Function at 0x14005f5ac
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xe0
mov rax, qword [0x1400b8288]
xor rax, rsp
mov qword [rbp + 7], rax
mov rax, qword [rbp + 0x7f]
mov rbx, rcx
mov r12, qword [rbp + 0x77]
xor ecx, ecx
mov rsi, r8
mov dword [rbp - 0x61], ecx
mov qword [rbp - 0x79], rcx
mov edi, ecx
mov qword [rbp - 0x59], rcx
xor edx, edx
lea r8d, [rcx + 0x40]
mov dword [rbp - 0x6d], ecx
mov dword [rsp + 0x44], ecx
mov r14, r9
mov dword [rsp + 0x48], ecx
mov dword [rbp - 0x69], ecx
lea rcx, [rbp - 0x39]
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], rax
call sub.msvcrt.dll_memset
xor r8d, r8d
mov dword [rbp - 0x71], r8d
mov r13d, r8d
mov dword [rsp + 0x40], r8d
mov r15d, r8d
test rsi, rsi
je 0x14005fad5
test rbx, rbx
je 0x14005fad5
test r14, r14
je 0x14005f661
test r12, r12
je 0x14005f657
mov r12d, dword [r12]
mov dword [rbp - 0x69], r12d
cmp r12d, 2
jae 0x14005f661
mov ebx, 0x57
jmp 0x14005fb2d
lea rax, [rbp - 0x79]
mov r12d, 0x20019
mov r9d, r12d
mov qword [rsp + 0x20], rax
lea rdx, str.ControlMUIUILanguages
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
xor r8d, r8d
mov ebx, eax
test eax, eax
je 0x14005f69b
mov qword [rbp - 0x79], r8
jmp 0x14005faef
mov rcx, qword [rbp - 0x79]
lea rax, [rbp - 0x59]
mov r9d, r12d
mov qword [rsp + 0x20], rax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14005fada
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rax, qword [rbp - 0x59]
lea edx, [rbx + 1]
xor r8d, r8d
mov qword [rbp - 0x79], rax
mov qword [rbp - 0x59], r8
mov dword [rbp - 0x65], edx
mov r9d, 0x7fffffff
test rsi, rsi
je 0x14005f733
mov eax, r9d
mov rcx, rsi
cmp word [rcx], r8w
je 0x14005f70a
add rcx, 2
sub rax, 1
jne 0x14005f6fa
test rax, rax
je 0x14005f733
mov rcx, r9
lea r12, [rsi + 2]
sub rcx, rax
add rcx, rcx
neg rax
sbb rax, rax
and rax, rcx
add r12, rax
je 0x14005f736
cmp r8w, word [r12]
jne 0x14005f73d
jmp 0x14005f736
mov r12, r8
mov dword [rbp - 0x71], 1
mov eax, edx
sub eax, 1
je 0x14005f96b
sub eax, 1
je 0x14005f7f9
cmp eax, 1
jne 0x14005face
test byte [rbp - 0x6d], 2
je 0x14005face
mov rbx, r15
test r15, r15
je 0x14005face
cmp r8w, word [rbx]
je 0x14005face
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
xor r8d, r8d
test eax, eax
je 0x14005f7d3
mov r9d, 0x7fffffff
mov rcx, rbx
mov eax, r9d
cmp word [rcx], r8w
je 0x14005f7af
add rcx, 2
sub rax, 1
jne 0x14005f79f
test rax, rax
je 0x14005face
mov rcx, r9
sub rcx, rax
add rcx, rcx
neg rax
sbb rax, rax
add rbx, 2
and rax, rcx
add rbx, rax
jne 0x14005f770
test rbx, rbx
je 0x14005face
cmp r8w, word [rbx]
je 0x14005face
test r14, r14
je 0x14005f7ef
and dword [r14], 0
mov edi, 2
jmp 0x14005f9c3
test byte [rbp - 0x6d], 6
je 0x14005face
test r15, r15
je 0x14005f82e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor r8d, r8d
mov r15d, r8d
mov rcx, qword [rbp - 0x79]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], r8
mov rdx, rsi
mov dword [rsp + 0x40], r8d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14005face
cmp dword [rsp + 0x44], 7
jne 0x14005face
lea r15d, [rax + 4]
cmp dword [rsp + 0x40], r15d
ja 0x14005f8c8
mov dword [rsp + 0x40], r15d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, r15d
lea edx, [rbx + 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x14005fada
mov r8d, dword [rsp + 0x40]
lea rdx, [0x14009fd54]
mov rcx, rax
call sub.msvcrt.dll_memcpy
xor r8d, r8d
jmp 0x14005f934
mov ebx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebx
mov ebx, 8
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
xor r8d, r8d
mov r15, rax
test rax, rax
je 0x14005fada
mov rcx, qword [rbp - 0x79]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
mov rdx, rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
xor r8d, r8d
mov ebx, eax
test eax, eax
jne 0x14005fada
mov ebx, dword [rsp + 0x40]
shr ebx, 1
mov eax, ebx
mov dword [rsp + 0x40], ebx
cmp dword [rbp - 0x71], r8d
je 0x14005f9c3
cmp eax, dword [rbp - 0x69]
jbe 0x14005f953
mov r13d, 1
jmp 0x14005f967
mov r8d, ebx
mov rdx, r15
add r8, r8
mov rcx, r14
call sub.msvcrt.dll_memcpy
xor r8d, r8d
mov edi, ebx
jmp 0x14005f9c3
mov rcx, qword [rbp - 0x79]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rbp - 0x6d]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Type
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
xor r8d, r8d
mov ebx, eax
test eax, eax
jne 0x14005fada
cmp dword [rsp + 0x44], 4
jne 0x14005face
cmp dword [rbp - 0x71], r8d
jne 0x14005f9dd
mov edx, dword [rbp - 0x65]
mov rsi, r12
inc edx
mov dword [rbp - 0x65], edx
cmp dword [rbp - 0x71], r8d
jne 0x14005fa98
jmp 0x14005f6e9
mov r12d, dword [rbp - 0x69]
mov esi, r8d
mov rcx, qword [rbp - 0x79]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x48]
mov qword [rsp + 0x30], r8
mov edx, esi
mov qword [rsp + 0x28], rax
inc esi
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x39]
mov dword [rsp + 0x48], 0x20
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
nop dword [rax + rax]
xor r8d, r8d
test eax, eax
jne 0x14005fa60
cmp dword [rsp + 0x44], 7
jne 0x14005f9e4
mov eax, dword [rsp + 0x48]
inc eax
lea ebx, [rax + rdi]
cmp ebx, r12d
jb 0x14005fa44
lea r13d, [r8 + 1]
jmp 0x14005fa5c
mov r8d, eax
lea rdx, [rbp - 0x39]
mov eax, edi
add r8, r8
lea rcx, [r14 + rax*2]
call sub.msvcrt.dll_memcpy
xor r8d, r8d
mov edi, ebx
jmp 0x14005f9e4
cmp eax, 0x103
jne 0x14005face
test r13d, r13d
jne 0x14005fa89
cmp edi, r12d
jae 0x14005fa83
mov eax, edi
mov word [r14 + rax*2], r8w
test edi, edi
jne 0x14005fa89
mov word [r14 + 2], r8w
jmp 0x14005fa89
mov r13d, 1
mov eax, edi
lea ecx, [rdi + 1]
test eax, eax
mov edi, 2
cmovne edi, ecx
mov rax, qword [rbp - 0x51]
test rax, rax
je 0x14005faa3
mov dword [rax], edi
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x14005fab1
mov eax, dword [rbp - 0x6d]
mov dword [rcx], eax
test r13d, r13d
je 0x14005fac2
test r14, r14
je 0x14005fac2
mov ebx, 0x7a
jmp 0x14005fada
mov dword [rbp - 0x61], 1
mov ebx, r8d
jmp 0x14005fada
mov ebx, 0x32
jmp 0x14005fada
mov ebx, 0x57
mov rcx, qword [rbp - 0x79]
test rcx, rcx
je 0x14005faef
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x14005fb04
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test r15, r15
je 0x14005fb29
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test ebx, ebx
je 0x14005fb4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14005fb4b
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, dword [rbp - 0x61]
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.140096bd0
mov rbx, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret