Function at 0x14001b934
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x140113970]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rbp + 0xf], rcx
xor r14d, r14d
mov dword [rbp - 0x19], r14d
lea rcx, str.AgentService.Util::GetNameOfMockShellProgram:_Entry
call fcn.14000457c
mov dword [rbp + 0x17], r14d
lea r12d, [r14 + 7]
mov qword [rdi + 0x18], r12
mov qword [rdi + 0x10], r14
mov word [rdi], r14w
xor r8d, r8d
lea rdx, [0x1400dd700]
mov rcx, rdi
call fcn.14000643c
mov dword [rbp - 0x19], 1
lea rax, [rbp + 0x17]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 2]
lea r8, str.MockShell
lea rdx, str.SoftwareMicrosoftUE_V_test
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x14001ba05
cmp eax, 2
jne 0x14001b9f2
lea rcx, str.AgentService.Util::GetNameOfMockShellProgram:_No_mock_shell_program_has_been_defined
call fcn.14000457c
jmp 0x14001bb11
mov edx, eax
lea rcx, str.AgentService.Util::GetNameOfMockShellProgram:_::RegGetValueW____1__returned_system_error_code_0x_lX
call fcn.140019d84
jmp 0x14001bb11
mov ecx, dword [rbp + 0x17]
add ecx, 2
call fcn.1400a5d68
mov rbx, rax
mov qword [rbp + 0x1f], rax
lea rax, [rbp + 0x17]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r9d, 2
lea r8, str.MockShell
lea rdx, str.SoftwareMicrosoftUE_V_test
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x14001ba64
mov edx, eax
lea rcx, str.AgentService.Util::GetNameOfMockShellProgram:_::RegGetValueW____2__returned_system_error_code_0x_lX
call fcn.1400045ac
jmp 0x14001bb02
mov qword [rbp + 7], r12
mov qword [rbp - 1], r14
mov word [rbp - 0x11], r14w
cmp word [rbx], r14w
jne 0x14001ba7c
mov r8, r14
jmp 0x14001ba8a
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], r14w
jne 0x14001ba80
mov rdx, rbx
lea rcx, [rbp - 0x11]
call fcn.14000643c
nop
lea rax, [rbp - 0x11]
cmp rdi, rax
je 0x14001bacf
cmp qword [rdi + 0x18], 8
jb 0x14001bab6
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov qword [rdi + 0x18], r12
mov qword [rdi + 0x10], r14
mov word [rdi], r14w
lea rdx, [rbp - 0x11]
mov rcx, rdi
call fcn.140006720
nop
cmp qword [rbp + 7], 8
jb 0x14001bae6
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
cmp qword [rdi + 0x18], 8
jb 0x14001baf2
mov rdx, qword [rdi]
jmp 0x14001baf5
mov rdx, rdi
lea rcx, str.AgentService.Util::GetNameOfMockShellProgram:_Mock_shell_program_is__s
call fcn.140014294
nop
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
cmp qword [rdi + 0x18], 8
jb 0x14001bb1d
mov rdx, qword [rdi]
jmp 0x14001bb20
mov rdx, rdi
lea rcx, str.AgentService.Util::GetNameOfMockShellProgram:_Exit___s_
call fcn.140014294
mov rax, rdi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400c4a70
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret