Function at 0x140009234
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140036150]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, qword [rbp + 0x60]
xor r13d, r13d
mov r14, r9
mov r12, rdx
test rsi, rsi
jne 0x140009283
lea r8, str.psczValue
mov edx, 0x13d
lea rcx, str.onecore_basecbsutilcbsreg.cpp
call fcn.140007e20
mov qword [rbp - 0x18], r13
mov ebx, r13d
mov qword [rbp - 0x20], r13
mov rdi, r13
mov dword [rbp - 0xc], r13d
mov r15d, r13d
mov dword [rbp - 0x10], r13d
mov rcx, 0xffffffff80000002
test r12, r12
je 0x14000931d
lea rax, [rbp - 0x18]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ecx, eax
add eax, 0xfffffffe
cmp eax, 1
ja 0x1400092e1
movzx ebx, cx
or ebx, 0x80070000
jmp 0x1400094ff
test ecx, ecx
je 0x140009317
jg 0x1400092eb
mov ebx, ecx
jmp 0x1400092f4
movzx ebx, cx
or ebx, 0x80070000
lea r9, str.Failed_to_open_the_registry_root:_n_a__key:__S.
mov qword [rsp + 0x20], r12
mov r8d, 1
mov edx, ebx
mov ecx, 0x4000000
call fcn.1400066ac
jmp 0x1400094ff
mov rcx, qword [rbp - 0x18]
jmp 0x140009321
mov qword [rbp - 0x18], rcx
cmp qword [rsi], r13
je 0x140009427
mov rcx, qword [rsi]
lea rdx, [rbp - 0x20]
call fcn.140008a68
mov ebx, eax
test eax, eax
jns 0x14000935a
lea r9, str.Failed_to_determine_size_of_string.
mov edx, eax
mov r8d, 1
mov ecx, 0x4000000
call fcn.1400066ac
jmp 0x1400094fa
mov rdi, qword [rbp - 0x20]
mov ecx, 0xffffffff
lea rax, [rdi*2 - 4]
cmp rax, rcx
ja 0x140009411
mov rcx, qword [rbp - 0x18]
lea r9, [rbp - 0xc]
mov dword [rbp - 0x10], eax
xor r8d, r8d
lea rax, [rbp - 0x10]
mov rdx, r14
mov qword [rsp + 0x28], rax
mov rax, qword [rsi]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x1400093cb
lea r15d, [rax + 1]
mov ebx, r13d
mov eax, dword [rbp - 0xc]
dec eax
cmp eax, 1
jbe 0x140009470
mov ebx, 0x8007000d
lea r9, str.Registry_value_is_not_a_string_type.
jmp 0x140009420
cmp eax, 0xea
je 0x1400093ac
cmp eax, 2
jne 0x1400093e1
mov ebx, 0x80070002
jmp 0x1400094fa
test eax, eax
jle 0x1400093ee
movzx ebx, ax
or ebx, 0x80070000
lea r9, str.Failed_initial_query_of_value_to_get_type__size__and_value_of_registry_value:__S
mov edx, ebx
mov r8d, 1
mov qword [rsp + 0x20], r14
mov ecx, 0x4000000
call fcn.1400066ac
jmp 0x1400094fa
mov dword [rbp - 0x10], ecx
lea r9, str.Failed_to_convert_cchValue_to_DWORD
mov ebx, 0x80070216
mov edx, ebx
jmp 0x140009345
lea rax, [rbp - 0x10]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0xc]
mov rdx, r14
mov qword [rsp + 0x20], r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
cmp eax, 2
je 0x1400093d7
test eax, eax
je 0x1400093af
jg 0x14000945e
mov ebx, eax
jmp 0x140009467
movzx ebx, ax
or ebx, 0x80070000
lea r9, str.Failed_to_query_value_to_get_type_and_size_of_registry_root:_n_a__value:__S
jmp 0x1400093f5
test r15d, r15d
jne 0x1400094e8
mov edi, dword [rbp - 0x10]
mov rcx, rsi
shr rdi, 1
add rdi, 2
mov rdx, rdi
call fcn.140007fe4
mov ebx, eax
test eax, eax
jns 0x14000949e
lea r9, str.Failed_to_allocate_string_to_read_registry_value:__S
mov edx, eax
jmp 0x1400093f7
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0xc]
mov rax, qword [rsi]
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x1400094e8
jg 0x1400094d3
mov ebx, eax
jmp 0x1400094dc
movzx ebx, ax
or ebx, 0x80070000
lea r9, str.Failed_to_query_registry_value:__S
jmp 0x1400093f5
mov rax, qword [rsi]
mov word [rax + rdi*2 - 4], r13w
mov rax, qword [rsi]
mov word [rax + rdi*2 - 2], r13w
test r12, r12
je 0x140009514
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140009514
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001450
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret