Function at 0x14005cdb0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
push r14
push r15
mov eax, 0x1550
call sub.ntdll.dll___chkstk
sub rsp, rax
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + Ordinal_5447], rax
test r8, r8
mov rax, qword [rsp + 0x15c8]
mov r13, qword [rsp + 0x15c0]
mov r14, qword [rsp + 0x15d0]
mov rbx, r9
mov rsi, r8
mov qword [rsp + 0xc8], rax
mov rbp, rcx
je 0x14005ce46
mov r15, qword [rsp + 0x15b0]
test r15, r15
je 0x14005ce46
mov r12, qword [rsp + 0x15b8]
test r12, r12
je 0x14005ce46
test rax, rax
je 0x14005ce46
test r14, r14
je 0x14005ce46
test rbx, rbx
je 0x14005ce46
test r13, r13
je 0x14005ce46
mov r8, rdx
mov rdx, rsi
call fcn.14005b310
test eax, eax
jne 0x14005ce4d
xor eax, eax
jmp 0x14005d6ef
mov qword [rsp + Ordinal_5524], rdi
xor edi, edi
lea rcx, [rsp + 0x912]
xor edx, edx
mov r8d, Ordinal_512
mov qword [rsp + 0x80], rdi
mov word [rsp + 0x910], di
call sub.ntdll.dll_memset
lea r9, str.Objects
lea rdx, [0x1402e1998]
lea rcx, [rsp + 0x910]
mov r8, rsi
call qword [sym.imp.MSVCR80.dll__swprintf]
lea r11, [rsp + 0x80]
lea rdx, [rsp + 0x910]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14005cf08
call fcn.140049470
lea rcx, str..._reg.cpp
mov edx, 0x4d7
mov rdi, qword [rax]
mov rbx, rax
call fcn.14005ae30
lea rdx, [0x1402e22a0]
mov rcx, rbx
mov r8, rax
call qword [rdi + 0x10]
mov rdx, rsi
mov rcx, rbp
call fcn.14005b510
xor eax, eax
jmp 0x14005d6e7
lea rcx, [rsp + 0xd22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + Ordinal_3365], di
call sub.ntdll.dll_memset
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0xa8]
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0xd20]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xd0]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xec]
mov dword [rsp + 0x88], Ordinal_265
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xe4]
mov dword [rsp + 0x64], edi
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r11d, dword [rsp + 0x64]
test r11d, r11d
je 0x14005d6d4
test r11d, r11d
mov ebp, edi
je 0x14005d6d4
lea rsi, [0x1403b66f8]
nop
nop
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0xa8]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x1140]
mov edx, ebp
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x98], Ordinal_265
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14005d6c7
lea rcx, [rsp + 0x702]
xor edx, edx
mov r8d, 0x206
mov word [rsp + reloc.MFC80U.DLL_Ordinal_1792], ax
call sub.ntdll.dll_memset
lea r9, [rsp + 0x1140]
lea r8, [rsp + 0x910]
lea rdx, [0x1402e2530]
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_1792]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.MSVCR80.dll__swprintf]
lea r11, [rsp + 0x90]
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_1792]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005d6c7
lea rcx, [rsp + 0xf32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + Ordinal_3891], ax
call sub.ntdll.dll_memset
mov rcx, qword [rsp + 0x90]
lea rax, [rsp + 0xb8]
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0xf30]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xe8]
mov dword [rsp + 0xa0], Ordinal_265
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa4]
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xd4]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xdc]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r11d, dword [rsp + 0x60]
test r11d, r11d
je 0x14005d6b9
test r11d, r11d
mov esi, edi
mov dword [rsp + 0x78], edi
je 0x14005d6b2
nop
nop
mov rcx, qword [rsp + 0x90]
lea rax, [rsp + 0xb8]
lea r9, [rsp + 0x9c]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x1340]
mov edx, esi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x9c], Ordinal_265
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14005d698
lea rcx, [rsp + 0xb12]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0xb10], ax
call sub.ntdll.dll_memset
lea r9, [rsp + 0x1340]
lea r8, [rsp + reloc.MFC80U.DLL_Ordinal_1792]
lea rdx, [0x1402e0040]
lea rcx, [rsp + 0xb10]
call qword [sym.imp.MSVCR80.dll__swprintf]
lea r11, [rsp + 0x68]
lea rdx, [rsp + 0xb10]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005d698
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_1282]
xor edx, edx
mov r8d, Ordinal_512
mov word [rsp + Ordinal_1282], ax
call sub.ntdll.dll_memset
mov rcx, qword [rsp + 0x68]
xor eax, eax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x500]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], reloc.MFC80U.DLL_Ordinal_512
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x14005d68b
mov rsi, qword [rsp + 0xc8]
nop
nop
nop
lea rcx, [rsp + 0x101]
xor edx, edx
mov r8d, 0x3ff
add edi, 1
mov byte [rsp + 0x100], 0
call sub.ntdll.dll_memset
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x74]
