Function at 0x14001fe84
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x770]
sub rsp, 0x870
mov rax, qword [0x14004ba88]
xor rax, rsp
mov qword [rbp + 0x760], rax
and qword [rsp + 0x38], 0
mov rdi, rcx
mov edx, dword [rcx]
sub edx, 1
je 0x14001ff0d
sub edx, 1
je 0x14001ff04
sub edx, 1
je 0x14001fefb
sub edx, 1
je 0x14001fef2
cmp edx, 1
je 0x14001fee9
mov ebx, 0x80070057
mov edx, 0x6b9
jmp 0x14002003a
mov rcx, 0xffffffff80000003
jmp 0x14001ff14
mov rcx, 0xffffffff80000002
jmp 0x14001ff14
mov rcx, 0xffffffff80000001
jmp 0x14001ff14
mov rcx, 0xffffffff80000005
jmp 0x14001ff14
mov rcx, 0xffffffff80000000
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x40], rax
lea rdx, [rdi + 4]
lea rax, [rsp + 0x48]
mov byte [rsp + 0x50], 1
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
nop dword [rax + rax]
cmp byte [rsp + 0x50], 0
mov r14d, eax
je 0x14001ff96
mov rsi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov r15, qword [rsi]
test r15, r15
je 0x14001ff93
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, r15
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov qword [rsi], r12
test r14d, r14d
je 0x14001ffa5
mov r9d, r14d
mov edx, 0x6c7
jmp 0x14001fffd
mov esi, 0x800
lea rcx, [rsp + 0x60]
mov r8d, esi
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + 0x104]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], esi
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
nop dword [rax + rax]
test eax, eax
je 0x140020017
mov r9d, eax
mov edx, 0x6d3
mov rcx, qword [rbp + 0x798]
lea r8, str.onecore_amcoreoctagon_broker_sourcelib_assists.cpp
call fcn.140018bcc
mov ebx, eax
jmp 0x1400200a3
mov eax, dword [rsp + 0x34]
mov dword [rdi + 0x204], eax
sub eax, 1
je 0x140020066
sub eax, 3
je 0x140020059
cmp eax, 7
je 0x140020052
mov ebx, 0x80004005
mov edx, 0x6e5
mov rcx, qword [rbp + 0x798]
lea r8, str.onecore_amcoreoctagon_broker_sourcelib_assists.cpp
mov r9d, ebx
call fcn.140005170
jmp 0x1400200a3
mov rax, qword [rsp + 0x60]
jmp 0x14002005d
mov eax, dword [rsp + 0x60]
mov qword [rdi + 0x208], rax
jmp 0x1400200a1
mov eax, dword [rsp + 0x30]
lea rdx, [rsp + 0x60]
cmp eax, esi
mov ecx, 0x7ff
cmova eax, ecx
lea rcx, [rdi + 0x210]
mov r8d, eax
mov ebx, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
sub rsi, rbx
lea rcx, [rdi + 0x210]
add rcx, rbx
mov r8, rsi
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400200b9
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.1400342a0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret