Function at 0x100005c24
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r15d, r15d
mov rsi, r9
mov rbp, r8
mov r14, rdx
mov r13, rcx
mov dword [rax - 0x78], r15d
mov dword [rax + 8], r15d
mov qword [rax - 0x70], r15
cmp rcx, r15
je 0x100005ec6
cmp rdx, r15
je 0x100005ec6
cmp r8, r15
je 0x100005ec6
cmp r9, r15
je 0x100005ec6
mov rbx, qword [rsp + 0xe0]
cmp rbx, r15
je 0x100005ec6
lea rax, [rax + 8]
mov r9d, 0xffff
xor edx, edx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edi, eax
cmp eax, r15d
je 0x100005cfe
cmp eax, 2
jne 0x100005ecb
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, r15d
jne 0x100005ecb
xor r8d, r8d
mov edx, 0x1f6
xor ecx, ecx
call fcn.10000d950
cmp rax, r15
jne 0x100005cef
mov eax, r15d
jmp 0x100005cf8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rax + rax + 2]
jmp 0x100005d05
mov ecx, dword [rsp + 0xc0]
mov eax, ecx
and eax, 1
add ecx, eax
mov dword [rsp + 0xc0], ecx
add ecx, 2
call fcn.10000ef18
mov r12, rax
mov qword [rsp + 0x48], rax
cmp rax, r15
jne 0x100005d32
mov edi, 0xe
jmp 0x100005ecb
mov rcx, rax
call fcn.10000f0c0
mov rdi, r12
mov r9d, 0x1000ffff
movsxd rcx, eax
xor eax, eax
mov r8, rbp
rep stosb byte [rdi], al
lea rax, [rsp + 0xc0]
xor edx, edx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov rcx, r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edi, eax
cmp eax, r15d
je 0x100005dc6
cmp eax, 2
jne 0x100005ecb
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, r15d
jne 0x100005ecb
mov edi, 1
xor r8d, r8d
mov edx, 0x1f6
xor ecx, ecx
mov dword [rsp + 0x40], edi
call fcn.10000d950
mov r8d, dword [rsp + 0xc0]
mov rcx, r12
shr r8d, 1
mov rdx, rax
call fcn.10000e668
jmp 0x100005dcb
mov edi, 1
cmp dword [rbx + 8], r15d
jne 0x100005e0d
test byte [rsi + 0x68], 4
je 0x100005e0d
mov r8d, dword [rsp + 0xc0]
mov edx, dword [rsp + 0x40]
mov r9, rsi
mov rcx, r12
call fcn.1000065e8
cmp eax, edi
jne 0x100005df5
add dword [rbx + 0x10], edi
cmp eax, r15d
jne 0x100005e0d
mov ecx, 0x490
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, r15d
jmp 0x100005ed2
cmp dword [rbx + 0xc], edi
jne 0x100005e25
cmp qword [rsi + 0x58], r15
jne 0x100005e21
cmp qword [rsi + 0x78], r15
jne 0x100005e21
add dword [rbx + 0x10], edi
mov dword [rbx + 0xc], r15d
cmp dword [rbx], edi
jne 0x100005e4c
call qword [sym.imp.msvcrt.dll___iob_func]
lea r9, [0x100001d58]
mov r8d, edi
lea rcx, [rax + 0x30]
mov edx, edi
mov qword [rsp + 0x20], r14
call fcn.10000ec34
mov dword [rbx], r15d
cmp qword [rsi + 0x58], r15
jne 0x100005e58
cmp qword [rsi + 0x78], r15
je 0x100005e5b
add dword [rbx + 0x10], edi
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x38]
call sub.msvcrt.dll_memset
mov eax, dword [rsp + 0x40]
mov qword [rsp + 0x60], rbp
mov dword [rsp + 0x50], eax
lea rax, [0x100001d60]
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x54], eax
lea rax, [rsi + 0x38]
mov dword [rsp + 0x70], 4
mov qword [rsp + 0x80], rax
cmp dword [rsi + 0x2c], edi
jne 0x100005eb7
or dword [rsp + 0x6c], 0x20
lea rcx, [rsp + 0x50]
call fcn.100003084
jmp 0x100005e05
mov edi, 0x57
mov ecx, edi
call fcn.100002fe8
lea rcx, [rsp + 0x48]
call fcn.10000ee3c
lea r11, [rsp + 0x90]
mov eax, edi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret