Function at 0x1400208f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x300
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x340], rbx
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0xd0], rcx
call fcn.140001540
mov rcx, rax
test rax, rax
je 0x140020bcb
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140027f5e.0]
add rax, 0x18
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0xd8], 0x104
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Identifier
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea r8, [rsp + 0xe0]
lea rdx, [0x14002e674]
lea rcx, [rsp + 0xd0]
call fcn.14000b890
mov rbx, qword [rsp + 0xd0]
mov rsi, rbx
xor r15d, r15d
mov edi, r15d
movzx eax, word [rbx]
lea r14d, [r15 + 1]
test ax, ax
je 0x140020a48
nop
movzx ecx, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x1400209ec
mov rax, rsi
test rdi, rdi
cmovne rax, rdi
mov rdi, rax
jmp 0x1400209ef
mov rdi, r15
add rsi, 2
movzx eax, word [rsi]
test ax, ax
jne 0x1400209d0
test rdi, rdi
je 0x140020a48
sub rdi, rbx
sar rdi, 1
test edi, edi
js 0x140020bd6
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140020a34
mov edx, edi
lea rcx, [rsp + 0xd0]
call fcn.14000b430
mov rbx, qword [rsp + 0xd0]
cmp edi, dword [rbx - 0xc]
jg 0x140020bec
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], r15w
mov rdi, rbx
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x140020b13
nop dword [rax]
add rdi, 2
movzx ecx, word [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
jne 0x140020a60
cmp rdi, rbx
je 0x140020b13
sub rdi, rbx
sar rdi, 1
mov edx, dword [rbx - 0x10]
test edx, edx
js 0x140020be1
sub r14d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, r14d
jge 0x140020aae
lea rcx, [rsp + 0xd0]
call fcn.14000b430
mov rbx, qword [rsp + 0xd0]
movsxd rax, edi
lea rdx, [rbx + rax*2]
mov ecx, dword [rbx - 0x10]
mov esi, ecx
sub esi, edi
lea eax, [rsi + 1]
movsxd r8, eax
add r8, r8
je 0x140020af7
test rdx, rdx
jne 0x140020add
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
jmp 0x140020baf
lea eax, [rcx + 1]
movsxd rcx, eax
add rcx, rcx
cmp rcx, r8
jb 0x140020ba2
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
test esi, esi
js 0x140020bc0
cmp esi, dword [rbx - 0xc]
jg 0x140020bc0
mov dword [rbx - 0x10], esi
movsxd rax, esi
mov word [rbx + rax*2], r15w
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov r8d, 3
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14000d4a0
nop
mov rdx, qword [rsp + 0x40]
mov rcx, rbp
call fcn.14000a5b0
nop
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
cmp rcx, rax
je 0x140020b55
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
lea rdx, [rbx - 0x18]
mov ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140020b78
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x140027f5e.0]
mov rax, rbp
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.140027890
mov rbx, qword [rsp + 0x340]
add rsp, 0x300
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
nop
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.140001280
int3
mov ecx, 0x80070057
call fcn.140001280
nop
mov ecx, 0x80004005
call fcn.140001280
nop
mov ecx, 0x80070057
call fcn.140001280
int3
mov ecx, 0x80070057
call fcn.140001280
int3
mov ecx, 0x80070057
call fcn.140001280
int3