Function at 0x14001fe04
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x770]
sub rsp, 0x870
mov rax, qword [0x14004ba88]
xor rax, rsp
mov qword [rbp + 0x760], rax
and qword [rsp + 0x38], 0
mov rdi, rcx
mov edx, dword [rcx]
sub edx, 1
je 0x14001fe8d
sub edx, 1
je 0x14001fe84
sub edx, 1
je 0x14001fe7b
sub edx, 1
je 0x14001fe72
cmp edx, 1
je 0x14001fe69
mov ebx, 0x80070057
mov edx, 0x6b9
jmp 0x14001ffba
mov rcx, 0xffffffff80000003
jmp 0x14001fe94
mov rcx, 0xffffffff80000002
jmp 0x14001fe94
mov rcx, 0xffffffff80000001
jmp 0x14001fe94
mov rcx, 0xffffffff80000005
jmp 0x14001fe94
mov rcx, 0xffffffff80000000
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x40], rax
lea rdx, [rdi + 4]
lea rax, [rsp + 0x48]
mov byte [rsp + 0x50], 1
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
nop dword [rax + rax]
cmp byte [rsp + 0x50], 0
mov r14d, eax
je 0x14001ff16
mov rsi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov r15, qword [rsi]
test r15, r15
je 0x14001ff13
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, r15
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov qword [rsi], r12
test r14d, r14d
je 0x14001ff25
mov r9d, r14d
mov edx, 0x6c7
jmp 0x14001ff7d
mov esi, 0x800
lea rcx, [rsp + 0x60]
mov r8d, esi
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + 0x104]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], esi
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
nop dword [rax + rax]
test eax, eax
je 0x14001ff97
mov r9d, eax
mov edx, 0x6d3
mov rcx, qword [rbp + 0x798]
lea r8, str.onecore_amcoreoctagon_broker_sourcelib_assists.cpp
call fcn.140018b4c
mov ebx, eax
jmp 0x140020023
mov eax, dword [rsp + 0x34]
mov dword [rdi + 0x204], eax
sub eax, 1
je 0x14001ffe6
sub eax, 3
je 0x14001ffd9
cmp eax, 7
je 0x14001ffd2
mov ebx, 0x80004005
mov edx, 0x6e5
mov rcx, qword [rbp + 0x798]
lea r8, str.onecore_amcoreoctagon_broker_sourcelib_assists.cpp
mov r9d, ebx
call fcn.140005170
jmp 0x140020023
mov rax, qword [rsp + 0x60]
jmp 0x14001ffdd
mov eax, dword [rsp + 0x60]
mov qword [rdi + 0x208], rax
jmp 0x140020021
mov eax, dword [rsp + 0x30]
lea rdx, [rsp + 0x60]
cmp eax, esi
mov ecx, 0x7ff
cmova eax, ecx
lea rcx, [rdi + 0x210]
mov r8d, eax
mov ebx, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
sub rsi, rbx
lea rcx, [rdi + 0x210]
add rcx, rbx
mov r8, rsi
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140020039
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.140034200
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret