Function at 0x14005938e
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push r15
mov rax, 0xd
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x1400593ab
sub rsp, 0x28
mov rax, qword [rsp + 0xc0]
mov qword [0x14004ea60], rax
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.14000b570
add rsp, 0x10
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.14000b570
add rsp, 0x10
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x38]
sub rsp, 0x10
call fcn.14000b570
add rsp, 0x10
mov dword [0x14004d924], 0
movabs rdx, 0x14004a028
lea rcx, [rsp + 0x68]
call fcn.14000b5e0
push qword [0x14004ea60]
sub rsp, 8
push qword [0x14004ea60]
push 1
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140009bd0
add rsp, 0x28
add qword [0x14004ea60], 2
movabs rcx, 0x14004a2f8
pop rdx
mov qword [0x14004ea60], rdx
add rdx, qword [0x14004ea58]
call fcn.14000b6b0
or rax, rax
je 0x1400594e0
push qword [0x14004ea60]
sub rsp, 8
push qword [0x14004ea60]
sub rsp, 8
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.140009c70
add rsp, 0x28
mov r15, rax
dec r15
mov rax, r15
push rax
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14000a080
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.14000b410
push qword [0x14004ea60]
sub rsp, 8
push qword [0x14004ea60]
push 1
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14000a080
add rsp, 0x28
add qword [0x14004ea60], 2
movabs rcx, 0x14004a2f8
pop rdx
mov qword [0x14004ea60], rdx
add rdx, qword [0x14004ea58]
call fcn.14000b6b0
or rax, rax
je 0x140059585
push qword [0x14004ea60]
sub rsp, 8
push qword [0x14004ea60]
sub rsp, 8
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.140009c70
add rsp, 0x28
mov r15, rax
dec r15
mov rax, r15
push rax
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140009bd0
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.14000b410
push qword [rsp + 0x38]
movabs rcx, 0x14004a028
pop rdx
call fcn.14000b6b0
or rax, rax
je 0x1400595e1
sub rsp, 8
lea rax, [rsp + 0x48]
mov rax, rax
push rax
push 0xf003f
push 0
push qword [rsp + 0x48]
push qword [rsp + 0xc8]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.dll_RegOpenKeyExW
add rsp, 0x30
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x50], eax
jmp 0x1400596ba
lea rax, [rsp + 0x48]
mov rax, rax
push rax
push qword [rsp + 0xa8]
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_RegConnectRegistryW
movsxd rax, eax
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x50], eax
movsxd r15, dword [rsp + 0x50]
and r15, r15
je 0x14005967a
movsxd rax, dword [rsp + 0x50]
push rax
pop rax
mov dword [0x14004d924], eax
push qword [0x14004ea60]
push qword [0x14004ea60]
movsxd rax, dword [0x14004d924]
push rax
pop rcx
sub rsp, 0x20
call fcn.140055bb8
add rsp, 0x28
lea rcx, [0x14004d750]
pop rdx
call fcn.14000b410
movabs rcx, 0x14004a028
push qword [0x14004ea60]
sub rsp, 0x28
call fcn.14000b500
add rsp, 0x28
pop rax
add rax, qword [0x14004ea58]
jmp 0x140059a09
sub rsp, 8
lea rax, [rsp + 0x48]
mov rax, rax
push rax
push 0xf003f
push 0
push qword [rsp + 0x48]
movsxd rax, dword [rsp + 0x70]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.dll_RegOpenKeyExW
add rsp, 0x30
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x50], eax
movsxd r15, dword [rsp + 0x50]
and r15, r15
jne 0x140059973
lea rax, [rsp + 0x78]
mov rax, rax
push rax
push 0
lea rax, [rsp + 0x80]
mov rax, rax
push rax
push 0
push qword [rsp + 0x50]
movsxd rax, dword [rsp + 0x68]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x50], eax
movsxd r15, dword [rsp + 0x50]
and r15, r15
jne 0x140059935
movsxd rax, dword [rsp + 0x70]
push rax
mov r15, 1
cmp r15d, dword [rsp]
jne 0x140059814
sub rsp, 8
movsxd rax, dword [rsp + 0x88]
mov rax, rax
push rax
pop rcx
sub rsp, 0x20
call fcn.14000b070
add rsp, 0x28
mov qword [rsp + 0x68], rax
sub rsp, 8
lea rax, [rsp + 0x88]
mov rax, rax
push rax
push qword [rsp + 0x78]
push 0
push 0
push qword [rsp + 0x60]
movsxd rax, dword [rsp + 0x78]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x38
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x58], eax
movsxd r15, dword [rsp + 0x58]
and r15, r15
jne 0x1400597f3
push qword [0x14004ea60]
push qword [0x14004ea60]
push qword [rsp + 0x78]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000b120
add rsp, 0x20
lea rcx, [rsp + 0x78]
pop rdx
sub rsp, 0x28
call fcn.14000b410
add rsp, 0x28
sub rsp, 8
push qword [rsp + 0x70]
pop rcx
sub rsp, 0x20
call fcn.14000b0c0
add rsp, 0x28
jmp 0x14005980f
movabs rdx, 0x14004a028
lea rcx, [rsp + 0x70]
sub rsp, 0x28
call fcn.14000b5e0
add rsp, 0x28
jmp 0x1400598da
mov r15, 4
cmp r15d, dword [rsp]
jne 0x1400598da
sub rsp, 8
lea rax, [rsp + 0x88]
mov rax, rax
push rax
lea rax, [rsp + 0x98]
mov rax, rax
push rax
lea rax, [rsp + 0x90]
mov rax, rax
push rax
push 0
push qword [rsp + 0x60]
movsxd rax, dword [rsp + 0x78]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x38
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x58], eax
movsxd r15, dword [rsp + 0x58]
and r15, r15
jne 0x1400598be
push qword [0x14004ea60]
push qword [0x14004ea60]
movsxd rax, dword [rsp + 0x98]
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000a120
add rsp, 0x20
lea rcx, [rsp + 0x78]
pop rdx
sub rsp, 0x28
call fcn.14000b410
add rsp, 0x28
jmp 0x1400598da
movabs rdx, 0x14004a028
lea rcx, [rsp + 0x70]
sub rsp, 0x28
call fcn.14000b5e0
add rsp, 0x28
pop rax
movsxd r15, dword [rsp + 0x50]
and r15, r15
jne 0x1400598ef
mov dword [rsp + 0x58], 1
jmp 0x140059933
movsxd rax, dword [rsp + 0x50]
push rax
pop rax
mov dword [0x14004d924], eax
push qword [0x14004ea60]
push qword [0x14004ea60]
movsxd rax, dword [0x14004d924]
push rax
pop rcx
sub rsp, 0x20
call fcn.140055bb8
add rsp, 0x28
lea rcx, [0x14004d750]
pop rdx
call fcn.14000b410
mov dword [rsp + 0x58], 0
jmp 0x140059971
movsxd rax, dword [rsp + 0x50]
push rax
pop rax
mov dword [0x14004d924], eax
push qword [0x14004ea60]
push qword [0x14004ea60]
movsxd rax, dword [0x14004d924]
push rax
pop rcx
sub rsp, 0x20
call fcn.140055bb8
add rsp, 0x28
lea rcx, [0x14004d750]
pop rdx
call fcn.14000b410
jmp 0x1400599af
movsxd rax, dword [rsp + 0x50]
push rax
pop rax
mov dword [0x14004d924], eax
push qword [0x14004ea60]
push qword [0x14004ea60]
movsxd rax, dword [0x14004d924]
push rax
pop rcx
sub rsp, 0x20
call fcn.140055bb8
add rsp, 0x28
lea rcx, [0x14004d750]
pop rdx
call fcn.14000b410
movsxd rax, dword [rsp + 0x40]
mov rax, rax
push rax
pop rcx
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [rsp + 0x48], 0
je 0x1400599d4
movsxd rax, dword [rsp + 0x48]
mov rax, rax
push rax
pop rcx
call sub.ADVAPI32.dll_RegCloseKey
mov rcx, qword [rsp + 0x68]
push qword [0x14004ea60]
sub rsp, 0x28
call fcn.14000b500
add rsp, 0x28
pop rax
add rax, qword [0x14004ea58]
jmp 0x140059a09
push rax
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.14000b690
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.14000b690
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.14000b690
add rsp, 0x28
mov rcx, qword [rsp + 0x70]
sub rsp, 0x28
call fcn.14000b690
add rsp, 0x28
pop rax
add rsp, 0x90
pop r15
ret