Function at 0x140002320
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x170
mov rax, qword [0x14008a080]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rdx
mov qword [rsp + 0x38], rcx
mov rdi, rcx
lea rax, [rsp + 0x38]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov r9d, 0x20119
xor r8d, r8d
xor r14d, r14d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test eax, eax
je 0x1400023bf
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str.Failed_to_open_registry_key:
call fcn.1400045a0
mov edx, esi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140004ae0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x14007e268]
mov rcx, rdi
call fcn.140003d70
jmp 0x140002548
cmp qword [rbx + 0x18], 0xf
mov dword [rsp + 0x40], 0x104
jbe 0x1400023d1
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
test eax, eax
je 0x14000244c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str.Failed_to_read_environment_variable_value:
call fcn.1400045a0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140004ae0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x14007e268]
mov rcx, rdi
call fcn.140003d70
jmp 0x140002548
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov rbx, 0xffffffffffffffff
mov qword [rdi + 0x18], r14
inc rbx
cmp byte [rax + rbx], r14b
jne 0x140002471
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x14000256f
cmp rbx, 0xf
ja 0x1400024b8
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x50]
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], r14b
jmp 0x140002548
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x1400024ed
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14006bbf8
test rax, rax
je 0x140002514
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140002528
mov ecx, reloc.WLDAP32.dll_Ordinal_22
mov rsi, rax
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14000251b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002575
jmp 0x1400024d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140002528
call fcn.14006bbf8
mov r14, rax
mov r8, rbx
mov qword [rdi], r14
lea rdx, [rsp + 0x50]
mov qword [rdi + 0x10], rbx
mov rcx, r14
mov qword [rdi + 0x18], rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
mov rax, rdi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14006bbd0
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x170
pop r14
pop rdi
pop rsi
ret
call fcn.140001450
int3
call fcn.1400013b0
int3