Function at 0x140005800
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
lea rax, [rsp + 0x84]
mov qword [rsp + 0xf8], rdx
mov rbp, rcx
xor edx, edx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x100], r8d
xor r8d, r8d
mov dword [rsp + 0x108], r9d
xor r9d, r9d
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegQueryInfoKeyW]
mov dword [rsp + 0x74], eax
test eax, eax
jne 0x140005b70
mov eax, dword [rsp + 0x108]
or eax, dword [rsp + 0x84]
je 0x1400058bc
mov rdx, qword [rsp + 0xf8]
lea rcx, [0x1400094e8]
call sym.output_string
mov ecx, 0x200
mov esi, 0x800
mov rdi, qword [sym.imp.ucrtbase.dll_malloc]
mov ebx, 0x100
lea r15, [rsp + 0x88]
lea r14, [rsp + 0x8c]
mov qword [rsp + 0x78], rdi
call rdi
mov ecx, 0x800
mov r12, rax
call rdi
xor edi, edi
mov r13, rax
lea rax, [rsp + 0x94]
mov qword [rsp + 0x60], rax
mov rax, qword [sym.imp.ucrtbase.dll_realloc]
mov qword [rsp + 0x68], rax
nop dword [rax]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], r14
mov r9, r15
mov r8, r12
mov dword [rsp + 0x88], ebx
mov edx, edi
mov rcx, rbp
mov dword [rsp + 0x8c], esi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.advapi32.dll_RegEnumValueW]
test eax, eax
je 0x140005990
cmp eax, 0xea
jne 0x1400059d8
mov r8d, dword [rsp + 0x8c]
cmp r8d, esi
jbe 0x1400059b8
mov dword [rsp + 0x70], r8d
mov edx, r8d
mov rcx, r13
mov rax, qword [rsp + 0x68]
call rax
mov r8d, dword [rsp + 0x70]
mov r13, rax
mov esi, r8d
jmp 0x140005918
mov r9d, dword [rsp + 0x8c]
mov r8, r13
mov rcx, r12
inc edi
mov edx, dword [rsp + 0x94]
call sym.output_value
jmp 0x140005918
lea edx, [rbx + rbx]
mov rcx, r12
mov rbx, rdx
add rdx, rdx
call qword [sym.imp.ucrtbase.dll_realloc]
mov r12, rax
jmp 0x140005918
mov rcx, r13
mov r13, qword [sym.imp.ucrtbase.dll_free]
call r13
mov rcx, r12
call r13
or edi, dword [rsp + 0x108]
jne 0x140005b30
mov edx, dword [rsp + 0x80]
test edx, edx
jne 0x140005a20
mov eax, dword [rsp + 0x74]
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x78]
mov ecx, 0x202
call rax
mov r12, rax
mov rax, qword [rsp + 0xf8]
cmp word [rax], 0
je 0x140005bbf
mov rbx, rax
nop dword [rax]
add rbx, 2
cmp word [rbx], 0
jne 0x140005a48
sub rbx, qword [rsp + 0xf8]
sar rbx, 1
lea rax, [rsp + 0x98]
mov dword [rsp + 0x70], ebx
mov rdi, qword [sym.imp.advapi32.dll_RegEnumKeyExW]
xor esi, esi
mov qword [rsp + 0x60], rax
mov rbx, qword [rsp + 0xf8]
lea r15, [rsp + 0x90]
mov dword [rsp + 0x90], 0x101
mov r9, r15
mov r8, r12
mov edx, esi
mov qword [rsp + 0x38], 0
mov rcx, rbp
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
jne 0x140005b80
mov eax, dword [rsp + 0x100]
test eax, eax
je 0x140005b50
mov r9d, dword [rsp + 0x90]
mov edx, dword [rsp + 0x70]
mov r8, r12
mov rcx, rbx
call sym.build_subkey_path
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
mov r9d, dword [0x14000d0a0]
mov r14, rax
mov rax, qword [rsp + 0x60]
or r9d, 0x20019
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
je 0x140005b90
mov rcx, r14
inc esi
call r13
jmp 0x140005a87
lea rcx, [0x1400094c2]
call sym.output_string
mov edx, dword [rsp + 0x80]
test edx, edx
je 0x140005a03
jmp 0x140005a20
mov r8, r12
mov rdx, rbx
lea rcx, str._1_2_n
inc esi
call sym.output_string
jmp 0x140005a87
mov dword [rsp + 0x74], 1
jmp 0x140005a03
mov rcx, r12
call r13
jmp 0x140005a03
mov r9d, 1
mov rcx, qword [rsp + 0x98]
mov r8d, 1
mov rdx, r14
call sym.query_all
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x140005b1b
xor ebx, ebx
jmp 0x140005a5d