Function at 0x14001ca58
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x770]
sub rsp, 0x870
mov rax, qword [0x14003c4b8]
xor rax, rsp
mov qword [rbp + 0x760], rax
and qword [rsp + 0x38], 0
mov rdi, rcx
mov edx, dword [rcx]
sub edx, 1
je 0x14001cae1
sub edx, 1
je 0x14001cad8
sub edx, 1
je 0x14001cacf
sub edx, 1
je 0x14001cac6
cmp edx, 1
je 0x14001cabd
mov ebx, 0x80070057
mov edx, 0x63b
jmp 0x14001cbf0
mov rcx, 0xffffffff80000003
jmp 0x14001cae8
mov rcx, 0xffffffff80000002
jmp 0x14001cae8
mov rcx, 0xffffffff80000001
jmp 0x14001cae8
mov rcx, 0xffffffff80000005
jmp 0x14001cae8
mov rcx, 0xffffffff80000000
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x40], rax
lea rdx, [rdi + 4]
lea rax, [rsp + 0x48]
mov byte [rsp + 0x50], 1
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
cmp byte [rsp + 0x50], 0
mov r14d, eax
je 0x14001cb52
mov rsi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov r15, qword [rsi]
test r15, r15
je 0x14001cb4f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, r15
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov qword [rsi], r12
test r14d, r14d
je 0x14001cb61
mov r9d, r14d
mov edx, 0x649
jmp 0x14001cbb3
mov esi, 0x800
lea rcx, [rsp + 0x60]
mov r8d, esi
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + 0x104]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], esi
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
je 0x14001cbcd
mov r9d, eax
mov edx, 0x655
mov rcx, qword [rbp + 0x798]
lea r8, str.onecore_amcoreoctagon_broker_sourcelib_assists.cpp
call fcn.140016138
mov ebx, eax
jmp 0x14001cc59
mov eax, dword [rsp + 0x34]
mov dword [rdi + 0x204], eax
sub eax, 1
je 0x14001cc1c
sub eax, 3
je 0x14001cc0f
cmp eax, 7
je 0x14001cc08
mov ebx, 0x80004005
mov edx, 0x667
mov rcx, qword [rbp + 0x798]
lea r8, str.onecore_amcoreoctagon_broker_sourcelib_assists.cpp
mov r9d, ebx
call fcn.140002e14
jmp 0x14001cc59
mov rax, qword [rsp + 0x60]
jmp 0x14001cc13
mov eax, dword [rsp + 0x60]
mov qword [rdi + 0x208], rax
jmp 0x14001cc57
mov eax, dword [rsp + 0x30]
lea rdx, [rsp + 0x60]
cmp eax, esi
mov ecx, 0x7ff
cmova eax, ecx
lea rcx, [rdi + 0x210]
mov r8d, eax
mov ebx, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
sub rsi, rbx
lea rcx, [rdi + 0x210]
add rcx, rbx
mov r8, rsi
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001cc69
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.1400281d0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret