Function at 0x140059730
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rsp + 0xf0], rbx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rdx
mov rbx, rcx
xor r15d, r15d
mov qword [rdx + 0x10], r15
cmp qword [rdx + 0x18], 8
jb 0x14005977b
mov rax, qword [rdx]
jmp 0x14005977e
mov rax, rdx
mov word [rax], r15w
cmp rcx, 0xffffffff80000002
jne 0x1400597af
mov r8d, 0x11
lea rdx, str.REGISTRYMACHINE
mov rcx, rdi
call fcn.140007c60
movabs rax, 0x8000000000
jmp 0x140059a19
cmp rcx, 0xffffffff80000003
jne 0x1400597c7
mov r8d, 0xe
lea rdx, str.REGISTRYUSER
jmp 0x140059798
cmp rcx, 0xffffffff80000001
jne 0x140059873
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r15
mov word [rbp - 0x39], r15w
lea rcx, [rbp - 0x39]
call fcn.140059180
mov rbx, rax
shr rax, 0x27
not eax
test al, 1
jne 0x140059850
lea r8, [rbp - 0x39]
lea rdx, str.REGISTRYUSER_
lea rcx, [rbp - 0x19]
call fcn.14000d4c0
nop
mov rdx, rax
mov rcx, rdi
call fcn.14000c2d0
nop
cmp qword [rbp - 1], 8
jb 0x140059835
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp - 1], 7
mov qword [rbp - 9], r15
mov word [rbp - 0x19], r15w
movabs rbx, 0x8000000000
cmp qword [rbp - 0x21], 8
jb 0x140059861
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp - 0x21], 7
mov word [rbp - 0x39], r15w
jmp 0x140059a12
cmp rcx, 0xffffffff80000000
jne 0x14005993b
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r15
mov word [rbp - 0x39], r15w
lea rcx, [rbp - 0x39]
call fcn.140059180
mov rbx, rax
shr rax, 0x27
not eax
test al, 1
jne 0x140059936
lea r8, [rbp - 0x39]
lea rdx, str.REGISTRYUSER_
lea rcx, [rbp + 7]
call fcn.14000d4c0
nop
lea r8, str._Classes
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.14000d440
nop
mov rdx, rax
mov rcx, rdi
call fcn.14000c2d0
nop
cmp qword [rbp - 1], 8
jb 0x1400598f9
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp - 1], 7
mov qword [rbp - 9], r15
mov word [rbp - 0x19], r15w
cmp qword [rbp + 0x1f], 8
jb 0x14005991b
mov rcx, qword [rbp + 7]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0x1f], 7
mov qword [rbp + 0x17], r15
mov word [rbp + 7], r15w
movabs rbx, 0x8000000000
jmp 0x140059850
mov dword [rbp - 0x49], r15d
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 3]
call qword [sym.imp.ntdll.dll_NtQueryKey]
mov esi, eax
cmp eax, 0x80000005
je 0x140059983
cmp esi, 0xc0000023
je 0x140059983
call fcn.140058f90
or rax, rsi
movabs rcx, 0x172110000000
or rax, rcx
jmp 0x140059a19
mov eax, dword [rbp - 0x49]
test eax, eax
je 0x1400597a0
mov edx, eax
lea rcx, [rbp - 0x39]
call fcn.140016da0
nop
mov r9, qword [rbp - 0x31]
mov rsi, qword [rbp - 0x39]
sub r9, rsi
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x20], rcx
mov r8, rsi
mov edx, 3
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtQueryKey]
mov r14d, eax
test eax, eax
je 0x1400599e0
call fcn.140058f90
mov rbx, rax
or rbx, r14
movabs rax, 0x182110000000
or rbx, rax
jmp 0x1400599fc
mov r8d, dword [rsi]
shr r8, 1
lea rdx, [rsi + 4]
mov rcx, rdi
call fcn.140007c60
movabs rbx, 0x8000000000
test rsi, rsi
je 0x140059a16
mov rcx, rsi
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], r15
mov rax, rbx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400f5ff0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret