Function at 0x14005a1b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x38]
sub rsp, 0x138
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov r15, r9
mov qword [rbp - 0x68], r9
mov r14, r8
mov qword [rsp + 0x60], r8
mov r13, rdx
mov r12, rcx
mov qword [rbp - 0x60], rdx
mov qword [rbp - 0x58], r8
mov qword [rbp - 0x50], r9
mov rax, qword [rbp + 0xa0]
mov qword [rsp + 0x68], rax
mov qword [rbp - 0x48], rax
xor esi, esi
mov qword [rbp + 0x10], rsi
lea rax, [rbp + 0x10]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, esi
test eax, eax
cmove rcx, qword [rbp + 0x10]
mov qword [rbp - 0x10], rcx
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov dword [rbp + 0x24], esi
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov qword [rbp], rsi
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x14005a6d1
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rbp], rax
mov r9d, dword [rbp - 0x10]
mov r8d, dword [rbp - 0xc]
lea rdx, str._08lx_08lx
lea rcx, [rbp]
call fcn.14001c3d0
mov qword [rbp - 8], rsi
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x14005a6dc
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
lea rbx, [rax + 0x18]
mov qword [rbp - 8], rbx
mov rcx, qword [r12]
lea rdi, [rsi - 1]
test rcx, rcx
je 0x14005a5cb
mov dword [rbp - 0x18], esi
mov r15d, esi
mov dword [rbp - 0x14], 1
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x14]
xor r8d, r8d
lea rdx, [0x14026a230]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rbp - 0x18]
test edx, edx
je 0x14005a3b2
mov ecx, dword [rbp - 0x14]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x14005a33e
cmp ecx, 7
jne 0x14005a3b2
add rdx, 2
cmovb rdx, rdi
mov ecx, 1
call fcn.1402090a4
mov r14, rax
test rax, rax
je 0x14005a3ad
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x14]
xor r8d, r8d
lea rdx, [0x14026a230]
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005a3a5
mov r8, rdi
inc r8
cmp word [r14 + r8*2], si
jne 0x14005a385
mov rdx, r14
lea rcx, [rbp - 8]
call fcn.140018f70
mov r15d, 1
mov rbx, qword [rbp - 8]
mov rcx, r14
call fcn.140203254
mov r14, qword [rsp + 0x60]
test r15d, r15d
je 0x14005a5c7
mov qword [rbp + 8], rsi
lea rax, [rsp + 0x70]
mov qword [rbp - 0x40], rax
lea rax, [rsp + 0x78]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x78]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rbp - 0x20], rax
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx]
sub rcx, 0x18
call fcn.1400191a0
add rax, 0x18
mov qword [rsp + 0x70], rax
mov r14, qword [rbp]
lea rcx, [r14 - 0x18]
call fcn.1400191a0
add rax, 0x18
mov qword [rsp + 0x78], rax
mov r12, qword [rbp - 0x68]
mov rcx, qword [r12]
sub rcx, 0x18
call fcn.1400191a0
add rax, 0x18
mov qword [rbp - 0x80], rax
mov r15, qword [rsp + 0x60]
mov rcx, qword [r15]
sub rcx, 0x18
call fcn.1400191a0
add rax, 0x18
mov qword [rbp - 0x78], rax
mov rcx, qword [r13]
sub rcx, 0x18
call fcn.1400191a0
add rax, 0x18
mov qword [rbp - 0x70], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
lea r8, [rbp - 0x78]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 8]
call fcn.140059ed0
nop
mov rax, qword [rbp + 8]
test rax, rax
je 0x14005a6c6
sub rax, rbx
nop word [rax + rax]
movzx ecx, word [rbx]
cmp cx, word [rbx + rax]
jne 0x14005a4b4
add rbx, 2
test cx, cx
jne 0x14005a4a0
jmp 0x14005a4b9
sbb esi, esi
or esi, 1
test esi, esi
sete bl
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005a4e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rbp - 8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005a508
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov eax, edi
lock xadd dword [r14 - 8], eax
sub eax, 1
jg 0x14005a52b
mov rcx, qword [r14 - 0x18]
mov rax, qword [rcx]
lea rdx, [r14 - 0x18]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005a550
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [r15]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005a574
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005a599
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14005a5bf
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x140038716.0]
movzx eax, bl
jmp 0x14005a6a6
mov r15, qword [rbp - 0x68]
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005a5ec
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rbp]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005a611
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005a636
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005a65a
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [r15]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005a67e
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14005a6a4
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
xor al, al
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.1401f3bf0
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
int3