Function at 0x1000f1520
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x410
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x400], rax
mov eax, dword [rsp + 0xcc]
xor r14d, r14d
mov rsi, rcx
and eax, 0xfffffffe
lea rcx, [r11 - 0x368]
lea r13d, [r14 + 0x18]
and eax, 0xfffffffb
mov qword [r11 - 0x378], rcx
mov qword [r11 - 0x388], r14
or eax, 2
mov dword [r11 - 0x380], r13d
lea rcx, [r11 - 0x318]
mov dword [rsp + 0xcc], eax
mov eax, dword [rsp + 0x11c]
mov qword [r11 - 0x338], r14
and eax, 0xfffffffe
mov dword [r11 - 0x330], r13d
mov qword [r11 - 0x328], rcx
and eax, 0xfffffffb
mov rdi, rdx
mov ebx, r14d
or eax, 2
mov qword [rsp + 0x50], r14
mov r12, r14
mov dword [rsp + 0x11c], eax
mov dword [r11 - 0x370], r14d
mov word [r11 - 0x368], r14w
mov dword [r11 - 0x320], r14d
mov word [r11 - 0x318], r14w
cmp rdx, r14
jne 0x1000f161b
lea r8, [0x10000f6f8]
lea rcx, [0x10000f158]
mov edx, 0x374
call fcn.100099ad8
mov rax, qword [rsp + 0xc0]
mov word [rax], r14w
mov dword [rsp + 0xc8], r14d
jmp 0x1000f1637
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0xb0]
mov rdx, rdi
mov r8d, eax
call fcn.1000f2a80
mov edx, 0x5c
mov rcx, rdi
call sub.msvcrt.dll_wcschr
mov rbp, rax
cmp rax, r14
je 0x1000f168c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x100]
mov rdx, rbp
mov r8d, eax
call fcn.1000f2a80
mov edx, dword [rsp + 0xc8]
sub edx, dword [rsp + 0x118]
cmp edx, dword [rsp + 0xc8]
jae 0x1000f168c
lea rcx, [rsp + 0xb0]
call fcn.1000fcc74
or ebp, 0xffffffff
lea rdx, [0x10000f708]
lea rcx, [rsp + 0xb0]
mov r8d, 1
mov r9d, ebp
mov dword [rsp + 0x20], r14d
call fcn.1000f27e0
cmp eax, r14d
jne 0x1000f19c5
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
cmp rcx, rbp
je 0x1000f16f1
test byte [rcx + 0x1c], 1
je 0x1000f16f1
cmp byte [rcx + 0x19], 4
jb 0x1000f16f1
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, 0x15
mov r9, rdi
call fcn.10001da24
mov ecx, 0x2000
call qword [sym.imp.msvcrt.dll_malloc]
mov r12, rax
cmp rax, r14
jne 0x1000f1719
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x8007000e
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
cmp r12, r14
jne 0x1000f1737
mov ebx, 0x8007000e
mov dword [rsp + 0x70], 0x387
lea r9, [0x10000f4d8]
jmp 0x1000f1a8e
xor edx, edx
mov r8d, 0x2000
mov rcx, r12
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x50]
lea rdx, [0x10000f730]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
je 0x1000f17bc
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x1000f1ac7
test byte [rcx + 0x1c], 1
je 0x1000f1ac7
cmp byte [rcx + 0x19], 3
jb 0x1000f1ac7
mov rcx, qword [rcx + 0x10]
lea r9, [0x10000f730]
lea r8, [0x100003148]
mov edx, 0x16
mov dword [rsp + 0x20], eax
call fcn.10001daa4
jmp 0x1000f1ac7
mov r13d, r14d
lea rcx, [rsp + 0x1f0]
xor edx, edx
mov r8d, 0x104
mov dword [rsp + 0x40], 0x104
mov dword [rsp + 0x48], 0x2000
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x50]
lea r11, [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x1f0]
mov edx, r13d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc r13d
mov edi, eax
cmp eax, r14d
jne 0x1000f190c
cmp dword [rsp + 0x44], 2
jne 0x1000f1913
lea rcx, [rsp + 0x1a0]
xor r8d, r8d
mov rdx, r12
call fcn.1000f24ac
mov r11d, dword [rsp + 0x16c]
lea rax, [rsp + 0x170]
and r11d, 0xfffffffe
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x58]
and r11d, 0xfffffffb
mov qword [rsp + 0x150], r14
mov dword [rsp + 0x158], 0x18
or r11d, 2
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x168], r14d
mov dword [rsp + 0x16c], r11d
mov word [rsp + 0x170], r14w
call fcn.1000f251c
lea rdx, [rsp + 0x150]
mov rcx, rax
call fcn.1000fcd50
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x150]
xor r9d, r9d
xor r8d, r8d
call fcn.1000f2594
lea rdx, [rsp + 0x150]
mov rcx, rsi
call fcn.1000f11c0
cmp eax, r14d
mov ebx, eax
jl 0x1000f195e
lea rcx, [rsp + 0x150]
call fcn.1000f2568
lea rcx, [rsp + 0x1a0]
call fcn.1000f2568
jmp 0x1000f17bf
cmp eax, 0x103
je 0x1000f1950
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x1000f1950
test byte [rcx + 0x1c], 1
je 0x1000f1950
cmp byte [rcx + 0x19], 3
jb 0x1000f1950
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
lea r9, [0x10000f708]
lea r8, [0x100003148]
mov edx, 0x17
mov dword [rsp + 0x20], r13d
call fcn.10001dd64
cmp edi, r14d
jne 0x1000f1ac7
jmp 0x1000f17bf
lea rax, [0x100167d30]
lea r9, [0x10000f7a8]
lea r8, [0x10000f2d0]
mov qword [rsp + 0x58], rax
lea rax, [0x10000f1e0]
lea rdx, [0x10000fa60]
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x70], 0x3b5
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rsi
call sym.wbengine.exe_public:_void___cdecl_CTraceFailureHelper::TraceMessage_unsigned_short_int_const____ptr64____ptr64
lea rcx, [rsp + 0x150]
call fcn.1000f2568
lea rcx, [rsp + 0x1a0]
call fcn.1000f2568
jmp 0x1000f1ac7
lea rdx, [0x10000f7c8]
lea rcx, [rsp + 0xb0]
mov r9d, ebp
mov r8d, 1
mov dword [rsp + 0x20], r14d
call fcn.1000f27e0
cmp eax, r14d
jne 0x1000f1a4d
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
cmp rcx, rbp
je 0x1000f1a21
test byte [rcx + 0x1c], 1
je 0x1000f1a21
cmp byte [rcx + 0x19], 4
jb 0x1000f1a21
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, r13d
mov r9, rdi
call fcn.10001da24
lea rdx, [rsp + 0x100]
mov rcx, rsi
call fcn.1000f11c0
cmp eax, r14d
mov ebx, eax
jge 0x1000f1ac7
mov dword [rsp + 0x70], 0x3c8
lea r9, [0x10000f7e8]
jmp 0x1000f1a8e
lea rcx, [rsp + 0x1a0]
xor r8d, r8d
mov rdx, rdi
call fcn.1000f24ac
mov rcx, rsi
mov rdx, rax
call fcn.1000f11c0
lea rcx, [rsp + 0x1a0]
mov ebx, eax
call fcn.1000f2568
cmp ebx, r14d
jge 0x1000f1ac7
mov dword [rsp + 0x70], 0x3cf
lea r9, [0x10000f810]
lea rax, [0x100167d30]
lea r8, [0x10000f2d0]
lea rdx, [0x10000fa60]
mov qword [rsp + 0x58], rax
lea rax, [0x10000f1e0]
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x68], rax
call sym.wbengine.exe_public:_void___cdecl_CTraceFailureHelper::TraceMessage_unsigned_short_int_const____ptr64____ptr64
mov rcx, qword [rsp + 0x50]
cmp rcx, r14
je 0x1000f1ad7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_free]
lea rcx, [rsp + 0x100]
call fcn.1000f2568
lea rcx, [rsp + 0xb0]
call fcn.1000f2568
mov eax, ebx
mov rcx, qword [rsp + 0x400]
xor rcx, rsp
call fcn.10014e480
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret