Function at 0x14000b570
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push r12
lea rbp, [rsp - 0x5f0]
sub rsp, 0x6f0
mov rsi, rcx
xor edx, edx
lea rcx, [rbp - 0x40]
mov r8d, 0x208
call fcn.14002ec20
lea rax, [rsp + 0x60]
mov dword [rsp + 0x6c], 0x104
xor r12d, r12d
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
mov dword [rsp + 0x68], r12d
xor r8d, r8d
mov dword [rbp + 0x620], r12d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000b5e4
xor eax, eax
add rsp, 0x6f0
pop r12
pop rsi
pop rbp
ret
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x6c]
lea rax, [rbp - 0x60]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rdx, [rbp - 0x40]
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x628]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14000b992
mov ecx, dword [rbp + 0x628]
inc ecx
mov qword [rsp + 0x6d0], r15
add rcx, rcx
call fcn.14002fc3c
mov qword [rbp - 0x68], rax
mov r15, rax
test rax, rax
je 0x14000b98a
mov ecx, dword [rbp + 0x628]
mov dword [rbp + 0x620], ecx
cmp dword [rsp + 0x70], r12d
je 0x14000b982
mov qword [rsp + 0x38], r12
lea r9, [rbp + 0x620]
mov dword [rbp + 0x620], 0x96
mov r8, rax
mov word [rax], r12w
xor edx, edx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x14000b982
mov qword [rsp + 0x6e8], rdi
lea rcx, [rbp + 0x1d0]
mov edi, 1
xor edx, edx
mov r8d, 0x400
mov qword [rbp - 0x70], rdi
mov dword [rsp + 0x74], edi
call fcn.14002ec20
lea rax, [rsp + 0x60]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000b97a
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x618]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x74]
lea rax, [rbp + 0x1d0]
mov dword [rbp + 0x618], 0x400
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b97a
mov eax, dword [rbp + 0x618]
mov qword [rsp + 0x6d8], r14
lea ecx, [rax*2 + 1]
add rcx, rcx
call fcn.14002fc3c
mov r14, rax
test rax, rax
je 0x14000b972
mov word [rax], r12w
mov ecx, dword [rbp + 0x618]
mov qword [rsp + 0x710], rbx
mov rbx, r12
test rcx, rcx
je 0x14000b7f2
nop word [rax + rax]
sub rcx, rbx
mov rax, 0xffffffffffffffff
movsx r9d, byte [rbp + rcx + 0x1cf]
cmp word [r14 + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x14000b7c3
lea rcx, [r14 + rax*2]
mov edx, 3
lea r8, [0x1400678c0]
call fcn.14000db30
mov ecx, dword [rbp + 0x618]
inc rbx
cmp rbx, rcx
jb 0x14000b7b0
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [r14 + rax*2], r12w
jne 0x14000b800
cmp rax, 8
jb 0x14000b962
mov qword [rsp + 0x6e0], r13
mov r13, rax
shr r13, 3
cmp rdi, r13
ja 0x14000b95a
lea r15, [r14 - 0x10]
lea r15, [r15 + rax*2]
nop dword [rax]
nop dword [rax + rax]
xor eax, eax
lea rcx, [rsp + 0x78]
mov rdx, r15
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov word [rbp - 0x78], ax
lea r8d, [rax + 8]
call fcn.140034640
mov rcx, 0xffffffffffffffff
mov word [rbp - 0x78], r12w
nop dword [rax]
inc rcx
cmp word [rsi + rcx*2], r12w
jne 0x14000b870
lea rdx, [rsp + 0x78]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], r12w
jne 0x14000b886
add rcx, rax
lea rcx, [rcx*2 + 2]
call fcn.14002fc3c
mov rdi, rax
test rax, rax
je 0x14000b939
mov word [rax], r12w
lea rcx, [rax - 2]
cmp word [rcx + 2], r12w
lea rcx, [rcx + 2]
jne 0x14000b8b4
xor edx, edx
movzx eax, word [rsi + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x14000b8c1
lea rax, [rdi - 2]
nop word [rax + rax]
cmp word [rax + 2], r12w
lea rax, [rax + 2]
jne 0x14000b8e0
lea r8, [rsp + 0x78]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x14000b900
mov rcx, rdi
call fcn.14000a910
mov rcx, rdi
mov rbx, rax
call fcn.14002fc28
mov rcx, rbx
call fcn.14001e680
test al, al
jne 0x14000b953
mov rcx, rbx
call fcn.14002fc28
mov rdi, qword [rbp - 0x70]
sub r15, 0x10
inc rdi
mov qword [rbp - 0x70], rdi
cmp rdi, r13
jbe 0x14000b840
jmp 0x14000b956
mov r12, rbx
mov r15, qword [rbp - 0x68]
mov r13, qword [rsp + 0x6e0]
mov rcx, r14
call fcn.14002fc28
mov rbx, qword [rsp + 0x710]
mov r14, qword [rsp + 0x6d8]
mov rdi, qword [rsp + 0x6e8]
mov rcx, r15
call fcn.14002fc28
mov r15, qword [rsp + 0x6d0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, r12
add rsp, 0x6f0
pop r12
pop rsi
pop rbp
ret