi, 0xfffffff7
mov ecx, 0x250
call fcn.1400103f8
mov qword [rbp - 0x10], rax
test rax, rax
je 0x14000b502
xor edx, edx
mov rcx, rax
call fcn.1400095e0
mov rcx, rax
jmp 0x14000b505
mov rcx, r15
movsxd rax, r14d
mov qword [rsp + rax*8 + 0x60], rcx
inc r14d
test sil, 4
je 0x14000b549
and esi, 0xfffffffb
mov ecx, 0x250
call fcn.1400103f8
mov qword [rbp - 8], rax
test rax, rax
je 0x14000b53b
mov dl, 1
mov rcx, rax
call fcn.1400095e0
mov rcx, rax
jmp 0x14000b53e
mov rcx, r15
movsxd rax, r14d
mov qword [rsp + rax*8 + 0x60], rcx
inc r14d
test sil, 2
je 0x14000b585
and esi, 0xfffffffd
mov ecx, 0x18
call fcn.1400103f8
mov r12, rax
mov qword [rbp], rax
test rax, rax
je 0x14000b577
mov rcx, rax
call fcn.140008ca0
nop
mov qword [r12], r13
jmp 0x14000b57a
mov r12, r15
movsxd rax, r14d
mov qword [rsp + rax*8 + 0x60], r12
inc r14d
test sil, 0x10
je 0x14000b5c2
and esi, 0xffffffef
mov ecx, 0x18
call fcn.1400103f8
mov r12, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000b5b4
mov rcx, rax
call fcn.140008ca0
nop
mov qword [r12], rdi
jmp 0x14000b5b7
mov r12, r15
movsxd rax, r14d
mov qword [rsp + rax*8 + 0x60], r12
inc r14d
test esi, esi
jne 0x14000b4a0
mov rdi, qword [rbp + 0x70]
mov ecx, 0xb0
call fcn.1400103f8
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000b5f5
mov r8d, r14d
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.14000b640
mov r15, rax
lea rcx, [rsp + 0x30]
call fcn.140006560
nop
test rdi, rdi
je 0x14000b60f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test rbx, rbx
je 0x14000b61d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, r15
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret