Function at 0x14000d5cc
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r14
mov qword [rax + 0x20], r15
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [0x1400333e0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov eax, 2
mov word [0x140033408], ax
lea rdx, [0x14002aec0]
lea rdi, [0x14003bda0]
mov rcx, rdi
lea r8d, [rax + 0x1e]
mov rax, qword [rdx]
xchg qword [rcx], rax
lea rcx, [rcx + 8]
lea rdx, [rdx + 8]
sub r8, 1
jne 0x14000d61a
and qword [rbp + 0x17], r8
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
mov ebx, 0x20019
mov r9d, ebx
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionVirtualization
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000d898
and dword [rbp + 0xb], eax
and qword [rbp + 0x27], 0
and qword [rbp + 0xf], 0
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x14002ae48]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov r14d, 4
lea r15d, [r14 + 0xc]
test eax, eax
jne 0x14000d84a
mov dword [rbp + 7], r14d
lea rax, [rbp + 7]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xb]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9d, r15d
lea r8, str.TraceFlags
xor edx, edx
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov dword [rbp + 7], r14d
lea rax, [rbp + 7]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xb]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9d, r15d
lea r8, str.StopLevel
xor edx, edx
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov dword [rbp + 7], r14d
lea rax, [rbp + 7]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xb]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9d, r15d
lea r8, str.DebugBreakEnabled
xor edx, edx
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov dword [rbp + 7], r14d
lea rax, [rbp + 7]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xb]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9d, r15d
lea r8, str.TraceLevel
xor edx, edx
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
movzx ecx, word [0x140033408]
test eax, eax
cmove cx, word [rbp + 0xb]
mov word [0x140033408], cx
and qword [rbp + 0x1f], 0
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.TraceLevelsEnabled
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000d834
xor ebx, ebx
mov r8d, ebx
lea rdx, str.Trace_i
lea rcx, [rbp + 0x2f]
call fcn.140008774
mov dword [rbp + 7], 8
lea rax, [rbp + 7]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x27]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9d, 0x40
lea r8, [rbp + 0x2f]
xor edx, edx
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14000d829
mov rax, qword [rbp + 0x27]
mov qword [rdi], rax
inc ebx
add rdi, 8
cmp ebx, 0x20
jl 0x14000d7d0
mov rcx, qword [rbp + 0x1f]
test rcx, rcx
je 0x14000d84a
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
mov dword [rbp + 7], r14d
lea rax, [rbp + 7]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xb]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9d, r15d
lea r8, str.ClientAssertMask
xor edx, edx
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x14000d898
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x14000d8ae
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400017a0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov r15, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret