Function at 0x14005a05c
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [r11 - 0x48], 0xfffffffffffffffe
movabs rax, 0xffffe7a3dd31c000
add rax, rcx
mov qword [rsp + 0xa0], rax
xor ebx, ebx
mov r13d, ebx
mov edi, ebx
mov qword [r11 - 0x80], rbx
mov r14d, ebx
mov qword [r11 - 0x78], rbx
mov qword [r11 - 0x70], rbx
mov dword [rsp + 0x60], ebx
lea r15, str.___t_
mov rcx, qword [str.___t_]
cmp rcx, r15
je 0x14005a0dc
test byte [rcx + 0x1c], 4
je 0x14005a0dc
cmp byte [rcx + 0x19], 5
jb 0x14005a0dc
mov edx, 0xa4
lea r8, [0x1400040c0]
mov rcx, qword [rcx + 0x10]
call fcn.14000e618
mov r9d, 0x20019
xor r8d, r8d
lea rsi, [0x140004030]
mov rdx, rsi
mov rcx, 0xffffffff80000002
call fcn.140075c60
mov r12, rax
mov qword [rsp + 0xa8], rax
test rax, rax
jne 0x14005a150
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.___t_]
cmp rcx, r15
je 0x14005a149
test byte [rcx + 0x1c], 4
je 0x14005a149
cmp byte [rcx + 0x19], 3
jb 0x14005a149
mov edx, 0xa5
mov qword [rsp + 0x20], rsi
mov r9d, eax
lea r8, [0x1400040c0]
mov rcx, qword [rcx + 0x10]
call fcn.14000e678
nop
mov eax, ebx
jmp 0x14005a4b2
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x110]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r15d, eax
mov dword [rsp + 0x128], eax
test eax, eax
je 0x14005a1f1
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp rcx, rax
je 0x14005a48b
test byte [rcx + 0x1c], 4
je 0x14005a48b
cmp byte [rcx + 0x19], 2
jb 0x14005a48b
mov edx, 0xa6
mov qword [rsp + 0x20], rsi
mov r9d, r15d
lea r8, [0x1400040c0]
mov rcx, qword [rcx + 0x10]
call fcn.14000e678
jmp 0x14005a48b
mov eax, dword [rsp + 0x110]
inc eax
mov dword [rsp + 0x110], eax
mov ecx, eax
add rcx, rcx
mov eax, 0xffffffff
cmp rcx, rax
jbe 0x14005a21b
mov r15d, 0x216
jmp 0x14005a48b
mov ecx, ecx
call fcn.140072274
mov r13, rax
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x14005a26e
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp rcx, rax
je 0x14005a263
test byte [rcx + 0x1c], 4
je 0x14005a263
cmp byte [rcx + 0x19], 2
jb 0x14005a263
mov edx, 0xa7
lea r8, [0x1400040c0]
mov rcx, qword [rcx + 0x10]
call fcn.14000e618
mov r15d, 8
jmp 0x14005a48b
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x120], eax
mov eax, ebx
mov edx, eax
inc eax
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x120]
mov r8, r13
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14005a436
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r13
mov rcx, r12
call fcn.140075c60
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x14005a31c
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp rcx, rax
je 0x14005a41f
test byte [rcx + 0x1c], 4
je 0x14005a41f
cmp byte [rcx + 0x19], 3
jb 0x14005a41f
mov edx, 0xa8
mov r9, r13
lea r8, [0x1400040c0]
mov rcx, qword [rcx + 0x10]
call fcn.14000e868
jmp 0x14005a41f
lea r8, [rsp + 0x68]
lea rdx, [0x140004080]
mov rcx, rax
call fcn.14007607c
mov rsi, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14005a34e
mov rax, qword [rsp + 0xa0]
cmp qword [rsi], rax
jae 0x14005a40c
lea r8, [rsp + 0x118]
lea rdx, [0x1400040a0]
mov rcx, r13
call qword [sym.imp.msvcrt.dll_swscanf]
cmp eax, 1
jne 0x14005a3d8
test rdi, rdi
je 0x14005a3a9
mov rcx, r14
sub rcx, rdi
sar rcx, 2
mov rax, qword [rsp + 0x98]
sub rax, rdi
sar rax, 2
cmp rcx, rax
jae 0x14005a3a9
lea rcx, [r14 + 4]
mov eax, dword [rsp + 0x118]
mov dword [r14], eax
mov r14, rcx
mov qword [rsp + 0x90], rcx
jmp 0x14005a3d1
lea r9, [rsp + 0x118]
mov rdx, r14
lea rcx, [rsp + 0x80]
call fcn.14005a830
mov r14, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
jmp 0x14005a40c
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp rcx, rax
je 0x14005a40c
test byte [rcx + 0x1c], 4
je 0x14005a40c
cmp byte [rcx + 0x19], 3
jb 0x14005a40c
mov edx, 0xaa
lea r8, [0x1400040c0]
mov rcx, qword [rcx + 0x10]
call fcn.14000e618
mov rcx, rsi
call fcn.140072328
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x120], eax
mov eax, dword [rsp + 0x64]
jmp 0x14005a27e
mov rsi, r14
sub rsi, rdi
test rdi, rdi
je 0x14005a474
mov r12, rsi
sar r12, 2
test r12, r12
je 0x14005a474
mov ecx, dword [rdi + rsi - 4]
mov dword [rsp + 0x118], ecx
call fcn.140076b84
test r12, r12
je 0x14005a43c
sub r14, 4
mov qword [rsp + 0x90], r14
sub rsi, 4
jmp 0x14005a43c
jmp 0x14005a48b
mov rcx, r13
call fcn.140072328
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test rdi, rdi
je 0x14005a4af
mov rcx, rdi
call fcn.140088138
mov eax, r15d
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret