Function at 0x14000cc00
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov r14, r8
mov rbx, rdx
xor r15d, r15d
mov dword [r11 + 0x10], r15d
lea rsi, [rcx + 8]
lea rax, [r11 + 0x10]
mov qword [r11 - 0x70], rax
mov qword [r11 - 0x78], r15
lea r9, [r11 + 0x20]
xor r8d, r8d
mov rdx, qword [rdx]
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ce41
cmp dword [rsp + 0xb8], 7
jne 0x14000ce41
mov eax, dword [rsp + 0xa8]
shr eax, 1
mov dword [rsp + 0x30], eax
je 0x14000ce3d
mov edx, eax
lea r8, [rsp + 0xa0]
lea rcx, [rsp + 0x48]
call fcn.14000ca20
nop
lea r9, [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.14000d150
mov rsi, rdi
mov rbp, qword [r14 + 8]
mov rbx, qword [r14]
cmp rbx, rbp
je 0x14000cce3
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000ccd2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
add rbx, 8
cmp rbx, rbp
jne 0x14000ccb3
mov rbx, qword [r14]
mov rdi, qword [rsp + 0x48]
mov qword [r14 + 8], rbx
cmp word [rdi], 0
je 0x14000ce06
mov ecx, dword [0x140031a50]
mov rax, qword gs:[0x58]
mov edx, 4
mov rbx, qword [rax + rcx*8]
add rbx, rdx
lea rbp, vtable.ATL::CWin32Heap.0
lea r12, vtable.ATL::CAtlStringMgr.0
lea r13, [0x140031508]
lea rdi, [0x140031528]
nop dword [rax + rax]
mov eax, dword [rbx]
cmp dword [0x140031520], eax
jg 0x14000ce61
mov eax, dword [rbx]
cmp dword [0x140031558], eax
jg 0x14000ceb2
mov rcx, rdi
mov rax, qword [0x140031528]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
test rsi, 0xffffffffffff0000
jne 0x14000cd7a
movzx edx, si
lea rcx, [rsp + 0x38]
call fcn.140004380
jmp 0x14000cd9c
mov rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], 0
jne 0x14000cd81
mov r8d, eax
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140004670
nop
mov rax, qword [r14 + 8]
cmp qword [r14 + 0x10], rax
je 0x14000cdba
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.14000c700
add qword [r14 + 8], 8
jmp 0x14000cdca
lea r8, [rsp + 0x38]
mov rdx, rax
mov rcx, r14
call fcn.1400037e0
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax - 0x10]
inc ecx
movsxd rdx, ecx
lea rsi, [rsi + rdx*2]
lea rdx, [rax - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000cdf7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
cmp word [rsi], 0
jne 0x14000cd30
mov rdi, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
sub rdx, rdi
sar rdx, 1
add rdx, rdx
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000ce35
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ce5b
mov rcx, rdi
call fcn.14000d244
mov al, 1
jmp 0x14000ce43
xor al, al
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14001194c
nop
lea rcx, [0x140031520]
call fcn.14000d6e8
cmp dword [0x140031520], 0xffffffff
jne 0x14000cd3e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [0x140031508], rbp
mov qword [0x140031510], rax
mov byte [0x140031518], 0
lea rcx, [0x140020810]
call fcn.14000d4e8
lea rcx, [0x140031520]
call fcn.14000d688
jmp 0x14000cd3e
lea rcx, [0x140031558]
call fcn.14000d6e8
cmp dword [0x140031558], 0xffffffff
jne 0x14000cd4c
mov qword [0x140031528], r12
mov qword [0x140031530], r13
mov dword [0x140031548], 2
mov qword [0x140031540], r15
mov dword [0x140031550], r15d
mov qword [0x140031538], rdi
lea rcx, [0x140020840]
call fcn.14000d4e8
lea rcx, [0x140031558]
call fcn.14000d688
jmp 0x14000cd4c