Function at 0x140019f20
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
lea rax, [0x14002a04e]
mov qword [rsp + 0x40], rax
lea rax, [0x14002a07a]
mov qword [rsp + 0x48], rax
mov word [rsp + 0x50], 0
mov dword [rsp + 0x58], 1
lea rcx, [rsp + 0x88]
lea rdx, [rsp + 0x40]
call fcn.14001a700
add rdi, rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x50], 0
mov dword [rsp + 0x58], 1
lea rcx, [rsp + 0xa0]
lea rdi, [rsp + 0x40]
mov rdx, rdi
call fcn.14001a700
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], rdi
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001a03c
movabs rax, 0x8000000000000000
mov qword [rsi], rax
cmp qword [rsp + 0xa0], 0
je 0x14001a005
mov r8, qword [rsp + 0xa8]
mov rcx, qword [0x14002e0f0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x88], 0
je 0x14001a027
mov r8, qword [rsp + 0x90]
mov rcx, qword [0x14002e0f0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x80], rsi
mov rdi, qword [rsp + 0x40]
mov dword [rsp + 0x64], 0x800
movzx eax, byte [0x14002e118]
mov edx, 0x800
xor ecx, ecx
call fcn.140017130
test rax, rax
je 0x14001a480
mov rsi, rax
mov qword [rsp + 0x68], 0x800
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0
mov r15, qword [rsp + 0xa8]
lea rbx, [rsp + 0x64]
mov r14, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea r12, [rsp + 0x40]
mov rbp, qword [sym.imp.oleaut32.dll_GetErrorInfo]
jmp 0x14001a0b5
mov rsi, qword [rsp + 0x70]
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, r15
xor r8d, r8d
lea r9, [rsp + 0x3c]
call r14
test eax, eax
je 0x14001a159
movzx r13d, ax
or r13d, 0x80070000
test eax, eax
cmovle r13d, eax
mov qword [rsp + 0x40], 0
xor ecx, ecx
mov rdx, r12
call rbp
mov rcx, qword [rsp + 0x40]
cmp r13d, 0x800700ea
jne 0x14001a3f2
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x78], rdx
mov r8d, dword [rsp + 0x64]
test r8, r8
jne 0x14001a130
test rcx, rcx
je 0x14001a0b0
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14001a0b0
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rsi, rcx
lea rcx, [rsp + 0x68]
call fcn.1400214a0
mov rcx, rsi
test rcx, rcx
jne 0x14001a128
jmp 0x14001a0b0
mov eax, dword [rsp + 0x64]
mov qword [rsp + 0x78], rax
mov r8d, eax
shr r8d, 1
mov ebp, eax
and ebp, 0xfffffffe
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x50], 0
shr eax, 2
sub r8, rax
jne 0x14001a460
add rbp, rsi
xor r15d, r15d
lea r12, [rsp + 0x40]
mov rbx, rsi
test r15b, 1
jne 0x14001a2a0
nop dword [rax]
cmp rbx, rbp
je 0x14001a3c3
movzx eax, word [rbx]
add rbx, 2
mov ecx, eax
and ecx, 0xf800
cmp ecx, 0xd800
jne 0x14001a2b7
movzx ecx, ax
cmp ecx, 0xdbff
ja 0x14001a206
cmp rbx, rbp
je 0x14001a206
movzx ecx, word [rbx]
add rbx, 2
mov edx, ecx
add edx, 0x2000
movzx edx, dx
mov r15b, 1
cmp edx, 0xfbff
ja 0x14001a21c
mov r14d, ecx
jmp 0x14001a209
xor r15d, r15d
mov dword [rsp + 0x3c], 0
mov r13d, 0xfffd
jmp 0x14001a323
movzx ecx, cx
and eax, 0x3ff
and ecx, 0x3ff
shl rax, 0x1a
movabs rdx, 0x100000000
add rax, rdx
shl ecx, 0x10
or rcx, rax
mov r13, rcx
shr r13, 0x10
mov dword [rsp + 0x3c], 0
shr rax, 0x20
je 0x14001a320
mov rax, rcx
shr rax, 0x22
or al, 0xf0
mov byte [rsp + 0x3c], al
mov rax, rcx
shr rax, 0x1c
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x3d], al
shr ecx, 0x16
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x3e], cl
xor r15d, r15d
lea rax, [rsp + 0x3f]
lea r12, [rsp + 0x40]
jmp 0x14001a347
mov eax, r14d
mov ecx, eax
and ecx, 0xf800
cmp ecx, 0xd800
je 0x14001a1d4
movzx r13d, ax
shl eax, 0x10
cmp eax, 0x800000
jae 0x14001a2f9
mov r15, qword [rsp + 0x50]
cmp r15, qword [rsp + 0x40]
jne 0x14001a2d9
mov rcx, r12
call fcn.14001af20
mov rax, qword [rsp + 0x48]
mov byte [rax + r15], r13b
inc r15
mov qword [rsp + 0x50], r15
xor r15d, r15d
test r15b, 1
je 0x14001a1b0
jmp 0x14001a2a0
mov dword [rsp + 0x3c], 0
cmp eax, 0x8000000
jae 0x14001a320
shr eax, 0x16
or al, 0xc0
mov byte [rsp + 0x3c], al
xor r15d, r15d
lea rax, [rsp + 0x3d]
lea r12, [rsp + 0x3e]
jmp 0x14001a347
xor r15d, r15d
mov eax, r13d
shr eax, 0xc
or al, 0xe0
mov byte [rsp + 0x3c], al
mov eax, r13d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x3d], al
lea rax, [rsp + 0x3e]
lea r12, [rsp + 0x3f]
and r13b, 0x3f
or r13b, 0x80
mov byte [rax], r13b
lea rax, [rsp + 0x3c]
sub r12, rax
mov rax, qword [rsp + 0x40]
mov r13, qword [rsp + 0x50]
sub rax, r13
cmp rax, r12
jb 0x14001a39d
mov rcx, qword [rsp + 0x48]
add rcx, r13
lea rdx, [rsp + 0x3c]
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
add r13, r12
mov qword [rsp + 0x50], r13
lea r12, [rsp + 0x40]
test r15b, 1
je 0x14001a1b0
jmp 0x14001a2a0
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rsp + 0x40]
mov rdx, r13
mov r8, r12
call fcn.1400214a0
mov r13, qword [rsp + 0x50]
jmp 0x14001a36c
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x50]
nop word cs:[rax + rax]
mov rdx, r8
sub r8, 1
jb 0x14001a414
cmp byte [rcx + rdx - 1], 0
je 0x14001a3e0
jmp 0x14001a416
movabs rax, 0x8000000000000000
mov rdx, qword [rsp + 0x80]
mov qword [rdx], rax
test rcx, rcx
je 0x14001a429
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14001a429
xor edx, edx
mov r8, qword [rsp + 0x80]
mov qword [r8], rax
mov qword [r8 + 8], rcx
mov qword [r8 + 0x10], rdx
cmp qword [rsp + 0x68], 0
je 0x14001a443
mov rcx, qword [0x14002e0f0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsp + 0xa0], 0
jne 0x140019fee
jmp 0x14001a005
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0x40]
mov r9d, 1
xor edx, edx
call fcn.1400214a0
jmp 0x14001a194
ud2