Function at 0x14001bb20
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor r13d, r13d
lea rax, [rbp + 0x48]
mov qword [r11 - 0x50], r13
mov r15, r8
mov qword [r11 - 0x58], r13
mov r12, rdx
mov qword [r11 - 0x60], r13
xor r9d, r9d
mov qword [r11 - 0x68], r13
xor r8d, r8d
mov qword [r11 - 0x70], r13
xor edx, edx
mov qword [r11 - 0x78], r13
mov r14, rcx
mov qword [r11 - 0x80], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x20], r13d
mov dword [rbp + 0x48], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
test eax, eax
je 0x14001bb9e
xor eax, eax
jmp 0x14001bd45
or r8, 0xffffffffffffffff
mov rcx, r8
inc rcx
cmp word [r12 + rcx*2], r13w
jne 0x14001bba5
mov eax, dword [rbp + 0x48]
cmp ecx, eax
mov dword [rbp - 0x1c], ecx
cmova eax, ecx
inc dword [rbp - 0x20]
add eax, 5
mov ecx, eax
mov dword [rbp + 0x48], eax
mov eax, 2
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400014a0
mov rsi, rax
test rax, rax
jne 0x14001bbf2
lea ecx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
jmp 0x14001bb97
mov qword [rbp - 0x10], r13
mov edi, r13d
mov edx, dword [rbp + 0x48]
lea r8, str._s_lu
mov r9, r12
mov dword [rsp + 0x20], edi
mov rcx, rsi
call fcn.140010e44
lea rax, [rbp - 0x10]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001bcf3
test r15, r15
je 0x14001bcc9
mov ecx, 0x208
call fcn.1400014a0
mov rbx, rax
test rax, rax
je 0x14001bcc9
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
mov dword [rbp - 0x18], 1
mov dword [rbp - 0x1c], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001bcc1
cmp dword [rbp - 0x18], 1
jne 0x14001bcc1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r13w
jne 0x14001bc9c
test rax, rax
je 0x14001bcc1
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x14001bce9
mov rcx, rbx
call fcn.140001454
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
inc edi
mov qword [rbp - 0x10], r13
cmp edi, dword [rbp - 0x20]
ja 0x14001bd39
jmp 0x14001bbf9
mov rcx, rbx
call fcn.140001454
jmp 0x14001bd39
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov rdx, rsi
mov rcx, r14
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x10]
test eax, eax
cmovne rcx, r13
mov qword [rbp - 0x10], rcx
mov rcx, rsi
call fcn.140001454
mov rax, qword [rbp - 0x10]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret