Function at 0x1400040e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12, r8
mov r14, r9
mov r13, rdx
mov rbx, rcx
lea r8, str.d:_build_ob_bora_621624_bora_lib_winregistry_winregistry.c
mov r9d, 0xa2
mov edx, 0x800
or ecx, 0xffffffff
mov dword [rsp + 0x30], 0x800
mov dword [rsp + 0x34], 1
call sub.vmtools.dll_Util_SafeInternalMalloc
mov edx, 1
mov rcx, r13
mov rsi, rax
call sub.vmtools.dll_Unicode_GetAllocBytes
mov edx, 1
mov rcx, r12
mov r15, rax
call sub.vmtools.dll_Unicode_GetAllocBytes
mov r9d, 1
mov rbp, rax
lea rax, [rsp + 0x38]
xor r8d, r8d
mov rdx, r15
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
je 0x1400041ab
mov rcx, r12
call sub.vmtools.dll_Unicode_GetUTF8
mov rcx, r13
mov rbx, rax
call sub.vmtools.dll_Unicode_GetUTF8
lea rdx, str.WinRegGetSZInt
lea rcx, str._s:_A_Windows_registry_operation_failed:_Failed_to_open_key._key_path:__s__value_name:__s_n
mov r9, rbx
mov r8, rax
call sub.vmtools.dll_Log
jmp 0x1400042b2
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, 0xea
jne 0x140004255
mov rcx, r12
call sub.vmtools.dll_Unicode_GetUTF8
mov rcx, r13
mov rbx, rax
call sub.vmtools.dll_Unicode_GetUTF8
mov r8d, dword [rsp + 0x30]
lea rdx, str.WinRegGetSZInt
lea rcx, str._s:_A_Windows_registry_operation_failed:_buffer_too_small__need__d_bytes._key_path:__s__value_name:__s.__Resizing_buffer_to_retry._n
mov r9, rax
mov qword [rsp + 0x20], rbx
call sub.vmtools.dll_Log
mov r8d, dword [rsp + 0x30]
lea r9, str.d:_build_ob_bora_621624_bora_lib_winregistry_winregistry.c
mov rdx, rsi
or ecx, 0xffffffff
mov dword [rsp + 0x20], 0xc2
call sub.vmtools.dll_Util_SafeInternalRealloc
mov rcx, qword [rsp + 0x38]
mov rsi, rax
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, dword [rsp + 0x34]
cmp r11d, 1
je 0x1400042ef
cmp r11d, 2
je 0x1400042ef
mov rcx, r12
call sub.vmtools.dll_Unicode_GetUTF8
mov rcx, r13
mov rbx, rax
call sub.vmtools.dll_Unicode_GetUTF8
mov r9d, dword [rsp + 0x34]
lea rdx, str.WinRegGetSZInt
lea rcx, str._s:_A_Windows_registry_operation_failed:__d._registry_value_TYPE_is__d._key_path:__s__value_name:__s_n
mov r8d, edi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call sub.vmtools.dll_Log
mov edi, 0xd
mov rcx, rsi
call qword [sym.imp.MSVCR90.dll_free]
mov rcx, r15
call qword [sym.imp.MSVCR90.dll_free]
mov rcx, rbp
call qword [sym.imp.MSVCR90.dll_free]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov eax, edi
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
test edi, edi
jne 0x1400042b2
mov ecx, dword [rsp + 0x30]
cmp ecx, 2
jb 0x1400042ad
mov eax, ecx
shr eax, 1
dec eax
cmp word [rsi + rax*2], di
je 0x14000431d
lea rdx, str.WinRegGetSZInt
lea rcx, str._s:_Registry_string_not_terminated_correctly_n
call sub.vmtools.dll_Log
jmp 0x1400042ad
mov rax, qword [rsp + 0x90]
test rax, rax
je 0x14000432c
mov dword [rax], ecx
mov rax, qword [rsp + 0x98]
test rax, rax
je 0x14000433c
mov dword [rax], r11d
mov qword [r14], rsi
jmp 0x1400042bb