Function at 0x1400b4b70
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r12, rdx
mov rsi, rcx
mov dword [rbp - 0x41], 4
lea rax, [rcx + 0x490]
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140108390]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp - 0x41], 4
lea rax, [rsi + 0x494]
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401083b0]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdi, [rsi + 0x220]
mov ebx, 0x104
mov dword [rbp - 0x41], ebx
lea rax, [rbp - 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [0x1401083d0]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor r14d, r14d
mov edx, dword [rbp - 0x41]
test edx, edx
je 0x1400b4c68
cmp dword [rbp - 0x49], 1
jne 0x1400b4c68
lea eax, [rdx - 1]
cmp word [rdi + rax*2], r14w
je 0x1400b4c6c
cmp edx, ebx
cmovb ebx, edx
mov word [rdi + rbx*2], r14w
jmp 0x1400b4c6c
mov word [rdi], r14w
mov dword [rbp - 0x49], 4
lea rax, [rsi + 0x448]
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401083f8]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp - 0x49], 4
lea rax, [rsi + 0x44c]
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140108420]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp - 0x49], 4
lea rax, [rsi + 0x450]
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140108450]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp - 0x49], 4
lea rax, [rsi + 0x454]
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140108470]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp - 0x49], 4
lea rax, [rsi + 0x458]
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140108480]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp - 0x49], 4
lea rax, [rsi + 0x45c]
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140108490]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp - 0x49], 4
lea rax, [rsi + 0x460]
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401084a8]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea r8, [rsi + 0x428]
lea rdx, [0x1401084b8]
mov rcx, r12
call fcn.14008f560
mov qword [rbp - 0x31], r14
mov ecx, 0x38
call fcn.14004b164
test rax, rax
je 0x1400b4f2e
mov qword [rbp - 0x39], rax
mov qword [rax], rax
mov qword [rax + 8], rax
lea r8, [rbp - 0x39]
lea rdx, [0x1401084d0]
mov rcx, r12
call fcn.14008f560
mov r13, qword [rsi + 0x440]
mov rdi, qword [rbp - 0x39]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1400b4e7b
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov qword [rbp + 0x17], 7
mov qword [rbp + 0xf], r14
mov word [rbp - 1], r14w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp - 1]
call fcn.140009660
nop
lea rdx, [rbp - 1]
mov rcx, r13
call fcn.140018e50
nop
cmp qword [rbp + 0x17], 8
jb 0x1400b4e73
mov rcx, qword [rbp - 1]
call fcn.14004b088
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1400b4e30
mov dword [rbp - 0x49], 4
lea rax, [rsi + 0x488]
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401084e0]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp - 0x49], 4
lea rax, [rsi + 0x48c]
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401084f8]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop
mov rbx, qword [rdi]
mov qword [rdi], rdi
mov qword [rdi + 8], rdi
cmp rbx, rdi
je 0x1400b4f24
nop
mov rsi, qword [rbx]
cmp qword [rbx + 0x28], 8
jb 0x1400b4f03
mov rcx, qword [rbx + 0x10]
call fcn.14004b088
mov qword [rbx + 0x28], 7
mov qword [rbx + 0x20], r14
mov word [rbx + 0x10], r14w
mov rcx, rbx
call fcn.14004b088
mov rbx, rsi
cmp rsi, rdi
jne 0x1400b4ef0
mov rcx, rdi
call fcn.14004b088
jmp 0x1400b4f5b
mov qword [rbp - 0x49], r14
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x19]
call fcn.14004b2d4
lea r11, vtable.std::bad_alloc.0
mov qword [rbp - 0x19], r11
lea rdx, [0x140132320]
lea rcx, [rbp - 0x19]
call fcn.14004d894
int3
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14004ae00
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret