Function at 0x14005fa30
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rsp + 0xf0], rbx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rdx
mov rbx, rcx
xor r15d, r15d
mov qword [rdx + 0x10], r15
cmp qword [rdx + 0x18], 8
jb 0x14005fa7b
mov rax, qword [rdx]
jmp 0x14005fa7e
mov rax, rdx
mov word [rax], r15w
cmp rcx, 0xffffffff80000002
jne 0x14005faaf
mov r8d, 0x11
lea rdx, str.REGISTRYMACHINE
mov rcx, rdi
call fcn.140007d00
movabs rax, 0x8000000000
jmp 0x14005fd19
cmp rcx, 0xffffffff80000003
jne 0x14005fac7
mov r8d, 0xe
lea rdx, str.REGISTRYUSER
jmp 0x14005fa98
cmp rcx, 0xffffffff80000001
jne 0x14005fb73
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r15
mov word [rbp - 0x39], r15w
lea rcx, [rbp - 0x39]
call fcn.14005f480
mov rbx, rax
shr rax, 0x27
not eax
test al, 1
jne 0x14005fb50
lea r8, [rbp - 0x39]
lea rdx, str.REGISTRYUSER_
lea rcx, [rbp - 0x19]
call fcn.14000d620
nop
mov rdx, rax
mov rcx, rdi
call fcn.14000c400
nop
cmp qword [rbp - 1], 8
jb 0x14005fb35
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp - 1], 7
mov qword [rbp - 9], r15
mov word [rbp - 0x19], r15w
movabs rbx, 0x8000000000
cmp qword [rbp - 0x21], 8
jb 0x14005fb61
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp - 0x21], 7
mov word [rbp - 0x39], r15w
jmp 0x14005fd12
cmp rcx, 0xffffffff80000000
jne 0x14005fc3b
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r15
mov word [rbp - 0x39], r15w
lea rcx, [rbp - 0x39]
call fcn.14005f480
mov rbx, rax
shr rax, 0x27
not eax
test al, 1
jne 0x14005fc36
lea r8, [rbp - 0x39]
lea rdx, str.REGISTRYUSER_
lea rcx, [rbp + 7]
call fcn.14000d620
nop
lea r8, str._Classes
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.14000d5a0
nop
mov rdx, rax
mov rcx, rdi
call fcn.14000c400
nop
cmp qword [rbp - 1], 8
jb 0x14005fbf9
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp - 1], 7
mov qword [rbp - 9], r15
mov word [rbp - 0x19], r15w
cmp qword [rbp + 0x1f], 8
jb 0x14005fc1b
mov rcx, qword [rbp + 7]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0x1f], 7
mov qword [rbp + 0x17], r15
mov word [rbp + 7], r15w
movabs rbx, 0x8000000000
jmp 0x14005fb50
mov dword [rbp - 0x49], r15d
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 3]
call qword [sym.imp.ntdll.dll_NtQueryKey]
mov esi, eax
cmp eax, 0x80000005
je 0x14005fc83
cmp esi, 0xc0000023
je 0x14005fc83
call fcn.14005f290
or rax, rsi
movabs rcx, 0x172110000000
or rax, rcx
jmp 0x14005fd19
mov eax, dword [rbp - 0x49]
test eax, eax
je 0x14005faa0
mov edx, eax
lea rcx, [rbp - 0x39]
call fcn.1400175e0
nop
mov r9, qword [rbp - 0x31]
mov rsi, qword [rbp - 0x39]
sub r9, rsi
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x20], rcx
mov r8, rsi
mov edx, 3
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtQueryKey]
mov r14d, eax
test eax, eax
je 0x14005fce0
call fcn.14005f290
mov rbx, rax
or rbx, r14
movabs rax, 0x182110000000
or rbx, rax
jmp 0x14005fcfc
mov r8d, dword [rsi]
shr r8, 1
lea rdx, [rsi + 4]
mov rcx, rdi
call fcn.140007d00
movabs rbx, 0x8000000000
test rsi, rsi
je 0x14005fd16
mov rcx, rsi
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], r15
mov rax, rbx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140108d90
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret