Function at 0x5391e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
sub rsp, 0x1d8
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax - 8], rdi
mov qword [rax - 0x10], r12
mov qword [rax - 0x18], r13
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], r15
mov rax, qword [0x006443a8]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
mov rbx, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rcx
mov byte [rcx], 0
lea r14, [rcx + 8]
mov rcx, r14
call fcn.00497640
mov qword [r14 + 8], rax
mov byte [rax + 0x49], 1
mov rax, qword [r14 + 8]
mov qword [rax + 8], rax
mov rax, qword [r14 + 8]
mov qword [rax], rax
mov rax, qword [r14 + 8]
mov qword [rax + 0x10], rax
xor r13d, r13d
mov qword [r14 + 0x10], r13
call fcn.004e1770
mov rcx, rax
call fcn.004dc210
cmp eax, 0x10e10004
jne 0x5395dc
call fcn.004e1770
mov rcx, rax
call fcn.004dc230
cmp dword [rax], 5
jb 0x5395dc
mov dword [rsp + 0x30], r13d
lea rcx, [rsp + 0x190]
mov rax, qword [str.Counter_009]
mov qword [rcx], rax
mov rax, qword [0x005e8f88]
mov qword [rcx + 8], rax
mov rax, qword [0x005e8f90]
mov qword [rcx + 0x10], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x190]
mov rcx, 0xffffffff80000004
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x53935c
mov ecx, dword [0x00646640]
shr ecx, 3
test cl, 1
je 0x5395dc
lea rax, str._anonymous_namespace::LocalizedCounter::LocalizedCounter
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x78
lea r9, str..UmResourceWin.cpp
lea edx, [r13 + 0x20]
lea r8d, [r13 + 8]
lea rcx, [rsp + 0x78]
call fcn.00475e14
nop
lea rdx, str.error_getting_required_buffer_size__error
mov rcx, rax
call fcn.00475a24
lea rcx, [rax + 0x30]
mov edx, edi
call fcn.00448cb0
nop
lea rcx, [rsp + 0x78]
call fcn.0047591c
jmp 0x5395dc
mov ecx, dword [rsp + 0x30]
shr rcx, 1
mov eax, 2
mul rcx
mov rsi, 0xffffffffffffffff
cmovo rax, rsi
mov rcx, rax
call fcn.0053ce20
mov r15, rax
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call fcn.0056a100
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x190]
mov rcx, 0xffffffff80000004
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x539435
mov eax, dword [0x00646640]
shr eax, 3
test al, 1
je 0x53941f
lea rax, str._anonymous_namespace::LocalizedCounter::LocalizedCounter
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x82
lea r9, str..UmResourceWin.cpp
lea edx, [rsi + 0x21]
lea r8d, [rsi + 9]
lea rcx, [rsp + 0x78]
call fcn.00475e14
nop
lea rdx, str.error_reading_counters__error
mov rcx, rax
call fcn.00475a24
lea rcx, [rax + 0x30]
mov edx, edi
call fcn.00448cb0
nop
lea rcx, [rsp + 0x78]
call fcn.0047591c
test r15, r15
je 0x5395dc
mov rcx, r15
call fcn.005688d0
jmp 0x5395dc
mov dil, 1
mov ecx, dword [rsp + 0x30]
shr rcx, 1
mov eax, 2
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.0053ce20
mov r12, rax
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call fcn.0056a100
xor ebp, ebp
xor ecx, ecx
cmp dword [rsp + 0x30], ecx
jbe 0x5395c9
mov rsi, r15
movabs r9, 0x7ffffffffffffffe
movzx eax, word [rsi]
mov word [r12 + rcx*2], ax
add rcx, 1
cmp word [rsi], 0
jne 0x5395b1
test dil, dil
je 0x5394ae
mov rcx, r12
call fcn.005735d0
mov r13, rax
xor dil, dil
jmp 0x539591
mov edx, 7
mov qword [rsp + 0x58], rdx
xor r8d, r8d
mov qword [rsp + 0x50], r8
mov word [rsp + 0x40], r8w
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbx, rcx
cmp rcx, r9
jbe 0x5394f3
call fcn.0053cc80
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
cmp rdx, rbx
jae 0x53950c
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.005118a0
mov rdx, qword [rsp + 0x58]
jmp 0x53952a
test rbx, rbx
jne 0x53952a
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x40]
cmp rdx, 8
cmovae rax, qword [rsp + 0x40]
mov word [rax], bx
jmp 0x53956c
test rbx, rbx
je 0x53956c
lea rcx, [rsp + 0x40]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x40]
lea rdi, [rbx + rbx]
add rdx, rdx
mov r9, rdi
mov r8, r12
call fcn.00568a50
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rax, qword [rsp + 0x40]
mov word [rdi + rax], 0
lea rdx, [rsp + 0x38]
mov rcx, r14
call fcn.00535fc0
mov qword [rax], r13
cmp qword [rsp + 0x58], 8
jb 0x53958e
mov rcx, qword [rsp + 0x40]
call fcn.00568830
mov dil, 1
mov edx, dword [rsp + 0x30]
lea eax, [rdx - 2]
cmp ebp, eax
jae 0x5395a3
cmp word [rsi + 2], 0
je 0x5395c4
xor ecx, ecx
movabs r9, 0x7ffffffffffffffe
jmp 0x5395b5
mov edx, dword [rsp + 0x30]
add ebp, 1
add rsi, 2
cmp ebp, edx
jb 0x539480
mov rbx, qword [rsp + 0x60]
mov rcx, r12
call fcn.005688d0
mov rcx, r15
call fcn.005688d0
mov byte [rbx], 1
mov rax, rbx
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.00568fb0
mov rbx, qword [rsp + 0x1e8]
mov rbp, qword [rsp + 0x1f0]
mov rsi, qword [rsp + 0x1f8]
mov rdi, qword [rsp + 0x1d0]
mov r12, qword [rsp + 0x1c8]
mov r13, qword [rsp + 0x1c0]
mov r14, qword [rsp + 0x1b8]
mov r15, qword [rsp + 0x1b0]
add rsp, 0x1d8
ret