Function at 0x14005efc0
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14005efc0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xd58
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x25a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xd78]
mov rax, qword [0x140289140]
xor rax, rbp
mov qword [rbp + 0xd10], rax
mov dword [rbp + 0xcd4], 0
lea rcx, [0x1402ac2b2]
call fcn.140007f72
nop
mov edx, 0x20
mov rcx, qword [rbp + 0xd40]
call fcn.140001906
mov rcx, qword [rbp + 0xd40]
call fcn.140003acb
mov qword [rbp + 0xce8], rax
mov eax, dword [rbp + 0xcd4]
or eax, 1
mov dword [rbp + 0xcd4], eax
lea rax, str.SOFTWAREValveSteam
mov qword [rbp + 0x68], rax
lea rax, str.SteamPath
mov qword [rbp + 0x88], rax
mov dword [rbp + 0xa4], 0x104
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x68]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005f459
lea rax, [rbp + 0xa4]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005f44e
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x2f8]
call fcn.1400034d6
nop
lea rcx, [rbp + 0xaf4]
call fcn.14000290a
mov qword [rbp + 0xce8], rax
lea rax, [rbp + 0xb18]
mov qword [rbp + 0xb48], rax
mov rdx, qword [rbp + 0xb48]
lea rcx, [rbp + 0x2f8]
call fcn.140006523
mov qword [rbp + 0xcf0], rax
mov rax, qword [rbp + 0xcf0]
mov qword [rbp + 0xcf8], rax
lea rax, [rbp + 0xb68]
mov qword [rbp + 0xb98], rax
mov rdx, qword [rbp + 0xb98]
lea rcx, [rbp + 0x2f8]
call fcn.1400044a3
mov qword [rbp + 0xd00], rax
mov rax, qword [rbp + 0xd00]
mov qword [rbp + 0xd08], rax
mov r9, qword [rbp + 0xce8]
mov r8, qword [rbp + 0xcf8]
mov rdx, qword [rbp + 0xd08]
lea rcx, [rbp + 0x338]
call fcn.14000475a
nop
xor r8d, r8d
lea rdx, [rbp + 0x338]
lea rcx, [rbp + 0xbd8]
call fcn.140006771
nop
lea rcx, [rbp + 0xbd8]
call fcn.14000187f
mov byte [rbp + 0xbb4], al
lea rcx, [rbp + 0xbd8]
call fcn.140007518
movzx eax, byte [rbp + 0xbb4]
test eax, eax
je 0x14005f434
lea r8, str.configloginusers.vdf
lea rdx, [rbp + 0x338]
lea rcx, [rbp + 0x378]
call fcn.1400066a4
nop
xor r8d, r8d
lea rdx, [rbp + 0x378]
lea rcx, [rbp + 0xc38]
call fcn.140006771
nop
lea rcx, [rbp + 0xc38]
call fcn.140004192
mov byte [rbp + 0xc14], al
lea rcx, [rbp + 0xc38]
call fcn.140007518
movzx eax, byte [rbp + 0xc14]
test eax, eax
je 0x14005f427
mov edx, 0x110
lea rcx, [rbp + 0x3c0]
call fcn.140005a6a
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, [rbp + 0x378]
lea rcx, [rbp + 0x3c0]
call fcn.140006447
nop
lea rcx, [rbp + 0x3c0]
call fcn.14000130c
movzx eax, al
test eax, eax
je 0x14005f41a
lea rcx, [rbp + 0x4e8]
call fcn.140007ee6
nop
mov edx, 0x58
lea rcx, [rbp + 0x530]
call fcn.140006ece
mov r8d, 1
lea rdx, str.__d17__
lea rcx, [rbp + 0x530]
call fcn.140004845
nop
mov edx, 0x58
lea rcx, [rbp + 0x5b0]
call fcn.140006ece
mov r8d, 1
lea rdx, str._MostRecent____t___d__
lea rcx, [rbp + 0x5b0]
call fcn.140004845
nop
lea rdx, [rbp + 0x4e8]
lea rcx, [rbp + 0x3c0]
call fcn.140004d36
mov qword [rbp + 0xc78], rax
mov rax, qword [rbp + 0xc78]
mov rax, qword [rax]
movsxd rax, dword [rax + 4]
mov rcx, qword [rbp + 0xc78]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140004039
movzx eax, al
test eax, eax
je 0x14005f3e6
mov edx, 0xe8
lea rcx, [rbp + 0x630]
call fcn.140005e6b
lea rcx, [rbp + 0x630]
call fcn.1400041ce
nop
xor r9d, r9d
lea r8, [rbp + 0x530]
lea rdx, [rbp + 0x630]
lea rcx, [rbp + 0x4e8]
call fcn.140002423
movzx eax, al
test eax, eax
je 0x14005f3d4
lea rcx, [rbp + 0x630]
call fcn.140008792
cmp rax, 2
jne 0x14005f3d4
mov edx, 1
lea rcx, [rbp + 0x630]
call fcn.14000624e
mov qword [rbp + 0xce8], rax
lea rdx, [rbp + 0xc98]
mov rcx, qword [rbp + 0xce8]
call fcn.14000189d
mov qword [rbp + 0xcf0], rax
mov rax, qword [rbp + 0xcf0]
mov qword [rbp + 0xcf8], rax
mov rdx, qword [rbp + 0xcf8]
mov rcx, qword [rbp + 0xd40]
call fcn.140003657
nop
lea rcx, [rbp + 0xc98]
call fcn.140002414
nop
lea rcx, [rbp + 0x630]
call fcn.140001ba4
nop
jmp 0x14005f2d7
lea rcx, [rbp + 0x3c0]
call fcn.140004d1d
nop
lea rcx, [rbp + 0x5b0]
call fcn.1400030ad
nop
lea rcx, [rbp + 0x530]
call fcn.1400030ad
nop
lea rcx, [rbp + 0x4e8]
call fcn.140002414
nop
lea rcx, [rbp + 0x3c0]
call fcn.1400020db
nop
lea rcx, [rbp + 0x378]
call fcn.140002414
nop
lea rcx, [rbp + 0x338]
call fcn.140002414
nop
lea rcx, [rbp + 0x2f8]
call fcn.140006e79
nop
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rbp + 0xd40]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140224d40]
call fcn.140006b90
mov rax, rdi
mov rcx, qword [rbp + 0xd10]
xor rcx, rbp
call fcn.1400044d0
lea rsp, [rbp + 0xd28]
pop rdi
pop rbp
ret