Function at 0x140059dd0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1400f2010]
xor rax, rsp
mov qword [rbp + 0x78], rax
mov rdi, r8
mov r14, rdx
mov r15, rcx
mov qword [rsp + 0x68], rcx
xor r12d, r12d
mov dword [rsp + 0x44], r12d
mov qword [rbp + 0x30], r12
mov eax, dword [rdx + 0x20]
cmp eax, 1
jne 0x140059e1e
mov esi, 0x20219
jmp 0x140059e2e
mov esi, 0x20019
mov ecx, 0x20119
cmp eax, 2
cmove esi, ecx
lea rcx, [rsp + 0x48]
call fcn.140006870
mov ebx, 2
mov dword [rsp + 0x44], ebx
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140059eaf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059eaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a17c
call fcn.140085050
test esi, esi
jne 0x14005a182
mov dword [rbp + 0x38], ebx
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
mov rcx, r12
mov qword [rbp + 0x50], rcx
nop dword [rax]
mov r8d, ebx
and r8d, 1
mov eax, ebx
shr rax, 1
add r8, rax
mov r9, qword [rbp + 0x48]
mov rax, r9
mov rdx, qword [rbp + 0x40]
sub rax, rdx
sar rax, 1
cmp r8, rax
jae 0x140059eff
lea rax, [rdx + r8*2]
mov qword [rbp + 0x48], rax
jmp 0x140059f39
jbe 0x140059f39
sub rcx, rdx
sar rcx, 1
cmp r8, rcx
jbe 0x140059f1d
lfence
mov rdx, r8
lea rcx, [rbp + 0x40]
call fcn.140057a80
jmp 0x140059f35
sub r8, rax
add r8, r8
lea rbx, [r9 + r8]
xor edx, edx
mov rcx, r9
call fcn.14008b8d0
mov qword [rbp + 0x48], rbx
mov rdx, qword [rbp + 0x40]
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x140059f46
mov r8, qword [rdi]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
xor edx, edx
lea r9d, [rdx + 0x20]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp eax, 0xea
jne 0x140059f7c
mov ebx, dword [rbp + 0x38]
mov rcx, qword [rbp + 0x50]
jmp 0x140059ed0
test eax, eax
jne 0x14005a1b8
mov ecx, dword [rbp + 0x38]
test cl, 1
jne 0x14005a1f1
mov edx, ecx
and edx, 1
mov eax, ecx
shr rax, 1
add rdx, rax
lea rcx, [rbp + 0x40]
call fcn.1400578b0
mov rdi, qword [rbp + 0x40]
mov rax, qword [rbp + 0x48]
cmp rdi, rax
je 0x14005a22a
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15], r12
mov qword [r15 + 8], r12
mov qword [r15 + 0x10], r12
mov r14d, 3
sub rax, rdi
sar rax, 1
lea rsi, [rdi + rax*2]
cmp rdi, rsi
je 0x14005a0fa
movzx ebx, byte [rsp + 0x40]
test rsi, rsi
je 0x14005a176
mov qword [rbp + 0x58], r12
mov rdx, r12
mov qword [rbp + 0x68], rdx
mov ecx, 7
mov qword [rbp + 0x70], rcx
mov word [rbp + 0x58], r12w
or r14d, 4
mov dword [rsp + 0x44], r14d
cmp rdi, rsi
je 0x14005a078
movzx r9d, word [rdi]
cmp r12w, r9w
je 0x14005a074
cmp rdx, rcx
jae 0x14005a054
lea rax, [rdx + 1]
mov qword [rbp + 0x68], rax
lea rax, [rbp + 0x58]
cmp rcx, 8
cmovae rax, qword [rbp + 0x58]
mov word [rax + rdx*2], r9w
mov word [rax + rdx*2 + 2], r12w
add rdi, 2
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x68]
jmp 0x14005a012
movzx r8d, bl
mov edx, 1
lea rcx, [rbp + 0x58]
call fcn.140007b80
add rdi, 2
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x68]
jmp 0x14005a012
add rdi, 2
test rdx, rdx
je 0x14005a0ad
mov rax, qword [r15 + 8]
cmp rax, qword [r15 + 0x10]
je 0x14005a09a
lea rdx, [rbp + 0x58]
mov rcx, rax
call fcn.140006870
add qword [r15 + 8], 0x20
jmp 0x14005a0a9
lea r8, [rbp + 0x58]
mov rdx, rax
mov rcx, r15
call fcn.14005ac70
mov rcx, qword [rbp + 0x70]
and r14d, 0xfffffffb
cmp rcx, 8
jb 0x14005a0ed
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a0e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a251
call fcn.140085050
cmp rdi, rsi
jne 0x140059fe7
mov rdi, qword [rbp + 0x40]
test rdi, rdi
je 0x14005a146
mov rax, qword [rbp + 0x50]
sub rax, rdi
sar rax, 1
lea rdx, [rax + rax]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14005a132
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a24b
mov rcx, rdi
call fcn.140085050
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r12
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14005a155
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, r15
mov rcx, qword [rbp + 0x78]
xor rcx, rsp
call fcn.140085030
add rsp, 0x180
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14003fb40
nop
call fcn.14008fffc
int3
mov r9, r14
mov r8d, esi
lea rdx, str.Failed_to_open_registry_key
lea rcx, [rbp - 0x30]
call fcn.140058920
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140002740
lea rdx, [0x1400eff08]
lea rcx, [rsp + 0x70]
call fcn.14008b7f4
nop
mov qword [rsp + 0x20], rdi
mov r9, r14
mov r8d, eax
lea rdx, str.Failed_to_query_registry_key
lea rcx, [rbp - 0x10]
call fcn.140058c00
nop
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140002740
lea rdx, [0x1400eff08]
lea rcx, [rbp - 0x78]
call fcn.14008b7f4
nop
mov qword [rsp + 0x20], rdi
mov r9, r14
xor r8d, r8d
lea rdx, str.Invalid_registry_value_data_length
lea rcx, [rbp + 0x10]
call fcn.140058c00
nop
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140002740
lea rdx, [0x1400eff08]
lea rcx, [rbp - 0x60]
call fcn.14008b7f4
nop
lea rdx, str.Multi_string_values_should_always_have_at_least_a_null_terminating_character
lea rcx, [rbp - 0x48]
call fcn.14000be60
lea rdx, [0x1400eff08]
lea rcx, [rbp - 0x48]
call fcn.14008b7f4
nop
call fcn.14008fffc
nop
call fcn.14008fffc
int3