Function at 0x14005c8ae
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140081aa0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x1328
call fcn.1400599ba
sub rsp, rax
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x36e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1348]
mov rax, qword [0x140159080]
xor rax, rbp
mov qword [rbp + 0x12e8], rax
lea rcx, [0x1401b11bd]
call fcn.14005c363
mov dword [rsp + 0x28], 0x20
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rbp + 0x1310]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x28], 0x20
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rbp + 0x1318]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, [rbp + 0x1118]
lea rcx, [rbp + 0x10f4]
call fcn.14007f0c0
mov rcx, rax
call fcn.140059b36
lea rcx, [rbp + 0xc8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0xe4], eax
cmp dword [rbp + 0xe4], 0
je 0x140081be5
lea rdx, [rbp + 0x1188]
lea rcx, [rbp + 0x1164]
call fcn.14007f1a0
mov rcx, rax
call fcn.14005c791
mov qword [rbp + 0x12d8], rax
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov qword [rbp + 0x12e0], rax
mov rdx, qword [rbp + 0x12d8]
mov rcx, qword [rbp + 0x12e0]
call fcn.14005bc38
jmp 0x140081d77
mov dword [rbp + 0x334], 0x208
lea rdx, [rbp + 0x11e8]
lea rcx, [rbp + 0x11c4]
call fcn.14007f280
mov rcx, rax
call fcn.14005bbbb
mov qword [rbp + 0x12d8], rax
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x12e0], rax
lea rax, [rbp + 0x334]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x110]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x12d8]
mov rcx, qword [rbp + 0x12e0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 0xe4], eax
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp + 0xe4], 0
jne 0x140081c76
cmp dword [rbp + 0x334], 1
jae 0x140081cc2
lea rdx, [rbp + 0x1238]
lea rcx, [rbp + 0x1214]
call fcn.14007f3d0
mov rcx, rax
call fcn.14005b5ee
mov qword [rbp + 0x12d8], rax
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov qword [rbp + 0x12e0], rax
mov rdx, qword [rbp + 0x12d8]
mov rcx, qword [rbp + 0x12e0]
call fcn.14005bc38
jmp 0x140081d77
mov eax, dword [rbp + 0x334]
xor edx, edx
mov ecx, 2
div rcx
mov dword [rbp + 0x354], eax
mov dword [rbp + 0x374], 0
jmp 0x140081cf2
mov eax, dword [rbp + 0x374]
inc eax
mov dword [rbp + 0x374], eax
mov eax, dword [rbp + 0x354]
cmp dword [rbp + 0x374], eax
jae 0x140081d28
mov eax, dword [rbp + 0x374]
movzx eax, word [rbp + rax*2 + 0x110]
cmp eax, 0x2f
jne 0x140081d26
mov eax, dword [rbp + 0x374]
mov ecx, 0x5c
mov word [rbp + rax*2 + 0x110], cx
jmp 0x140081ce4
lea rdx, [rbp + 0x1298]
lea rcx, [rbp + 0x1274]
call fcn.14007f440
mov rcx, rax
call fcn.14005bc8d
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x110]
mov r8, rax
mov edx, 0x800
lea rcx, [rbp + 0x3a0]
call fcn.14005aae5
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x10]
call fcn.14007f6e0
lea rcx, [rbp - 0x30]
lea rdx, [0x14011ab20]
call fcn.14005b9c7
mov rcx, qword [rbp + 0x12e8]
xor rcx, rbp
call fcn.14005a892
lea rsp, [rbp + 0x12f8]
pop rdi
pop rbp
ret