Function at 0x140005008
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov eax, r9d
mov r13, rdx
mov r12, rcx
xor r9d, r9d
test r8d, r8d
je 0x140005039
mov word [rdx], r9w
mov r8d, r8d
add r8, r8
cmp rax, r8
jae 0x140005056
mov ecx, 0x48d3d3
call fcn.140002060
or eax, 0xffffffff
jmp 0x140005283
lea rsi, [0x140025f34]
lea r10, [0x14002f2b0]
or ebx, 0xffffffff
mov rdx, r12
mov cl, byte [rsi]
call fcn.140004d00
mov edi, eax
mov dword [rbp - 0x28], eax
cmp eax, 0xffffffff
je 0x14000526e
mov qword [rbp - 0x20], r10
and qword [rbp - 0x18], 0
mov rcx, r10
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
xor r8d, r8d
test eax, eax
jne 0x1400052f8
lea eax, [rbx + 2]
lock xadd dword [rbp - 0x18], eax
inc eax
cmp eax, 1
jne 0x1400050c1
cmp dword [rbp - 0x14], r8d
jne 0x14000531b
call qword [sym.imp.MSVCP140.dll__Thrd_id]
mov dword [rbp - 0x14], eax
xor r8d, r8d
mov r15d, r8d
cmp r15d, 4
jge 0x14000525b
mov r14b, r8b
mov byte [rbp + 0x50], r8b
mov qword [rsp + 0x28], r8
mov al, byte [r12 + 0x18]
mov byte [rsp + 0x20], al
mov r9d, edi
xor r8d, r8d
mov rdx, qword [r12 + 0x10]
lea rcx, [rbp - 0x10]
call fcn.140003fb0
mov ebx, dword [rax]
mov rdi, qword [rax + 8]
xor r8d, r8d
mov qword [rax + 8], r8
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140005121
mov qword [rbp - 8], r8
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140023690]
xor r8d, r8d
test ebx, ebx
jne 0x140005234
mov r14b, byte [r12 + 0x1c]
and r14b, 0xf
mov eax, dword [rbp + 0x58]
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x2c], r8d
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x20], rax
mov r9d, 0xffff
mov r8, qword [r12]
xor edx, edx
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, eax
mov ecx, dword [rbp - 0x2c]
mov edx, 2
cmp dword [rbp - 0x30], edx
jae 0x140005181
lea eax, [rcx - 1]
cmp eax, 1
cmovbe ebx, edx
mov r9d, 0x3f2
cmp ebx, r9d
je 0x1400051a1
cmp ebx, 0x3fa
je 0x1400051a1
cmp ebx, 6
je 0x1400051a1
xor r8d, r8d
mov eax, r8d
jmp 0x1400051a9
mov eax, 1
xor r8d, r8d
test eax, eax
jne 0x1400051e6
test ebx, ebx
jne 0x1400051e6
lea eax, [rcx - 1]
cmp eax, 1
ja 0x1400051c8
mov eax, dword [rbp - 0x30]
shr rax, 1
mov word [r13 + rax*2 - 2], r8w
mov ecx, dword [rbp - 0x2c]
movzx eax, r14b
cmp ecx, eax
je 0x1400051e6
sub ecx, 1
je 0x1400051e0
cmp ecx, 1
jne 0x1400051e4
cmp eax, ecx
jne 0x1400051e4
jmp 0x1400051e6
cmp eax, edx
je 0x1400051e6
mov ebx, edx
cmp ebx, r9d
je 0x1400051fb
cmp ebx, 0x3fa
je 0x1400051fb
cmp ebx, 6
mov eax, r8d
jne 0x140005200
mov eax, 1
test eax, eax
je 0x14000522c
mov rcx, qword [r12 + 0x10]
movzx eax, word [rcx + 0xa]
and eax, 0x1f
shl rax, 5
lea rdx, [0x14002e0a0]
mov qword [rax + rdx], r8
call fcn.14000269c
mov r14b, 1
xor r8d, r8d
jmp 0x140005234
test ebx, ebx
je 0x14000529b
mov r14b, byte [rbp + 0x50]
test rdi, rdi
je 0x14000524c
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [0x140023690]
xor r8d, r8d
inc r15d
test r14b, r14b
mov edi, dword [rbp - 0x28]
jne 0x1400050c4
lea rcx, [rbp - 0x20]
call fcn.140002aa8
xor r9d, r9d
lea r10, [0x14002f2b0]
inc rsi
lea rax, [0x140025f37]
cmp rsi, rax
jne 0x140005064
mov eax, ebx
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test rdi, rdi
je 0x1400052b3
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [0x140023690]
xor r8d, r8d
mov eax, dword [rbp - 0x18]
test eax, eax
je 0x1400052e5
or eax, 0xffffffff
lock xadd dword [rbp - 0x18], eax
cmp eax, 1
jne 0x1400052d9
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x14], eax
jne 0x140005301
xor r9d, r9d
mov dword [rbp - 0x14], r9d
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
jmp 0x1400052b0
cmp dword [rbp - 0x14], r8d
je 0x140005281
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x14], eax
jne 0x14000530e
jmp 0x140005281
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
xor edx, edx
mov ecx, 0x131f4c5
call fcn.140001f08
int3
xor edx, edx
mov ecx, 0x131f4c3
call fcn.140001f08
int3
xor edx, edx
mov ecx, 0x131f4c4
call fcn.140001f08
int3