Function at 0x140005290
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd98]
sub rsp, 0xe98
mov rax, qword [0x14001a0e8]
xor rax, rsp
mov qword [rbp + 0xd80], rax
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor r12d, r12d
xor edx, edx
mov qword [rsp + 0x60], r12
mov r8d, 0x208
lea rcx, [rbp + 0x370]
mov rdi, r9
call sub.msvcrt.dll_memset
lea rdx, str.GlobalLogger
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
lea ecx, [r12 + 1]
movzx esi, r12b
test eax, eax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x58]
cmovne esi, ecx
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x370]
call fcn.140001094
test eax, eax
je 0x140005330
movzx eax, ax
jmp 0x1400056a7
test sil, sil
je 0x14000534f
mov rdx, qword [rsp + 0x58]
lea r8, str.AutoLogger
mov rcx, qword [rsp + 0x60]
call fcn.140001008
test eax, eax
jne 0x140005328
lea r8, [rsp + 0x58]
mov dl, sil
lea rcx, [rbp + 0x370]
call fcn.140002cb4
test eax, eax
jne 0x1400056a7
mov rax, qword [rsp + 0x58]
mov edx, 0x104
cmp rax, rdx
jbe 0x140005384
mov eax, 0x7a
jmp 0x1400056a7
sub rdx, rax
lea rcx, [rbp + rax*2 + 0x36e]
mov r9, rdi
lea r8, str._ls
call fcn.140001180
test eax, eax
jne 0x140005328
lea rax, [rsp + 0x50]
mov dword [r14], r12d
mov r9d, 3
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x370]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14000569d
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x44]
mov eax, 0x400
lea r8, [rbp + 0x580]
mov dword [rsp + 0x44], eax
xor edx, edx
mov dword [rsp + 0x40], eax
mov edi, r12d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
nop dword [rax + rax]
test eax, eax
jne 0x140005689
lea r13d, [rax + 4]
lea rdx, str.Start
inc edi
lea rcx, [rbp + 0x580]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140005470
mov eax, dword [rsp + 0x40]
mov rcx, r14
cmp eax, r13d
cmova eax, r13d
mov r8d, eax
jmp 0x1400055cb
lea rdx, [0x14000c560]
lea rcx, [rbp + 0x580]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140005497
lea rcx, [rbx + 0x30]
jmp 0x1400055c6
lea rdx, str.MaximumBuffers
lea rcx, [rbp + 0x580]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400054be
lea rcx, [rbx + 0x38]
jmp 0x1400055c6
lea rdx, str.MinimumBuffers
lea rcx, [rbp + 0x580]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400054e5
lea rcx, [rbx + 0x34]
jmp 0x1400055c6
lea rdx, str.FlushTimer
lea rcx, [rbp + 0x580]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000550c
lea rcx, [rbx + 0x44]
jmp 0x1400055c6
lea rdx, str.EnableKernelFlags
lea rcx, [rbp + 0x580]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000554d
mov eax, dword [rsp + 0x40]
mov ecx, 0x20
cmp eax, ecx
cmova eax, ecx
lea rcx, [0x14001b138]
test eax, eax
mov r8d, eax
setne byte [0x14001a6b0]
jmp 0x1400055cb
lea rdx, str.ClockType
lea rcx, [rbp + 0x580]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000557e
mov eax, dword [rsp + 0x40]
mov rcx, r15
cmp eax, r13d
cmova eax, r13d
mov r8d, eax
jmp 0x1400055cb
lea rdx, str.FileName
lea rcx, [rbp + 0x580]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400055a4
mov ecx, dword [rbx + 0x70]
add rcx, rbx
jmp 0x1400055c6
lea rdx, str.LogFileMode
lea rcx, [rbp + 0x580]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400055d7
lea rcx, [rbx + 0x40]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x70]
call sub.msvcrt.dll_memcpy
jmp 0x140005632
test sil, sil
jne 0x140005632
lea rdx, str.StackWalkingFilter
lea rcx, [rbp + 0x580]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140005632
lea rdx, str.Status
lea rcx, [rbp + 0x580]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140005632
lea rdx, [rbp + 0x580]
lea rcx, str.WARNING:_Unidentified_Key_in_the_trace_registry:__ls_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x44]
mov eax, 0x400
lea r8, [rbp + 0x580]
mov dword [rsp + 0x44], eax
mov edx, edi
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
nop dword [rax + rax]
test eax, eax
je 0x14000543a
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov edi, r12d
mov rcx, rbx
call fcn.140005180
mov eax, edi
mov rcx, qword [rbp + 0xd80]
xor rcx, rsp
call fcn.14000ae40
add rsp, 0xe98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret