Function at 0x140005a18
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r13, r9
mov r12, r8
mov rdi, rdx
xor r14d, r14d
mov qword [rax - 0x30], r14
mov qword [rax - 0x28], r14
mov qword [rax - 0x20], r14
mov qword [rax - 0x50], r14
mov qword [rax - 0x58], r14
mov dword [rax - 0x60], 0x2001f
mov dword [rax - 0x68], r14d
xor r9d, r9d
lea r8, str.UserSettings
mov rdx, rcx
lea rcx, [rax - 0x30]
call fcn.1400039c8
cmp eax, r14d
jne 0x14001a326
mov ebp, 0x80070000
mov r15d, 4
mov rbx, qword [rsp + 0x58]
cmp rdi, r14
jne 0x14000fad9
or rdi, 0xffffffffffffffff
cmp r12, r14
jne 0x14000fb3c
cmp r13, r14
jne 0x140006066
mov rax, qword [rsp + 0xb0]
cmp rax, r14
je 0x140005b0c
mov dword [rsp + 0x48], r15d
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.WatchOrder
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x140005b03
mov eax, dword [rsp + 0x44]
sub eax, r15d
neg eax
sbb eax, eax
and eax, 0xd
cmp eax, r14d
jne 0x14001a4e6
mov rax, qword [rsp + 0xb8]
cmp rax, r14
je 0x140005b61
mov dword [rsp + 0x48], r15d
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.RecordOrder
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x140005b58
mov eax, dword [rsp + 0x44]
sub eax, r15d
neg eax
sbb eax, eax
and eax, 0xd
cmp eax, r14d
jne 0x14001a50b
mov rdi, qword [rsp + 0xc0]
cmp rdi, r14
je 0x140005bcc
mov dword [rsp + 0x44], r14d
mov dword [rsp + 0x48], r15d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.WatchPrefered
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x140005bb7
mov eax, dword [rsp + 0x40]
sub eax, r15d
neg eax
sbb eax, eax
and eax, 0xd
cmp eax, r14d
jne 0x14001a530
mov eax, dword [rsp + 0x44]
neg eax
sbb cx, cx
mov word [rdi], cx
mov rdi, qword [rsp + 0xc8]
cmp rdi, r14
je 0x140005c37
mov dword [rsp + 0x44], r14d
mov dword [rsp + 0x48], r15d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.RecordPrefered
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x140005c22
mov eax, dword [rsp + 0x40]
sub eax, r15d
neg eax
sbb eax, eax
and eax, 0xd
cmp eax, r14d
jne 0x14001a554
mov eax, dword [rsp + 0x44]
neg eax
sbb cx, cx
mov word [rdi], cx
mov rdi, qword [rsp + 0xd0]
cmp rdi, r14
je 0x140005ca2
mov dword [rsp + 0x44], r14d
mov dword [rsp + 0x48], r15d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.EnabledForMCE
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x140005c8d
mov eax, dword [rsp + 0x40]
sub eax, r15d
neg eax
sbb eax, eax
and eax, 0xd
cmp eax, r14d
jne 0x14001a578
mov eax, dword [rsp + 0x44]
neg eax
sbb cx, cx
mov word [rdi], cx
cmp rbx, r14
je 0x140005cb0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov dword [rsp + 0x40], r14d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.UserDefName
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x140005ab7
cmp dword [rsp + 0x44], 1
jne 0x14001a46e
mov eax, dword [rsp + 0x40]
shr eax, 1
mov dword [rsp + 0x48], eax
je 0x140005ab7
mov ecx, eax
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1400025a0
mov rdi, rax
cmp rax, r14
je 0x14001a47e
mov word [rax], r14w
lea r9, [rsp + 0x48]
mov r8, rax
lea rdx, str.UserDefName
lea rcx, [rsp + 0x58]
call fcn.140005980
cmp eax, r14d
jne 0x14001a4b9
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r13], rax
mov rcx, rdi
call sub.msvcrt.dll_free
nop
jmp 0x140005ab7
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x44], r15d
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.UseSTB
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x14000fb22
mov eax, dword [rsp + 0x48]
sub eax, r15d
neg eax
sbb eax, eax
and eax, 0xd
cmp eax, r14d
jne 0x14001a360
mov eax, dword [rsp + 0x40]
neg eax
sbb cx, cx
mov word [rdi], cx
jmp 0x140005aa1
mov dword [rsp + 0x44], r14d
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.STBCode
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x140005aae
jmp 0x14001a38d
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
mov r8d, ebx
lea rdx, str.CRecorder::GetRecorderConfigInternalStatic:_Cannot_open_USERSETTINGS_for_RW_0x_x
lea ecx, [r14 + 1]
call fcn.140001110
nop
mov rcx, qword [rsp + 0x58]
cmp rcx, r14
je 0x14001a359
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140005cb2
cmp eax, 2
je 0x14000fb2b
movzx r8d, ax
or r8d, ebp
cmp eax, r14d
cmovle r8d, eax
lea rdx, str.CRecorder::GetRecorderConfigInternalStatic:_Cannot_RegQueryValueEx_USE_STB__0x_x
mov ecx, 8
call fcn.140001110
jmp 0x140005aa1
cmp dword [rsp + 0x40], 1
je 0x14001a39f
cmp dword [rsp + 0x40], 2
jne 0x140005aae
mov eax, dword [rsp + 0x44]
shr eax, 1
mov dword [rsp + 0x48], eax
je 0x140005aae
mov ecx, eax
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1400025a0
mov rdi, rax
cmp rax, r14
jne 0x14001a408
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r8d, ax
or r8d, ebp
cmp eax, r14d
cmovle r8d, eax
lea rdx, str.CRecorder::GetRecorderConfigInternalStatic:_Cannot_allocate_memory_blob__0x_x
mov ecx, 1
call fcn.140001110
nop
cmp rbx, r14
je 0x14001a401
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x140005cb2
mov word [rax], r14w
lea r9, [rsp + 0x48]
mov r8, rax
lea rdx, str.STBCode
lea rcx, [rsp + 0x58]
call fcn.140005980
cmp eax, r14d
je 0x14001a450
cmp eax, 2
je 0x14001a450
movzx r8d, ax
or r8d, ebp
cmp eax, r14d
cmovle r8d, eax
lea rdx, str.CRecorder::GetRecorderConfigInternalStatic:_Cannot_RegQueryValueEx_STBCODE__0x_x
mov ecx, 8
call fcn.140001110
jmp 0x14001a45d
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r12], rax
mov rcx, rdi
call sub.msvcrt.dll_free
or rdi, 0xffffffffffffffff
jmp 0x140005aae
cmp dword [rsp + 0x44], 2
je 0x1400060a6
jmp 0x140005ab7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r8d, ax
or r8d, ebp
cmp eax, r14d
cmovle r8d, eax
lea rdx, str.CRecorder::GetRecorderConfigInternalStatic:_Cannot_allocate_memory_wzName__0x_x
mov ecx, 1
call fcn.140001110
nop
cmp rbx, r14
je 0x14001a4b2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x140005cb2
cmp eax, 2
je 0x1400060fe
movzx r8d, ax
or r8d, ebp
cmp eax, r14d
cmovle r8d, eax
lea rdx, str.CRecorder::GetRecorderConfigInternalStatic:_Cannot_RegQueryValueEx_USER_DEF_NAME__0x_x
mov ecx, 8
call fcn.140001110
jmp 0x14000610b
movzx r8d, ax
or r8d, ebp
cmp eax, r14d
cmovle r8d, eax
lea rdx, str.CRecorder::GetRecorderConfigInternalStatic:_Cannot_QueryValue_WATCH_ORDER_0x_x
mov ecx, 8
call fcn.140001110
nop
jmp 0x140005b0c
movzx r8d, ax
or r8d, ebp
cmp eax, r14d
cmovle r8d, eax
lea rdx, str.CRecorder::GetRecorderConfigInternalStatic:_Cannot_QueryValue_RECORD_ORDER_0x_x
mov ecx, 8
call fcn.140001110
nop
jmp 0x140005b61
movzx r8d, ax
or r8d, ebp
cmp eax, r14d
cmovle r8d, eax
lea rdx, str.CRecorder::GetRecorderConfigInternalStatic:_Cannot_QueryValue_WATCH_PREF_0x_x
mov ecx, 8
call fcn.140001110
jmp 0x140005bcc
movzx r8d, ax
or r8d, ebp
cmp eax, r14d
cmovle r8d, eax
lea rdx, str.CRecorder::GetRecorderConfigInternalStatic:_Cannot_QueryValue_RECORD_PREF_0x_x
mov ecx, 8
call fcn.140001110
jmp 0x140005c37
movzx r8d, ax
or r8d, ebp
cmp eax, r14d
cmovle r8d, eax
lea rdx, str.CRecorder::GetRecorderConfigInternalStatic:_Cannot_QueryValue_MCE_ENABLE_0x_x
mov ecx, 8
call fcn.140001110
jmp 0x140005ca2