lea rdx, [rsp + 0x500]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x100]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x74], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005d632
mov r8d, dword [rsp + 0x74]
cmp r8d, 0x58
jne 0x14005d523
lea rax, [rsp + 0x138]
mov rdx, qword [rax]
cmp rdx, qword [rbx]
jne 0x14005d33d
mov rdx, qword [rax + 8]
cmp rdx, qword [rbx + 8]
jne 0x14005d33d
xor eax, eax
jmp 0x14005d342
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x14005d424
lea rcx, [rsp + 0x120]
mov rdx, qword [rcx]
cmp rdx, qword [r12 + 0x78]
jne 0x14005d36a
mov rdx, qword [rcx + 8]
cmp rdx, qword [r12 + 0x80]
je 0x14005d36f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x14005d424
mov eax, dword [r14 + 0x78]
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x500]
mov dword [rcx], eax
mov eax, dword [r14 + 0x7c]
mov r9d, 3
mov dword [rcx + 4], eax
mov eax, dword [r14 + 0x80]
xor r8d, r8d
mov dword [rcx + 8], eax
mov eax, dword [r14 + 0x84]
mov dword [rsp + 0x28], 0x58
mov dword [rcx + 0xc], eax
mov eax, dword [r13]
lea rcx, [rsp + 0x138]
mov dword [rcx], eax
mov eax, dword [r13 + 4]
mov dword [rcx + 4], eax
mov eax, dword [r13 + 8]
mov dword [rcx + 8], eax
mov eax, dword [r13 + 0xc]
mov dword [rcx + 0xc], eax
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14005d632
call fcn.140049470
lea r8, str..._reg.cpp
lea rdx, str.Update_BCD_file_failed.__s__d__n
mov r10, qword [rax]
mov r9d, 0x561
mov rcx, rax
call qword [r10 + 0x10]
jmp 0x14005d632
lea rax, [rsp + 0x138]
mov rdx, qword [rax]
cmp rdx, qword [rbx]
jne 0x14005d442
mov rdx, qword [rax + 8]
cmp rdx, qword [rbx + 8]
jne 0x14005d442
xor eax, eax
jmp 0x14005d447
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x14005d632
lea rcx, [rsp + 0x120]
mov rdx, qword [rcx]
cmp rdx, qword [r15 + 0x78]
jne 0x14005d46d
mov rdx, qword [rcx + 8]
cmp rdx, qword [r15 + 0x80]
je 0x14005d472
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x14005d632
mov eax, dword [rsi + 0x78]
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x500]
mov dword [rcx], eax
mov eax, dword [rsi + 0x7c]
mov r9d, 3
mov dword [rcx + 4], eax
mov eax, dword [rsi + 0x80]
xor r8d, r8d
mov dword [rcx + 8], eax
mov eax, dword [rsi + 0x84]
mov dword [rsp + 0x28], 0x58
mov dword [rcx + 0xc], eax
mov eax, dword [r13]
lea rcx, [rsp + 0x138]
mov dword [rcx], eax
mov eax, dword [r13 + 4]
mov dword [rcx + 4], eax
mov eax, dword [r13 + 8]
mov dword [rcx + 8], eax
mov eax, dword [r13 + 0xc]
mov dword [rcx + 0xc], eax
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14005d632
call fcn.140049470
lea r8, str..._reg.cpp
lea rdx, str.Update_BCD_file_failed.__s__d__n
mov r10, qword [rax]
mov r9d, Ordinal_1388
mov rcx, rax
call qword [r10 + 0x10]
jmp 0x14005d632
cmp r8d, 0xae
je 0x14005d539
cmp r8d, 0xf0
jbe 0x14005d632
lea rax, [rsp + 0x16c]
mov rdx, qword [rax]
cmp rdx, qword [rbx]
jne 0x14005d557
mov rdx, qword [rax + 8]
cmp rdx, qword [rbx + 8]
jne 0x14005d557
xor eax, eax
jmp 0x14005d55c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x14005d632
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_340]
mov rdx, qword [rcx]
cmp rdx, qword [r12 + 0x78]
jne 0x14005d584
mov rdx, qword [rcx + 8]
cmp rdx, qword [r12 + 0x80]
je 0x14005d589
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x14005d632
mov eax, dword [r14 + 0x78]
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_340]
mov dword [rsp + 0x28], r8d
mov dword [rcx], eax
mov eax, dword [r14 + 0x7c]
lea rdx, [rsp + 0x500]
mov dword [rcx + 4], eax
mov eax, dword [r14 + 0x80]
mov r9d, 3
mov dword [rcx + 8], eax
mov eax, dword [r14 + 0x84]
xor r8d, r8d
mov dword [rcx + 0xc], eax
mov eax, dword [r13]
lea rcx, [rsp + 0x16c]
mov dword [rcx], eax
mov eax, dword [r13 + 4]
mov dword [rcx + 4], eax
mov eax, dword [r13 + 8]
mov dword [rcx + 8], eax
mov eax, dword [r13 + 0xc]
mov dword [rcx + 0xc], eax
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14005d632
call fcn.140049470
lea r8, str..._reg.cpp
lea rdx, str.Update_BCD_file_failed.__s__d__n
mov r10, qword [rax]
mov r9d, Ordinal_1404
mov rcx, rax
call qword [r10 + 0x10]
lea rcx, [rsp + 0x500]
xor edx, edx
mov r8d, 0x100
call sub.ntdll.dll_memset
mov rcx, qword [rsp + 0x68]
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x500]
mov edx, edi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], reloc.MFC80U.DLL_Ordinal_512
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x14005d2b0
mov esi, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
add esi, 1
cmp esi, dword [rsp + 0x60]
mov dword [rsp + 0x78], esi
jb 0x14005d180
lea rsi, [0x1403b66f8]
jmp 0x14005d6b9
lea rsi, [0x1403b66f8]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebp, 1
cmp ebp, dword [rsp + 0x64]
jb 0x14005cfe0
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rdi, qword [rsp + 0x1590]
mov rcx, qword [rsp + 0x1540]
xor rcx, rsp
call fcn.140161080
add rsp, 0x1550
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret