Function at 0x140058f70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1f0
mov qword [rbp - 0x1d0], rbx
mov qword [rbp - 0x1c8], rsi
mov qword [rbp - 0x1c0], rdi
mov qword [rbp - 0x1b8], r12
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x20], r8
mov rdi, rdx
mov rbx, r9
mov qword [rdi], 0
mov qword [rdi + 8], 0
mov dword [rbp - 0x1b0], 0xffffffff
mov qword [rbp - 0x1a8], 0
lea rsi, [rbp - 0x1a8]
mov dword [rbp - 0x1a0], 8
mov r10, qword [rbp + 0x20]
mov rdx, qword [r10 + 8]
mov rax, qword [r10]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdx
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x190]
call fcn.14001a170
lea rcx, [rbp - 0x190]
sub rsp, 0x20
call fcn.14000b2c0
add rsp, 0x20
lea r8, [rbp - 0x1b0]
lea r9, [rbp - 0x1a8]
lea rdx, [rbp - 0x1a0]
push rdx
push r9
mov r9, r8
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov r12d, eax
cmp r12d, 0xea
jne 0x1400590ab
mov edx, dword [rbp - 0x1a0]
lea rcx, [0x1400b9ad0]
sub rsp, 0x20
call fcn.14000c680
add rsp, 0x20
mov rsi, rdx
lea rcx, [rbp - 0x190]
sub rsp, 0x20
call fcn.14000b2c0
add rsp, 0x20
lea r8, [rbp - 0x1b0]
lea r9, [rbp - 0x1a0]
push r9
push rsi
mov r9, r8
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov r12d, eax
mov r9d, r12d
lea r10, [0x140059300]
mov qword [rbp - 0x68], r10
xor r8d, r8d
mov qword [rbp - 0x70], r8
lea r8, [rbp - 0x70]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x60], 0x16
lea rdx, [rbp - 0x60]
mov ecx, 0x221
sub rsp, 0x20
call fcn.140057db0
add rsp, 0x20
mov r9d, dword [rbp - 0x1b0]
cmp r9d, dword [rbp + 0x10]
sete dl
lea r8, [0x140059310]
mov qword [rbp - 0x48], r8
mov qword [rbp - 0x50], 0
lea rcx, [rbp - 0x50]
sub rsp, 0x20
call fcn.140003f20
add rsp, 0x20
mov ebx, dword [rbp - 0x1b0]
cmp ebx, 0xb
ja case.0x14005913f.0
mov ebx, ebx
lea r9, [0x1400592c8]
movsxd rdx, dword [r9 + rbx*4]
lea r9, [rdx + r9]
jmp r9
mov r8d, dword [rbp - 0x1a0]
shr r8, 1
mov qword [rbp - 0x40], r8
mov qword [rbp - 0x38], rsi
cmp qword [rbp - 0x40], 0
je 0x140059188
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x40]
lea r9, [rsi + rdx*2]
cmp word [r9 - 2], 0
jne 0x140059188
lea rdx, [rbp - 0x40]
mov rax, qword [rbp - 0x40]
lea rcx, [rax - 1]
sub rsp, 0x20
call fcn.140066e30
add rsp, 0x20
mov rbx, qword [rbp - 0x40]
mov qword [rbp - 0x30], rbx
mov rsi, qword [rbp - 0x38]
mov qword [rbp - 0x28], rsi
lea rcx, [rbp - 0x30]
sub rsp, 0x20
call fcn.14001b850
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
jmp 0x140059280
mov ecx, dword [rbp - 0x1a8]
sub rsp, 0x20
call fcn.140055340
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
jmp 0x140059280
mov ecx, dword [rbp - 0x1a8]
bswap ecx
sub rsp, 0x20
call fcn.140055340
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
jmp 0x140059280
mov rcx, qword [rbp - 0x1a8]
sub rsp, 0x20
call fcn.14000a0b0
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
jmp 0x140059280
lea rcx, [0x1400cced0]
sub rsp, 0x20
call fcn.140010940
add rsp, 0x20
mov rsi, rax
sub rsp, 8
lea rax, str.Cannot_read_the_given_value_as_a_string
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], 0x27
lea rdx, [rbp - 0x20]
push rdx
lea rbx, str.stdwindows_registry.d
mov qword [rbp - 8], rbx
mov qword [rbp - 0x10], 0x16
lea r9, [rbp - 0x10]
mov r8d, 0x247
xor edx, edx
mov rcx, rsi
sub rsp, 0x20
call fcn.140050480
add rsp, 0x30
mov rcx, rax
sub rsp, 0x20
call fcn.1400109f0
sub rsp, 8
call fcn.14005928f
add rsp, 8
jmp 0x1400592a4
mov rbx, qword [rbp - 0x1d0]
mov rsi, qword [rbp - 0x1c8]
mov rdi, qword [rbp - 0x1c0]
mov r12, qword [rbp - 0x1b8]
mov rsp, rbp
pop rbp
ret