Function at 0x14001b558
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x140110980]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rbp + 0xf], rcx
xor r14d, r14d
mov dword [rbp - 0x19], r14d
lea rcx, str.AgentService.Util::GetNameOfMockShellProgram:_Entry
call fcn.140004514
mov dword [rbp + 0x17], r14d
lea r12d, [r14 + 7]
mov qword [rdi + 0x18], r12
mov qword [rdi + 0x10], r14
mov word [rdi], r14w
xor r8d, r8d
lea rdx, [0x1400db6f0]
mov rcx, rdi
call fcn.1400063d0
mov dword [rbp - 0x19], 1
lea rax, [rbp + 0x17]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 2]
lea r8, str.MockShell
lea rdx, str.SoftwareMicrosoftUE_V_test
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x14001b629
cmp eax, 2
jne 0x14001b616
lea rcx, str.AgentService.Util::GetNameOfMockShellProgram:_No_mock_shell_program_has_been_defined
call fcn.140004514
jmp 0x14001b735
mov edx, eax
lea rcx, str.AgentService.Util::GetNameOfMockShellProgram:_::RegGetValueW____1__returned_system_error_code_0x_lX
call fcn.1400199a4
jmp 0x14001b735
mov ecx, dword [rbp + 0x17]
add ecx, 2
call fcn.1400a40f0
mov rbx, rax
mov qword [rbp + 0x1f], rax
lea rax, [rbp + 0x17]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r9d, 2
lea r8, str.MockShell
lea rdx, str.SoftwareMicrosoftUE_V_test
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x14001b688
mov edx, eax
lea rcx, str.AgentService.Util::GetNameOfMockShellProgram:_::RegGetValueW____2__returned_system_error_code_0x_lX
call fcn.140004544
jmp 0x14001b726
mov qword [rbp + 7], r12
mov qword [rbp - 1], r14
mov word [rbp - 0x11], r14w
cmp word [rbx], r14w
jne 0x14001b6a0
mov r8, r14
jmp 0x14001b6ae
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], r14w
jne 0x14001b6a4
mov rdx, rbx
lea rcx, [rbp - 0x11]
call fcn.1400063d0
nop
lea rax, [rbp - 0x11]
cmp rdi, rax
je 0x14001b6f3
cmp qword [rdi + 0x18], 8
jb 0x14001b6da
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov qword [rdi + 0x18], r12
mov qword [rdi + 0x10], r14
mov word [rdi], r14w
lea rdx, [rbp - 0x11]
mov rcx, rdi
call fcn.1400066ac
nop
cmp qword [rbp + 7], 8
jb 0x14001b70a
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
cmp qword [rdi + 0x18], 8
jb 0x14001b716
mov rdx, qword [rdi]
jmp 0x14001b719
mov rdx, rdi
lea rcx, str.AgentService.Util::GetNameOfMockShellProgram:_Mock_shell_program_is__s
call fcn.140013f74
nop
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
cmp qword [rdi + 0x18], 8
jb 0x14001b741
mov rdx, qword [rdi]
jmp 0x14001b744
mov rdx, rdi
lea rcx, str.AgentService.Util::GetNameOfMockShellProgram:_Exit___s_
call fcn.140013f74
mov rax, rdi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400c2d60
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret