Function at 0x14001ee6c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov eax, r9d
mov r13, rdx
mov r12, rcx
xor r9d, r9d
test r8d, r8d
je 0x14001ee9d
mov word [rdx], r9w
mov r8d, r8d
add r8, r8
cmp rax, r8
jae 0x14001eeba
mov ecx, 0x48d3d3
call fcn.140006410
or eax, 0xffffffff
jmp 0x14001f0e7
lea rsi, [0x140038af8]
lea r10, [0x140066be0]
or ebx, 0xffffffff
mov rdx, r12
mov cl, byte [rsi]
call fcn.14001eb5c
mov edi, eax
mov dword [rbp - 0x28], eax
cmp eax, 0xffffffff
je 0x14001f0d2
mov qword [rbp - 0x20], r10
and qword [rbp - 0x18], 0
mov rcx, r10
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
xor r8d, r8d
test eax, eax
jne 0x14001f15c
lea eax, [rbx + 2]
lock xadd dword [rbp - 0x18], eax
inc eax
cmp eax, 1
jne 0x14001ef25
cmp dword [rbp - 0x14], r8d
jne 0x14001f17f
call qword [sym.imp.MSVCP140.dll__Thrd_id]
mov dword [rbp - 0x14], eax
xor r8d, r8d
mov r15d, r8d
cmp r15d, 4
jge 0x14001f0bf
mov r14b, r8b
mov byte [rbp + 0x50], r8b
mov qword [rsp + 0x28], r8
mov al, byte [r12 + 0x18]
mov byte [rsp + 0x20], al
mov r9d, edi
xor r8d, r8d
mov rdx, qword [r12 + 0x10]
lea rcx, [rbp - 0x10]
call fcn.14001dde0
mov ebx, dword [rax]
mov rdi, qword [rax + 8]
xor r8d, r8d
mov qword [rax + 8], r8
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14001ef85
mov qword [rbp - 8], r8
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400325b8]
xor r8d, r8d
test ebx, ebx
jne 0x14001f098
mov r14b, byte [r12 + 0x1c]
and r14b, 0xf
mov eax, dword [rbp + 0x58]
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x2c], r8d
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x20], rax
mov r9d, 0xffff
mov r8, qword [r12]
xor edx, edx
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, eax
mov ecx, dword [rbp - 0x2c]
mov edx, 2
cmp dword [rbp - 0x30], edx
jae 0x14001efe5
lea eax, [rcx - 1]
cmp eax, 1
cmovbe ebx, edx
mov r9d, 0x3f2
cmp ebx, r9d
je 0x14001f005
cmp ebx, 0x3fa
je 0x14001f005
cmp ebx, 6
je 0x14001f005
xor r8d, r8d
mov eax, r8d
jmp 0x14001f00d
mov eax, 1
xor r8d, r8d
test eax, eax
jne 0x14001f04a
test ebx, ebx
jne 0x14001f04a
lea eax, [rcx - 1]
cmp eax, 1
ja 0x14001f02c
mov eax, dword [rbp - 0x30]
shr rax, 1
mov word [r13 + rax*2 - 2], r8w
mov ecx, dword [rbp - 0x2c]
movzx eax, r14b
cmp ecx, eax
je 0x14001f04a
sub ecx, 1
je 0x14001f044
cmp ecx, 1
jne 0x14001f048
cmp eax, ecx
jne 0x14001f048
jmp 0x14001f04a
cmp eax, edx
je 0x14001f04a
mov ebx, edx
cmp ebx, r9d
je 0x14001f05f
cmp ebx, 0x3fa
je 0x14001f05f
cmp ebx, 6
mov eax, r8d
jne 0x14001f064
mov eax, 1
test eax, eax
je 0x14001f090
mov rcx, qword [r12 + 0x10]
movzx eax, word [rcx + 0xa]
and eax, 0x1f
shl rax, 5
lea rdx, [0x1400641e0]
mov qword [rax + rdx], r8
call fcn.14001c7b4
mov r14b, 1
xor r8d, r8d
jmp 0x14001f098
test ebx, ebx
je 0x14001f0ff
mov r14b, byte [rbp + 0x50]
test rdi, rdi
je 0x14001f0b0
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [0x1400325b8]
xor r8d, r8d
inc r15d
test r14b, r14b
mov edi, dword [rbp - 0x28]
jne 0x14001ef28
lea rcx, [rbp - 0x20]
call fcn.14000de8c
xor r9d, r9d
lea r10, [0x140066be0]
inc rsi
lea rax, [0x140038afb]
cmp rsi, rax
jne 0x14001eec8
mov eax, ebx
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test rdi, rdi
je 0x14001f117
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [0x1400325b8]
xor r8d, r8d
mov eax, dword [rbp - 0x18]
test eax, eax
je 0x14001f149
or eax, 0xffffffff
lock xadd dword [rbp - 0x18], eax
cmp eax, 1
jne 0x14001f13d
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x14], eax
jne 0x14001f165
xor r9d, r9d
mov dword [rbp - 0x14], r9d
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
jmp 0x14001f114
cmp dword [rbp - 0x14], r8d
je 0x14001f0e5
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x14], eax
jne 0x14001f172
jmp 0x14001f0e5
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
xor edx, edx
mov ecx, 0x131f4c5
call fcn.140006298
int3
xor edx, edx
mov ecx, 0x131f4c3
call fcn.140006298
int3
xor edx, edx
mov ecx, 0x131f4c4
call fcn.140006298
int3