Function at 0x140042a58
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov rax, qword [0x1400e6870]
xor rax, rsp
mov qword [rsp + 0x2a8], rax
mov r13, rcx
mov qword [rsp + 0x60], rcx
and qword [rsp + 0x68], 0
and qword [rsp + 0x48], 0
lea r8, [rsp + 0x48]
lea rcx, str.Status_Codes
call fcn.140058558
mov esi, eax
test eax, eax
jns 0x140042af6
lea r14, [0x1400df278]
mov rcx, qword [0x1400df278]
cmp rcx, r14
je 0x140042ae3
test byte [rcx + 0x1c], 1
je 0x140042ae3
mov edx, 0x36
mov r9d, eax
lea r8, [0x1400b9b20]
mov rcx, qword [rcx + 0x10]
call fcn.14000a9b0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140042bcb
jmp 0x140042bbf
xor r15d, r15d
lea r14, [0x1400df278]
mov rbx, qword [rsp + 0x48]
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x54], 0x104
mov dword [rsp + 0x50], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x54]
lea r8, [rsp + 0x90]
mov edx, r15d
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
nop dword [rax + rax]
test eax, eax
je 0x140042bcf
cmp eax, 0x103
jne 0x140042ba9
test rbx, rbx
je 0x140042b78
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
xor eax, eax
mov rcx, qword [rsp + 0x2a8]
xor rcx, rsp
call fcn.1400abb00
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test rbx, rbx
je 0x140042bcb
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, esi
jmp 0x140042b7a
and dword [rsp + 0x44], 0
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x70]
call fcn.1400462e0
nop
lea rcx, [rsp + 0x70]
call fcn.1400409d8
mov r12d, eax
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x70]
call fcn.140046270
nop
jmp 0x140042c24
test esi, esi
jns 0x140042c68
mov rcx, qword [0x1400df278]
cmp rcx, r14
je 0x140042d4e
test byte [rcx + 0x1c], 1
je 0x140042d4e
mov edx, 0x37
mov dword [rsp + 0x20], esi
lea r9, [rsp + 0x90]
lea r8, [0x1400b9b20]
mov rcx, qword [rcx + 0x10]
call fcn.140010d3c
jmp 0x140042d4e
mov r9d, dword [rsp + 0x5c]
mov eax, r9d
test r9d, r9d
je 0x140042cd1
sub eax, 1
je 0x140042cc7
sub eax, 1
je 0x140042cbd
cmp eax, 1
je 0x140042cd1
mov rcx, qword [0x1400df278]
cmp rcx, r14
je 0x140042d4e
test byte [rcx + 0x1c], 1
je 0x140042d4e
mov edx, 0x38
mov dword [rsp + 0x20], r12d
lea r8, [0x1400b9b20]
mov rcx, qword [rcx + 0x10]
call fcn.14000a9f4
jmp 0x140042d4e
mov dword [rsp + 0x40], 2
jmp 0x140042cd9
mov dword [rsp + 0x40], 1
jmp 0x140042cd9
mov dword [rsp + 0x40], 3
lea rcx, [r13 + 0x78]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x44]
call fcn.140046938
mov esi, eax
test eax, eax
jns 0x140042d22
mov rcx, qword [0x1400df278]
cmp rcx, r14
je 0x140042d4e
test byte [rcx + 0x1c], 1
je 0x140042d4e
mov edx, 0x39
mov dword [rsp + 0x20], eax
mov r9d, r12d
lea r8, [0x1400b9b20]
mov rcx, qword [rcx + 0x10]
call fcn.14000a9f4
jmp 0x140042d4e
jne 0x140042d4e
mov rcx, qword [0x1400df278]
cmp rcx, r14
je 0x140042d4e
test byte [rcx + 0x1c], 1
je 0x140042d4e
mov edx, 0x3a
mov r9d, r12d
lea r8, [0x1400b9b20]
mov rcx, qword [rcx + 0x10]
call fcn.14000a9b0
inc r15d
jmp 0x140042b05