Function at 0x14005f190
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rsp + 0xf0], rbx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rdx
mov rbx, rcx
xor r15d, r15d
mov qword [rdx + 0x10], r15
cmp qword [rdx + 0x18], 8
jb 0x14005f1db
mov rax, qword [rdx]
jmp 0x14005f1de
mov rax, rdx
mov word [rax], r15w
cmp rcx, 0xffffffff80000002
jne 0x14005f20f
mov r8d, 0x11
lea rdx, str.REGISTRYMACHINE
mov rcx, rdi
call fcn.140007d00
movabs rax, 0x8000000000
jmp 0x14005f479
cmp rcx, 0xffffffff80000003
jne 0x14005f227
mov r8d, 0xe
lea rdx, str.REGISTRYUSER
jmp 0x14005f1f8
cmp rcx, 0xffffffff80000001
jne 0x14005f2d3
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r15
mov word [rbp - 0x39], r15w
lea rcx, [rbp - 0x39]
call fcn.14005ebe0
mov rbx, rax
shr rax, 0x27
not eax
test al, 1
jne 0x14005f2b0
lea r8, [rbp - 0x39]
lea rdx, str.REGISTRYUSER_
lea rcx, [rbp - 0x19]
call fcn.14000d5f0
nop
mov rdx, rax
mov rcx, rdi
call fcn.14000c400
nop
cmp qword [rbp - 1], 8
jb 0x14005f295
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp - 1], 7
mov qword [rbp - 9], r15
mov word [rbp - 0x19], r15w
movabs rbx, 0x8000000000
cmp qword [rbp - 0x21], 8
jb 0x14005f2c1
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp - 0x21], 7
mov word [rbp - 0x39], r15w
jmp 0x14005f472
cmp rcx, 0xffffffff80000000
jne 0x14005f39b
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r15
mov word [rbp - 0x39], r15w
lea rcx, [rbp - 0x39]
call fcn.14005ebe0
mov rbx, rax
shr rax, 0x27
not eax
test al, 1
jne 0x14005f396
lea r8, [rbp - 0x39]
lea rdx, str.REGISTRYUSER_
lea rcx, [rbp + 7]
call fcn.14000d5f0
nop
lea r8, str._Classes
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.14000d570
nop
mov rdx, rax
mov rcx, rdi
call fcn.14000c400
nop
cmp qword [rbp - 1], 8
jb 0x14005f359
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp - 1], 7
mov qword [rbp - 9], r15
mov word [rbp - 0x19], r15w
cmp qword [rbp + 0x1f], 8
jb 0x14005f37b
mov rcx, qword [rbp + 7]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0x1f], 7
mov qword [rbp + 0x17], r15
mov word [rbp + 7], r15w
movabs rbx, 0x8000000000
jmp 0x14005f2b0
mov dword [rbp - 0x49], r15d
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 3]
call qword [sym.imp.ntdll.dll_NtQueryKey]
mov esi, eax
cmp eax, 0x80000005
je 0x14005f3e3
cmp esi, 0xc0000023
je 0x14005f3e3
call fcn.14005e9f0
or rax, rsi
movabs rcx, 0x172110000000
or rax, rcx
jmp 0x14005f479
mov eax, dword [rbp - 0x49]
test eax, eax
je 0x14005f200
mov edx, eax
lea rcx, [rbp - 0x39]
call fcn.1400175b0
nop
mov r9, qword [rbp - 0x31]
mov rsi, qword [rbp - 0x39]
sub r9, rsi
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x20], rcx
mov r8, rsi
mov edx, 3
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtQueryKey]
mov r14d, eax
test eax, eax
je 0x14005f440
call fcn.14005e9f0
mov rbx, rax
or rbx, r14
movabs rax, 0x182110000000
or rbx, rax
jmp 0x14005f45c
mov r8d, dword [rsi]
shr r8, 1
lea rdx, [rsi + 4]
mov rcx, rdi
call fcn.140007d00
movabs rbx, 0x8000000000
test rsi, rsi
je 0x14005f476
mov rcx, rsi
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], r15
mov rax, rbx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140107280
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret