Function at 0x140059400
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x230
mov qword [rbp - 0x208], rbx
mov qword [rbp - 0x200], rsi
mov qword [rbp - 0x1f8], rdi
mov qword [rbp - 0x1f0], r12
mov qword [rbp - 0x1e8], r13
mov r13, rcx
mov rbx, rdx
mov rsi, r8
mov rdi, r9
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov dword [rbp - 0x1e0], 0xffffffff
mov rdx, qword [rsi + 8]
mov rax, qword [rsi]
mov qword [rbp - 0xc0], rax
mov qword [rbp - 0xb8], rdx
lea rdx, [rbp - 0xc0]
lea rcx, [rbp - 0x1d0]
call fcn.14001a170
mov edx, 0x100
lea rcx, [0x1400c3660]
sub rsp, 0x20
call fcn.14000c4a0
add rsp, 0x20
mov qword [rbp - 0xb0], rax
mov qword [rbp - 0xa8], rdx
mov rcx, qword [rbp - 0xb0]
add rcx, rcx
sub rsp, 0x20
call fcn.14002d4d0
add rsp, 0x20
mov dword [rbp - 0xa0], eax
lea rcx, [rbp - 0x1d0]
sub rsp, 0x20
call fcn.14000b2c0
add rsp, 0x20
mov r12, rax
lea r8, [rbp - 0x1e0]
mov rdx, qword [rbp - 0xa8]
lea r9, [rbp - 0xa0]
push r9
push rdx
mov r9, r8
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov esi, eax
cmp esi, 0xea
jne 0x14005957b
lea rdx, [rbp - 0xb0]
mov ecx, dword [rbp - 0xa0]
shr rcx, 1
sub rsp, 0x20
call fcn.14001bc00
add rsp, 0x20
lea rcx, [rbp - 0x1d0]
sub rsp, 0x20
call fcn.14000b2c0
add rsp, 0x20
mov r12, rax
lea r8, [rbp - 0x1e0]
mov r9, qword [rbp - 0xa8]
lea rdx, [rbp - 0xa0]
push rdx
push r9
mov r9, r8
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov esi, eax
jmp 0x14005959c
test esi, esi
jne 0x14005959c
lea rdx, [rbp - 0xb0]
mov ecx, dword [rbp - 0xa0]
shr rcx, 1
sub rsp, 0x20
call fcn.14001bc00
add rsp, 0x20
mov r9d, esi
lea r10, [0x140059300]
mov qword [rbp - 0x88], r10
xor r8d, r8d
mov qword [rbp - 0x90], r8
lea r8, [rbp - 0x90]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x80], 0x16
lea rdx, [rbp - 0x80]
mov ecx, 0x261
sub rsp, 0x20
call fcn.140057db0
add rsp, 0x20
cmp dword [rbp - 0x1e0], 7
sete dl
lea r8, [0x1400597c0]
mov qword [rbp - 0x68], r8
mov qword [rbp - 0x70], 0
lea rcx, [rbp - 0x70]
sub rsp, 0x20
call fcn.140003f20
add rsp, 0x20
cmp dword [rbp - 0x1e0], r13d
sete dl
lea r9, [0x140059830]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x60], 0
lea rcx, [rbp - 0x60]
sub rsp, 0x20
call fcn.140003f20
add rsp, 0x20
lea rdx, [rbp - 0xb0]
mov rcx, qword [rbp - 0xb0]
dec rcx
sub rsp, 0x20
call fcn.14001bc00
add rsp, 0x20
cmp qword [rbp - 0xb0], 0
je 0x1400596ab
mov rdi, qword [rbp - 0xb0]
mov r8, qword [rbp - 0xb0]
mov r9, qword [rbp - 0xa8]
lea r10, [r9 + r8*2]
cmp word [r10 - 2], 0
jne 0x1400596ab
lea rdx, [rbp - 0xb0]
mov rax, qword [rbp - 0xb0]
lea rcx, [rax - 1]
sub rsp, 0x20
call fcn.14001bc00
add rsp, 0x20
mov r8, qword [rbp - 0xb0]
mov qword [rbp - 0x40], r8
mov r9, qword [rbp - 0xa8]
mov qword [rbp - 0x38], r9
lea rdx, [rbp - 0x40]
lea r10, [0x1400c5fe0]
mov qword [rbp - 0x28], r10
mov qword [rbp - 0x30], 1
lea rcx, [rbp - 0x30]
sub rsp, 0x20
call fcn.140066f00
add rsp, 0x20
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
mov rdx, rbx
mov rcx, qword [rbp - 0x50]
sub rsp, 0x20
call fcn.140008c70
add rsp, 0x20
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
xor esi, esi
cmp qword [rbp - 0x20], rsi
je 0x140059766
mov rdi, qword [rbp - 0x18]
mov rbx, qword [rbp - 0x48]
mov r12, rdi
mov r13, rsi
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
lea rcx, [rbp - 0x10]
sub rsp, 0x20
call fcn.14001b850
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
mov r8d, 0x10
add rdi, r8
add rbx, r8
inc rsi
cmp rsi, qword [rbp - 0x20]
jb 0x140059724
sub rsp, 8
call fcn.140059775
add rsp, 8
jmp 0x14005978a
mov rbx, qword [rbp - 0x208]
mov rsi, qword [rbp - 0x200]
mov rdi, qword [rbp - 0x1f8]
mov r12, qword [rbp - 0x1f0]
mov r13, qword [rbp - 0x1e8]
mov rsp, rbp
pop rbp
ret