Function at 0x140005b80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x140019010]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov qword [rbp - 0x50], rcx
xor eax, eax
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x40], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x3c], 0x208
movdqa xmm1, xmmword [0x140014190]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm2, xmmword [0x1400141a0]
movdqu xmmword [rsp + 0x50], xmm2
mov cl, 0x76
mov dl, 0x7d
mov r8b, 0x67
mov r9b, 0x45
movzx r10d, cl
mov bl, 0x61
mov dil, 0x60
mov sil, 0x7a
mov r14b, 0x7c
movzx r15d, dl
mov r12b, 0x4f
mov r13b, 0x41
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r11d, xmm1
xor al, r11b
mov byte [rsp + 0x41], al
xor byte [rsp + 0x42], r11b
xor byte [rsp + 0x43], r11b
xor byte [rsp + 0x44], r11b
xor byte [rsp + 0x45], r11b
xor byte [rsp + 0x46], r11b
xor byte [rsp + 0x47], r11b
xor byte [rsp + 0x48], r11b
xor byte [rsp + 0x49], r11b
xor byte [rsp + 0x4a], r11b
xor byte [rsp + 0x4b], r11b
xor byte [rsp + 0x4c], r11b
xor byte [rsp + 0x4d], r11b
xor byte [rsp + 0x4e], r11b
xor byte [rsp + 0x4f], r11b
movd eax, xmm2
xor al, r11b
mov byte [rsp + 0x50], al
xor byte [rsp + 0x51], r11b
xor byte [rsp + 0x52], r11b
xor byte [rsp + 0x53], r11b
xor byte [rsp + 0x54], r11b
xor byte [rsp + 0x55], r11b
xor byte [rsp + 0x56], r11b
xor byte [rsp + 0x57], r11b
xor byte [rsp + 0x58], r11b
xor byte [rsp + 0x59], r11b
xor byte [rsp + 0x5a], r11b
xor byte [rsp + 0x5b], r11b
xor byte [rsp + 0x5c], r11b
xor byte [rsp + 0x5d], r11b
xor byte [rsp + 0x5e], r11b
xor byte [rsp + 0x5f], r11b
xor cl, r11b
mov byte [rsp + 0x60], cl
xor dl, r11b
mov byte [rsp + 0x61], dl
xor r8b, r11b
mov byte [rsp + 0x62], r8b
xor r9b, r11b
mov byte [rsp + 0x63], r9b
xor r10b, r11b
mov byte [rsp + 0x64], r10b
xor bl, r11b
mov byte [rsp + 0x65], bl
xor dil, r11b
mov byte [rsp + 0x66], dil
xor sil, r11b
mov byte [rsp + 0x67], sil
xor r14b, r11b
mov byte [rsp + 0x68], r14b
xor r15b, r11b
mov byte [rsp + 0x69], r15b
xor r12b, r11b
mov byte [rsp + 0x6a], r12b
xor r13b, r11b
mov byte [rsp + 0x6b], r13b
mov al, 0x66
xor al, r11b
mov byte [rsp + 0x6c], al
mov al, 0x7d
xor al, r11b
mov byte [rsp + 0x6d], al
mov byte [rsp + 0x6e], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor r15d, r15d
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
lea rax, [rsp + 0x41]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x140005d70
lea rdx, [rsp + 0x41]
lea rcx, [rsp + 0x70]
call fcn.140007fb0
nop
mov r14d, dword [rbp - 0x80]
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae r8, qword [rsp + 0x70]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9d, [r14 + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
cmovo rax, rbx
mov rcx, rax
call fcn.140010714
mov rsi, rax
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae r8, qword [rsp + 0x70]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, rsi
lea rcx, [rbp - 0x70]
call fcn.1400070d0
mov rcx, rsi
call fcn.1400103b0
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rdx, qword [rbp - 0x70]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140005e7c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005e77
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103b0
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r15w
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140005ecc
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ec7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ec7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103b0
mov edi, r15d
test esi, esi
sete dil
test esi, esi
jne 0x140005f34
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 2]
mov r8, qword [rbp - 0x50]
xor edx, edx
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edi, r15d
test eax, eax
sete dil
test eax, eax
jne 0x140005f34
lea rax, [rbp - 0x30]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140005f20
mov edi, r15d
test rbx, rbx
setne dil
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140005f43
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.140010390
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret