Function at 0x14005c160
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x38]
sub rsp, 0x138
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov r15, r9
mov qword [rbp - 0x68], r9
mov r14, r8
mov qword [rsp + 0x60], r8
mov r13, rdx
mov r12, rcx
mov qword [rbp - 0x60], rdx
mov qword [rbp - 0x58], r8
mov qword [rbp - 0x50], r9
mov rax, qword [rbp + 0xa0]
mov qword [rsp + 0x68], rax
mov qword [rbp - 0x48], rax
xor esi, esi
mov qword [rbp + 0x10], rsi
lea rax, [rbp + 0x10]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, esi
test eax, eax
cmove rcx, qword [rbp + 0x10]
mov qword [rbp - 0x10], rcx
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov dword [rbp + 0x24], esi
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov qword [rbp], rsi
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x14005c681
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp], rax
mov r9d, dword [rbp - 0x10]
mov r8d, dword [rbp - 0xc]
lea rdx, str._08lx_08lx
lea rcx, [rbp]
call fcn.14001c4c0
mov qword [rbp - 8], rsi
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x14005c68c
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
lea rbx, [rax + 0x18]
mov qword [rbp - 8], rbx
mov rcx, qword [r12]
lea rdi, [rsi - 1]
test rcx, rcx
je 0x14005c57b
mov dword [rbp - 0x18], esi
mov r15d, esi
mov dword [rbp - 0x14], 1
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x14]
xor r8d, r8d
lea rdx, [0x14026f270]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rbp - 0x18]
test edx, edx
je 0x14005c362
mov ecx, dword [rbp - 0x14]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x14005c2ee
cmp ecx, 7
jne 0x14005c362
add rdx, 2
cmovb rdx, rdi
mov ecx, 1
call fcn.14020cf94
mov r14, rax
test rax, rax
je 0x14005c35d
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x14]
xor r8d, r8d
lea rdx, [0x14026f270]
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005c355
mov r8, rdi
inc r8
cmp word [r14 + r8*2], si
jne 0x14005c335
mov rdx, r14
lea rcx, [rbp - 8]
call fcn.140018f50
mov r15d, 1
mov rbx, qword [rbp - 8]
mov rcx, r14
call fcn.140207144
mov r14, qword [rsp + 0x60]
test r15d, r15d
je 0x14005c577
mov qword [rbp + 8], rsi
lea rax, [rsp + 0x70]
mov qword [rbp - 0x40], rax
lea rax, [rsp + 0x78]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x78]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rbp - 0x20], rax
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rsp + 0x70], rax
mov r14, qword [rbp]
lea rcx, [r14 - 0x18]
call fcn.140019180
add rax, 0x18
mov qword [rsp + 0x78], rax
mov r12, qword [rbp - 0x68]
mov rcx, qword [r12]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rbp - 0x80], rax
mov r15, qword [rsp + 0x60]
mov rcx, qword [r15]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rbp - 0x78], rax
mov rcx, qword [r13]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rbp - 0x70], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
lea r8, [rbp - 0x78]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 8]
call fcn.14005be80
nop
mov rax, qword [rbp + 8]
test rax, rax
je 0x14005c676
sub rax, rbx
nop word [rax + rax]
movzx ecx, word [rbx]
cmp cx, word [rbx + rax]
jne 0x14005c464
add rbx, 2
test cx, cx
jne 0x14005c450
jmp 0x14005c469
sbb esi, esi
or esi, 1
test esi, esi
sete bl
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005c493
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp - 8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005c4b8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov eax, edi
lock xadd dword [r14 - 8], eax
sub eax, 1
jg 0x14005c4db
mov rcx, qword [r14 - 0x18]
mov rax, qword [rcx]
lea rdx, [r14 - 0x18]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005c500
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [r15]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005c524
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005c549
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14005c56f
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x140038ca6.0]
movzx eax, bl
jmp 0x14005c656
mov r15, qword [rbp - 0x68]
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005c59c
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005c5c1
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005c5e6
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005c60a
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [r15]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005c62e
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14005c654
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
xor al, al
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.1401f74b0
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
int3