Function at 0x14004eb10
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x220
mov qword [rbp - 0x1f8], rbx
mov qword [rbp - 0x1f0], rsi
mov qword [rbp - 0x1e8], rdi
mov dword [rbp + 0x10], ecx
mov rbx, rdx
mov rsi, r8
mov rdi, r9
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov dword [rbp - 0x1e0], 0xffffffff
mov rdx, qword [rsi + 8]
mov rax, qword [rsi]
mov qword [rbp - 0xc0], rax
mov qword [rbp - 0xb8], rdx
lea rdx, [rbp - 0xc0]
lea rcx, [rbp - 0x1d0]
call fcn.1400290b0
mov edx, 0x100
xor ecx, ecx
sub rsp, 0x20
call fcn.14004ea30
add rsp, 0x20
mov qword [rbp - 0xb0], rax
mov qword [rbp - 0xa8], rdx
mov rcx, qword [rbp - 0xb0]
add rcx, rcx
sub rsp, 0x20
call fcn.140028830
add rsp, 0x20
mov dword [rbp - 0xa0], eax
lea rcx, [rbp - 0x1d0]
sub rsp, 0x20
call fcn.140013810
add rsp, 0x20
lea r8, [rbp - 0x1e0]
mov rdx, qword [rbp - 0xa8]
lea r9, [rbp - 0xa0]
push r9
push rdx
mov r9, r8
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov esi, eax
cmp esi, 0xea
jne 0x14004ec72
lea rdx, [rbp - 0xb0]
mov ecx, dword [rbp - 0xa0]
shr rcx, 1
sub rsp, 0x20
call fcn.140029630
add rsp, 0x20
lea rcx, [rbp - 0x1d0]
sub rsp, 0x20
call fcn.140013810
add rsp, 0x20
lea r8, [rbp - 0x1e0]
mov r9, qword [rbp - 0xa8]
lea rdx, [rbp - 0xa0]
push rdx
push r9
mov r9, r8
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov esi, eax
jmp 0x14004ec93
test esi, esi
jne 0x14004ec93
lea rdx, [rbp - 0xb0]
mov ecx, dword [rbp - 0xa0]
shr rcx, 1
sub rsp, 0x20
call fcn.140029630
add rsp, 0x20
mov r9d, esi
lea r10, [0x14004e9c0]
mov qword [rbp - 0x88], r10
xor r8d, r8d
mov qword [rbp - 0x90], r8
lea r8, [rbp - 0x90]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x80], 0x16
lea rdx, [rbp - 0x80]
mov ecx, 0x261
sub rsp, 0x20
call fcn.14004d370
add rsp, 0x20
cmp dword [rbp - 0x1e0], 7
sete dl
movzx edx, dl
lea rax, [0x14004eeb0]
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x70], 0
lea rcx, [rbp - 0x70]
sub rsp, 0x20
call fcn.140002cb0
add rsp, 0x20
mov esi, dword [rbp - 0x1e0]
cmp esi, dword [rbp + 0x10]
sete dl
movzx edx, dl
lea rdi, [0x14004ef10]
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x60], 0
lea rcx, [rbp - 0x60]
sub rsp, 0x20
call fcn.140002cb0
add rsp, 0x20
lea rdx, [rbp - 0xb0]
mov rcx, qword [rbp - 0xb0]
dec rcx
sub rsp, 0x20
call fcn.140029630
add rsp, 0x20
cmp qword [rbp - 0xb0], 0
je 0x14004eda9
mov rdx, qword [rbp - 0xb0]
mov rax, qword [rbp - 0xb0]
mov rsi, qword [rbp - 0xa8]
lea rdi, [rsi + rax*2]
cmp word [rdi - 2], 0
jne 0x14004eda9
lea rdx, [rbp - 0xb0]
mov rcx, qword [rbp - 0xb0]
lea rcx, [rcx - 1]
sub rsp, 0x20
call fcn.140029630
add rsp, 0x20
mov rax, qword [rbp - 0xb0]
mov qword [rbp - 0x40], rax
mov rsi, qword [rbp - 0xa8]
mov qword [rbp - 0x38], rsi
lea rdx, [rbp - 0x40]
lea rdi, [0x1400b6290]
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x30], 1
lea rcx, [rbp - 0x30]
sub rsp, 0x20
call fcn.14005e400
add rsp, 0x20
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
mov rdx, rbx
mov rcx, qword [rbp - 0x50]
sub rsp, 0x20
call fcn.1400552a0
add rsp, 0x20
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
xor edi, edi
cmp qword [rbp - 0x20], rdi
je 0x14004ee64
mov rsi, qword [rbp - 0x18]
mov rbx, qword [rbp - 0x48]
mov rax, rsi
mov rax, rdi
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
lea rcx, [rbp - 0x10]
sub rsp, 0x20
call fcn.140023420
add rsp, 0x20
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov r8d, 0x10
add rsi, r8
add rbx, r8
inc rdi
cmp rdi, qword [rbp - 0x20]
jb 0x14004ee22
sub rsp, 8
call fcn.14004ee73
add rsp, 8
jmp 0x14004ee88
mov rbx, qword [rbp - 0x1f8]
mov rsi, qword [rbp - 0x1f0]
mov rdi, qword [rbp - 0x1e8]
mov rsp, rbp
pop rbp
ret