Function at 0x14001fe64
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x770]
sub rsp, 0x870
mov rax, qword [0x14004ba88]
xor rax, rsp
mov qword [rbp + 0x760], rax
and qword [rsp + 0x38], 0
mov rdi, rcx
mov edx, dword [rcx]
sub edx, 1
je 0x14001feed
sub edx, 1
je 0x14001fee4
sub edx, 1
je 0x14001fedb
sub edx, 1
je 0x14001fed2
cmp edx, 1
je 0x14001fec9
mov ebx, 0x80070057
mov edx, 0x6b9
jmp 0x14002001a
mov rcx, 0xffffffff80000003
jmp 0x14001fef4
mov rcx, 0xffffffff80000002
jmp 0x14001fef4
mov rcx, 0xffffffff80000001
jmp 0x14001fef4
mov rcx, 0xffffffff80000005
jmp 0x14001fef4
mov rcx, 0xffffffff80000000
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x40], rax
lea rdx, [rdi + 4]
lea rax, [rsp + 0x48]
mov byte [rsp + 0x50], 1
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
nop dword [rax + rax]
cmp byte [rsp + 0x50], 0
mov r14d, eax
je 0x14001ff76
mov rsi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov r15, qword [rsi]
test r15, r15
je 0x14001ff73
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, r15
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov qword [rsi], r12
test r14d, r14d
je 0x14001ff85
mov r9d, r14d
mov edx, 0x6c7
jmp 0x14001ffdd
mov esi, 0x800
lea rcx, [rsp + 0x60]
mov r8d, esi
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + 0x104]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], esi
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
nop dword [rax + rax]
test eax, eax
je 0x14001fff7
mov r9d, eax
mov edx, 0x6d3
mov rcx, qword [rbp + 0x798]
lea r8, str.onecore_amcoreoctagon_broker_sourcelib_assists.cpp
call fcn.140018bac
mov ebx, eax
jmp 0x140020083
mov eax, dword [rsp + 0x34]
mov dword [rdi + 0x204], eax
sub eax, 1
je 0x140020046
sub eax, 3
je 0x140020039
cmp eax, 7
je 0x140020032
mov ebx, 0x80004005
mov edx, 0x6e5
mov rcx, qword [rbp + 0x798]
lea r8, str.onecore_amcoreoctagon_broker_sourcelib_assists.cpp
mov r9d, ebx
call fcn.140005180
jmp 0x140020083
mov rax, qword [rsp + 0x60]
jmp 0x14002003d
mov eax, dword [rsp + 0x60]
mov qword [rdi + 0x208], rax
jmp 0x140020081
mov eax, dword [rsp + 0x30]
lea rdx, [rsp + 0x60]
cmp eax, esi
mov ecx, 0x7ff
cmova eax, ecx
lea rcx, [rdi + 0x210]
mov r8d, eax
mov ebx, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
sub rsi, rbx
lea rcx, [rdi + 0x210]
add rcx, rbx
mov r8, rsi
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140020099
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.140034260
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret