Function at 0x14005b860
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov rax, qword [0x1402bf200]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, qword [rbp + 0x67]
mov qword [rbp + 0xf], r15
mov rsi, qword [rbp + 0x6f]
mov qword [rbp - 0x11], rsi
mov r14, qword [rbp + 0x77]
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov qword [rbp - 9], r12
mov qword [rbp - 1], r12
mov qword [rbp + 7], r12
mov ecx, 0x1000
call fcn.14002aac0
mov qword [rbp - 9], rax
lea rbx, [rax + 0x1000]
mov qword [rbp + 7], rbx
xor edx, edx
mov r8d, 0x1000
mov rcx, rax
call fcn.1401d80e0
mov qword [rbp - 1], rbx
mov rcx, qword [rbp - 9]
nop
sub rbx, rcx
mov eax, ebx
cmp rax, rbx
jne 0x14005ba77
mov dword [rbp + 0xf], ebx
mov rdx, qword [r14]
mov r8, qword [r14 + 8]
sub r8, rdx
sar r8, 5
mov eax, r8d
cmp rax, r8
jne 0x14005ba50
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
mov r9, rcx
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryMultipleValuesW]
cmp eax, 0xea
jne 0x14005b998
mov r8d, dword [rbp + 0xf]
mov rbx, qword [rbp - 1]
mov rdx, rbx
mov rcx, qword [rbp - 9]
sub rdx, rcx
cmp r8, rdx
jae 0x14005b958
lea rbx, [r8 + rcx]
mov qword [rbp - 1], rbx
jmp 0x14005b8f0
jbe 0x14005b8f0
mov rax, qword [rbp + 7]
sub rax, rcx
cmp r8, rax
jbe 0x14005b97b
mov rdx, r8
lea rcx, [rbp - 9]
call fcn.140044560
mov rbx, qword [rbp - 1]
jmp 0x14005b8ea
sub r8, rdx
lea rdi, [rbx + r8]
xor edx, edx
mov rcx, rbx
call fcn.1401d80e0
mov rbx, rdi
mov qword [rbp - 1], rbx
jmp 0x14005b8ea
lea rcx, str.Cannot_query_multiple_values
mov qword [rbp - 0x39], rcx
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], r12
lea rdx, [rbp - 0x39]
mov ecx, eax
call fcn.140059ec0
mov rdx, qword [r14 + 0x10]
mov qword [r14 + 0x10], r12
mov rcx, qword [r14 + 8]
mov qword [r14 + 8], r12
mov rax, qword [r14]
mov qword [r14], r12
mov qword [r15], rax
mov qword [r15 + 8], rcx
mov qword [r15 + 0x10], rdx
mov rdx, qword [rbp + 7]
mov qword [rbp + 7], r12
mov rcx, qword [rbp - 1]
mov qword [rbp - 1], r12
mov rax, qword [rbp - 9]
mov qword [rbp - 9], r12
mov qword [r15 + 0x18], rax
mov qword [r15 + 0x20], rcx
mov qword [r15 + 0x28], rdx
lea rcx, [rbp - 9]
call fcn.14002a0d0
nop
cmp byte [rsi + 8], 0
jne 0x14005ba12
mov qword [rsi], r12
mov rcx, qword [rsi]
test rcx, rcx
je 0x14005ba2c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x14005ba2c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsi], r12
mov rax, r15
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14019acb0
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x39]
call fcn.1400299c0
lea rdx, [0x1402ba2a0]
lea rcx, [rbp - 0x39]
call fcn.14019cd80
int3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x39]
call fcn.1400299c0
lea rdx, [0x1402ba2a0]
lea rcx, [rbp - 0x39]
call fcn.14019cd80
int3