Function at 0x140005bf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x14001a040]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov qword [rbp - 0x50], rcx
xor eax, eax
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x40], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x3c], 0x208
movdqa xmm1, xmmword [0x140015360]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm2, xmmword [0x140015350]
movdqu xmmword [rsp + 0x50], xmm2
mov cl, 0x4b
mov dl, 0x40
mov r8b, 0x5a
mov r9b, 0x78
movzx r10d, cl
mov bl, 0x5c
mov dil, 0x5d
mov sil, 0x47
mov r14b, 0x41
movzx r15d, dl
mov r12b, 0x72
mov r13b, 0x7c
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r11d, xmm1
xor al, r11b
mov byte [rsp + 0x41], al
xor byte [rsp + 0x42], r11b
xor byte [rsp + 0x43], r11b
xor byte [rsp + 0x44], r11b
xor byte [rsp + 0x45], r11b
xor byte [rsp + 0x46], r11b
xor byte [rsp + 0x47], r11b
xor byte [rsp + 0x48], r11b
xor byte [rsp + 0x49], r11b
xor byte [rsp + 0x4a], r11b
xor byte [rsp + 0x4b], r11b
xor byte [rsp + 0x4c], r11b
xor byte [rsp + 0x4d], r11b
xor byte [rsp + 0x4e], r11b
xor byte [rsp + 0x4f], r11b
movd eax, xmm2
xor al, r11b
mov byte [rsp + 0x50], al
xor byte [rsp + 0x51], r11b
xor byte [rsp + 0x52], r11b
xor byte [rsp + 0x53], r11b
xor byte [rsp + 0x54], r11b
xor byte [rsp + 0x55], r11b
xor byte [rsp + 0x56], r11b
xor byte [rsp + 0x57], r11b
xor byte [rsp + 0x58], r11b
xor byte [rsp + 0x59], r11b
xor byte [rsp + 0x5a], r11b
xor byte [rsp + 0x5b], r11b
xor byte [rsp + 0x5c], r11b
xor byte [rsp + 0x5d], r11b
xor byte [rsp + 0x5e], r11b
xor byte [rsp + 0x5f], r11b
xor cl, r11b
mov byte [rsp + 0x60], cl
xor dl, r11b
mov byte [rsp + 0x61], dl
xor r8b, r11b
mov byte [rsp + 0x62], r8b
xor r9b, r11b
mov byte [rsp + 0x63], r9b
xor r10b, r11b
mov byte [rsp + 0x64], r10b
xor bl, r11b
mov byte [rsp + 0x65], bl
xor dil, r11b
mov byte [rsp + 0x66], dil
xor sil, r11b
mov byte [rsp + 0x67], sil
xor r14b, r11b
mov byte [rsp + 0x68], r14b
xor r15b, r11b
mov byte [rsp + 0x69], r15b
xor r12b, r11b
mov byte [rsp + 0x6a], r12b
xor r13b, r11b
mov byte [rsp + 0x6b], r13b
mov al, 0x5b
xor al, r11b
mov byte [rsp + 0x6c], al
mov al, 0x40
xor al, r11b
mov byte [rsp + 0x6d], al
mov byte [rsp + 0x6e], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor r15d, r15d
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
lea rax, [rsp + 0x41]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x140005de0
lea rdx, [rsp + 0x41]
lea rcx, [rsp + 0x70]
call fcn.140008180
nop
mov r14d, dword [rbp - 0x80]
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova r8, qword [rsp + 0x70]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9d, [r14 + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
cmovo rax, rbx
mov rcx, rax
call fcn.140011274
mov rsi, rax
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova r8, qword [rsp + 0x70]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, rsi
lea rcx, [rbp - 0x70]
call fcn.1400072a0
mov rcx, rsi
call fcn.140010f20
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rdx, qword [rbp - 0x70]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x140005eec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ee7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ee7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010f20
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r15w
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140005f3c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005f37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010f20
mov edi, r15d
test esi, esi
sete dil
test esi, esi
jne 0x140005fa4
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 2]
mov r8, qword [rbp - 0x50]
xor edx, edx
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edi, r15d
test eax, eax
sete dil
test eax, eax
jne 0x140005fa4
lea rax, [rbp - 0x30]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140005f90
mov edi, r15d
test rbx, rbx
setne dil
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140005fb3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.140010f00
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret