Function at 0x140043dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x220
mov qword [rbp - 0x1f8], rbx
mov qword [rbp - 0x1f0], rsi
mov qword [rbp - 0x1e8], rdi
mov qword [rbp - 0x1e0], r12
mov qword [rbp - 0x1d8], r13
mov r13, rcx
mov rbx, rdx
mov rsi, r8
mov rdi, r9
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov dword [rbp - 0x10], 0xffffffff
mov rdx, qword [rsi + 8]
mov rax, qword [rsi]
mov qword [rbp - 0x1b0], rax
mov qword [rbp - 0x1a8], rdx
lea rdx, [rbp - 0x1b0]
lea rcx, [rbp - 0x120]
call fcn.14000f370
mov edx, 0x100
lea rcx, [0x140212320]
sub rsp, 0x20
call fcn.14001f610
add rsp, 0x20
mov qword [rbp - 0x1a0], rax
mov qword [rbp - 0x198], rdx
mov rcx, qword [rbp - 0x1a0]
add rcx, rcx
sub rsp, 0x20
call fcn.1400111f0
add rsp, 0x20
mov dword [rbp - 0xc], eax
lea rcx, [rbp - 0x120]
sub rsp, 0x20
call fcn.1400028b0
add rsp, 0x20
mov r12, rax
lea r8, [rbp - 0x10]
mov rdx, qword [rbp - 0x198]
lea r9, [rbp - 0xc]
push r9
push rdx
mov r9, r8
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov esi, eax
cmp esi, 0xea
jne 0x140043f26
lea rdx, [rbp - 0x1a0]
mov ecx, dword [rbp - 0xc]
shr rcx, 1
sub rsp, 0x20
call fcn.140004ca0
add rsp, 0x20
lea rcx, [rbp - 0x120]
sub rsp, 0x20
call fcn.1400028b0
add rsp, 0x20
mov r12, rax
lea r8, [rbp - 0x10]
mov r9, qword [rbp - 0x198]
lea rdx, [rbp - 0xc]
push rdx
push r9
mov r9, r8
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov esi, eax
jmp 0x140043f44
test esi, esi
jne 0x140043f44
lea rdx, [rbp - 0x1a0]
mov ecx, dword [rbp - 0xc]
shr rcx, 1
sub rsp, 0x20
call fcn.140004ca0
add rsp, 0x20
mov r9d, esi
lea r10, [0x1400441b0]
mov qword [rbp - 0x178], r10
xor r8d, r8d
mov qword [rbp - 0x180], r8
lea r8, [rbp - 0x180]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 0x168], rcx
mov qword [rbp - 0x170], 0x16
lea rdx, [rbp - 0x170]
mov ecx, 0x261
sub rsp, 0x20
call fcn.1400426e0
add rsp, 0x20
cmp dword [rbp - 0x10], 7
sete dl
lea r8, [0x1400441c0]
mov qword [rbp - 0x1c8], r8
mov qword [rbp - 0x1d0], 0
lea rcx, [rbp - 0x1d0]
sub rsp, 0x20
call fcn.140004490
add rsp, 0x20
cmp dword [rbp - 0x10], r13d
sete dl
lea r9, [0x140044230]
mov qword [rbp - 0x148], r9
mov qword [rbp - 0x150], 0
lea rcx, [rbp - 0x150]
sub rsp, 0x20
call fcn.140004490
add rsp, 0x20
lea rdx, [rbp - 0x1a0]
mov rcx, qword [rbp - 0x1a0]
dec rcx
sub rsp, 0x20
call fcn.140004ca0
add rsp, 0x20
cmp qword [rbp - 0x1a0], 0
je 0x140044068
mov rdi, qword [rbp - 0x1a0]
mov r8, qword [rbp - 0x1a0]
mov r9, qword [rbp - 0x198]
lea r10, [r9 + r8*2]
cmp word [r10 - 2], 0
jne 0x140044068
lea rdx, [rbp - 0x1a0]
mov rax, qword [rbp - 0x1a0]
lea rcx, [rax - 1]
sub rsp, 0x20
call fcn.140004ca0
add rsp, 0x20
mov r8, qword [rbp - 0x1a0]
mov qword [rbp - 0x190], r8
mov r9, qword [rbp - 0x198]
mov qword [rbp - 0x188], r9
lea rdx, [rbp - 0x190]
lea r10, [0x140220090]
mov qword [rbp - 0x1b8], r10
mov qword [rbp - 0x1c0], 1
lea rcx, [rbp - 0x1c0]
sub rsp, 0x20
call fcn.14005adc0
add rsp, 0x20
mov qword [rbp - 0x140], rax
mov qword [rbp - 0x138], rdx
mov rdx, rbx
mov rcx, qword [rbp - 0x140]
sub rsp, 0x20
call fcn.14004ae50
add rsp, 0x20
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x130], rax
mov qword [rbp - 0x128], rdx
xor esi, esi
cmp qword [rbp - 0x130], rsi
je 0x140044159
mov rdi, qword [rbp - 0x128]
mov rbx, qword [rbp - 0x138]
mov r12, rdi
mov r13, rsi
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x160], rax
mov qword [rbp - 0x158], rdx
lea rcx, [rbp - 0x160]
sub rsp, 0x20
call fcn.1400112a0
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
mov r8d, 0x10
add rdi, r8
add rbx, r8
inc rsi
cmp rsi, qword [rbp - 0x130]
jb 0x14004410b
sub rsp, 8
call fcn.140044168
add rsp, 8
jmp 0x14004417d
mov rbx, qword [rbp - 0x1f8]
mov rsi, qword [rbp - 0x1f0]
mov rdi, qword [rbp - 0x1e8]
mov r12, qword [rbp - 0x1e0]
mov r13, qword [rbp - 0x1d8]
mov rsp, rbp
pop rbp
ret