Function at 0x14004e640
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1f0
mov qword [rbp - 0x1d0], rbx
mov qword [rbp - 0x1c8], rsi
mov qword [rbp - 0x1c0], rdi
mov qword [rbp - 0x1b8], r12
mov dword [rbp + 0x10], ecx
mov rdi, rdx
mov r12, r8
mov rbx, r9
mov qword [rdi], 0
mov qword [rdi + 8], 0
mov dword [rbp - 0x1b0], 0xffffffff
mov qword [rbp - 0x1a8], 0
lea rsi, [rbp - 0x1a8]
mov dword [rbp - 0x1a0], 8
mov rdx, qword [r12 + 8]
mov rax, qword [r12]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdx
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x190]
call fcn.1400290b0
lea rcx, [rbp - 0x190]
sub rsp, 0x20
call fcn.140013810
add rsp, 0x20
lea r8, [rbp - 0x1b0]
lea r9, [rbp - 0x1a8]
lea rdx, [rbp - 0x1a0]
push rdx
push r9
mov r9, r8
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov r12d, eax
cmp r12d, 0xea
jne 0x14004e773
mov edx, dword [rbp - 0x1a0]
xor ecx, ecx
sub rsp, 0x20
call fcn.1400022d0
add rsp, 0x20
mov rsi, rdx
lea rcx, [rbp - 0x190]
sub rsp, 0x20
call fcn.140013810
add rsp, 0x20
lea r8, [rbp - 0x1b0]
lea r9, [rbp - 0x1a0]
push r9
push rsi
mov r9, r8
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov r12d, eax
mov r9d, r12d
lea r10, [0x14004e9c0]
mov qword [rbp - 0x68], r10
xor r8d, r8d
mov qword [rbp - 0x70], r8
lea r8, [rbp - 0x70]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x60], 0x16
lea rdx, [rbp - 0x60]
mov ecx, 0x221
sub rsp, 0x20
call fcn.14004d370
add rsp, 0x20
mov r9d, dword [rbp - 0x1b0]
cmp r9d, dword [rbp + 0x10]
sete dl
movzx edx, dl
lea r8, [0x14004e9d0]
mov qword [rbp - 0x48], r8
mov qword [rbp - 0x50], 0
lea rcx, [rbp - 0x50]
sub rsp, 0x20
call fcn.140002cb0
add rsp, 0x20
mov ebx, dword [rbp - 0x1b0]
cmp ebx, 0xb
ja case.0x14004e80a.0
mov ebx, ebx
lea r9, [0x14004e990]
movsxd rdx, dword [r9 + rbx*4]
lea r9, [rdx + r9]
jmp r9
mov r8d, dword [rbp - 0x1a0]
shr r8, 1
mov qword [rbp - 0x40], r8
mov qword [rbp - 0x38], rsi
cmp qword [rbp - 0x40], 0
je 0x14004e853
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x40]
lea r9, [rsi + rdx*2]
cmp word [r9 - 2], 0
jne 0x14004e853
lea rdx, [rbp - 0x40]
mov rax, qword [rbp - 0x40]
lea rcx, [rax - 1]
sub rsp, 0x20
call fcn.14005e230
add rsp, 0x20
mov rbx, qword [rbp - 0x40]
mov qword [rbp - 0x30], rbx
mov rsi, qword [rbp - 0x38]
mov qword [rbp - 0x28], rsi
lea rcx, [rbp - 0x30]
sub rsp, 0x20
call fcn.140023420
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
jmp 0x14004e944
mov ecx, dword [rbp - 0x1a8]
sub rsp, 0x20
call fcn.140009550
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
jmp 0x14004e944
mov ecx, dword [rbp - 0x1a8]
bswap ecx
sub rsp, 0x20
call fcn.140009550
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
jmp 0x14004e944
mov rcx, qword [rbp - 0x1a8]
sub rsp, 0x20
call fcn.140012dc0
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
jmp 0x14004e944
sub rsp, 0x20
call fcn.14004d7e0
add rsp, 0x20
mov rsi, rax
sub rsp, 8
lea rax, str.Cannot_read_the_given_value_as_a_string
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], 0x27
lea rdx, [rbp - 0x20]
push rdx
lea rbx, str.stdwindows_registry.d
mov qword [rbp - 8], rbx
mov qword [rbp - 0x10], 0x16
lea r9, [rbp - 0x10]
mov r8d, 0x247
xor edx, edx
mov rcx, rsi
sub rsp, 0x20
call fcn.140041430
add rsp, 0x30
mov rcx, rax
sub rsp, 0x20
call fcn.140019e30
sub rsp, 8
call fcn.14004e953
add rsp, 8
jmp 0x14004e968
mov rbx, qword [rbp - 0x1d0]
mov rsi, qword [rbp - 0x1c8]
mov rdi, qword [rbp - 0x1c0]
mov r12, qword [rbp - 0x1b8]
mov rsp, rbp
pop rbp
ret