Function at 0x14005b610
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0xa8
mov rax, qword [0x140325af8]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r14, qword [rsp + 0x100]
mov r13, rcx
mov ecx, 0x800
mov dword [rsp + 0x50], edx
mov rbp, r9
mov dword [rsp + 0x54], 0x800
mov rdi, r8
mov ebx, 0xc000000d
call fcn.1401ecd00
mov rsi, rax
test rax, rax
jne 0x14005b670
mov eax, 0xc000009a
jmp 0x14005b814
mov qword [rsp + 0xa0], r15
call fcn.1400159c0
mov qword [rsp + 0x38], r13
lea rcx, str.SearchForCert_Looking_in__ws
mov qword [rsp + 0x30], rcx
lea r15, str.MbCommonSigVerify
mov qword [rsp + 0x28], r15
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
mov r10, qword [rax]
lea rdx, str.SearchForCert
mov r9d, 0x6bc
mov dword [rsp + 0x20], 5
mov rcx, rax
call qword [r10 + 0x20]
lea rax, [rsp + 0x58]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r13
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14005b735
call fcn.1400159c0
mov dword [rsp + 0x40], ebx
lea rcx, str.Failed_to_open__ws____x
mov qword [rsp + 0x38], r13
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
mov qword [rsp + 0x30], rcx
lea rdx, str.SearchForCert
mov r10, qword [rax]
mov r9d, 0x6c2
mov qword [rsp + 0x28], r15
mov rcx, rax
mov dword [rsp + 0x20], 5
call qword [r10 + 0x20]
mov rcx, rsi
call fcn.1401e539c
jmp 0x14005b80a
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rdx, str.Blob
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x14005b7b0
mov rcx, rsi
call fcn.1401e539c
mov ecx, dword [rsp + 0x54]
call fcn.1401ecd00
mov rcx, qword [rsp + 0x58]
mov rsi, rax
test rax, rax
jne 0x14005b78e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xc000009a
jmp 0x14005b80c
lea rax, [rsp + 0x54]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, str.Blob
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005b7f7
mov r8d, dword [rsp + 0x54]
mov rcx, rsi
xor edx, edx
mov qword [rsp + 0xe8], r12
cmp dword [rcx], 0x20
je 0x14005b834
mov eax, dword [rcx + 8]
add rax, 0xc
add rcx, rax
lea rax, [rsi + r8]
cmp rcx, rax
ja 0x14005b7ef
cmp rcx, rsi
jb 0x14005b7ef
inc edx
cmp edx, 0xf
jl 0x14005b7c6
mov ebx, 0xc000000d
mov r12, qword [rsp + 0xe8]
mov rcx, rsi
call fcn.1401e539c
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov r15, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1401d9c30
add rsp, 0xa8
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r12d, dword [rcx + 8]
lea rbx, [rcx + 0xc]
test r12d, r12d
je 0x14005b7ea
cmp rbx, rsi
jb 0x14005b7ea
mov eax, esi
sub eax, ebx
add eax, r8d
cmp r12d, eax
ja 0x14005b7ea
mov ecx, 0x80
call fcn.1401ecd00
mov r15, rax
test rax, rax
je 0x14005bac4
xor edx, edx
mov r8d, 0x80
mov rcx, rax
call fcn.1401dbcd0
mov ecx, 0x568
call fcn.1401ecd00
mov rdi, rax
test rax, rax
je 0x14005bab2
call fcn.1400159c0
mov qword [rsp + 0x38], rdi
lea rcx, str.Allocate_Search_Certificate__p
mov qword [rsp + 0x30], rcx
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
lea rcx, str.MbCommonSigVerify
mov r9d, 0x6fa
mov r10, qword [rax]
lea rdx, str.SearchForCert
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov dword [rsp + 0x20], 5
call qword [r10 + 0x20]
xor eax, eax
xor edx, edx
mov r8d, 0x568
mov qword [rsp + 0x60], rax
mov rcx, rdi
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
call fcn.1401dbcd0
lea rax, [rsp + 0x60]
mov dword [r15 + 0xc], r12d
mov qword [r15 + 0x40], rax
mov qword [r15], rbx
mov dword [r15 + 8], r12d
mov qword [r15 + 0x20], rdi
call fcn.1400159c0
mov qword [rsp + 0x38], r13
lea rcx, str.Parsing_cert_at__ws
mov qword [rsp + 0x30], rcx
lea r12, str.MbCommonSigVerify
mov qword [rsp + 0x28], r12
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
mov r10, qword [rax]
lea rdx, str.SearchForCert
mov r9d, 0x702
mov dword [rsp + 0x20], 5
mov rcx, rax
call qword [r10 + 0x20]
lea rdx, [0x1400600e0]
mov rcx, r15
call fcn.14005dd00
mov ebx, eax
call fcn.1400159c0
mov dword [rsp + 0x38], ebx
lea rcx, str.Parser_returns__x
mov qword [rsp + 0x30], rcx
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
mov qword [rsp + 0x28], r12
lea rdx, str.SearchForCert
mov r10, qword [rax]
mov r9d, 0x704
mov rcx, rax
mov dword [rsp + 0x20], 5
call qword [r10 + 0x20]
mov eax, dword [rsp + 0x50]
cmp eax, 1
jne 0x14005ba2a
mov rdx, rdi
lea rcx, str.Searching_for_Root:
call fcn.140068ee0
lea rcx, [rbp + 0x288]
lea rdx, [rdi + 0x2b8]
call fcn.14005d9f0
test al, al
je 0x14005ba07
lea rcx, [rdi + 0x288]
lea rdx, [rdi + 0x2b8]
call fcn.14005d9f0
test al, al
jne 0x14005baa1
mov ebx, 0xc000000d
test rdi, rdi
je 0x14005bab7
mov rcx, rdi
call fcn.14005da70
mov rcx, r15
call fcn.1401e539c
jmp 0x14005b7ef
cmp eax, 3
jne 0x14005ba61
test ebx, ebx
jne 0x14005ba0c
lea rcx, [rbp + 0x288]
lea rdx, [rdi + 0x2b8]
call fcn.14005d9f0
test al, al
je 0x14005ba07
lea rcx, [rdi + 0x288]
lea rdx, [rdi + 0x2b8]
call fcn.14005d9f0
test al, al
jmp 0x14005ba9b
test ebx, ebx
jne 0x14005ba07
movzx eax, word [rbp + 0x250]
cmp word [rdi + 0x250], ax
jne 0x14005ba07
movzx r8d, ax
lea rdx, [rbp + 0x252]
lea rcx, [rdi + 0x252]
movzx ebx, ax
call fcn.1401db770
test eax, eax
jne 0x14005ba97
mov eax, ebx
jmp 0x14005ba99
xor eax, eax
cmp eax, ebx
jne 0x14005ba07
test r14, r14
je 0x14005baab
mov qword [r14], rdi
xor edi, edi
xor ebx, ebx
jmp 0x14005ba0c
mov ebx, 0xc000009a
mov rcx, r15
call fcn.1401e539c
jmp 0x14005b7ef
mov ebx, 0xc000009a
jmp 0x14005b7ef