Function at 0x14010c6d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1f0
mov qword [rbp - 0x1d0], rbx
mov qword [rbp - 0x1c8], rsi
mov qword [rbp - 0x1c0], rdi
mov qword [rbp - 0x1b8], r12
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x20], r8
mov rdi, rdx
mov rbx, r9
mov qword [rdi], 0
mov qword [rdi + 8], 0
mov dword [rbp - 0x1b0], 0xffffffff
mov qword [rbp - 0x1a8], 0
lea rsi, [rbp - 0x1a8]
mov dword [rbp - 0x1a0], 8
mov r10, qword [rbp + 0x20]
mov rdx, qword [r10 + 8]
mov rax, qword [r10]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdx
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x190]
call fcn.1400c90d0
lea rcx, [rbp - 0x190]
sub rsp, 0x20
call fcn.14000e7a0
add rsp, 0x20
lea r8, [rbp - 0x1b0]
lea r9, [rbp - 0x1a8]
lea rdx, [rbp - 0x1a0]
push rdx
push r9
mov r9, r8
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov r12d, eax
cmp r12d, 0xea
jne 0x14010c80b
mov edx, dword [rbp - 0x1a0]
lea rcx, [0x140183c70]
sub rsp, 0x20
call fcn.1400aaba0
add rsp, 0x20
mov rsi, rdx
lea rcx, [rbp - 0x190]
sub rsp, 0x20
call fcn.14000e7a0
add rsp, 0x20
lea r8, [rbp - 0x1b0]
lea r9, [rbp - 0x1a0]
push r9
push rsi
mov r9, r8
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov r12d, eax
mov r9d, r12d
lea r10, [0x14010ca60]
mov qword [rbp - 0x68], r10
xor r8d, r8d
mov qword [rbp - 0x70], r8
lea r8, [rbp - 0x70]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x60], reloc.WS2_32.dll_shutdown
lea rdx, [rbp - 0x60]
mov ecx, 0x221
sub rsp, 0x20
call fcn.14010b180
add rsp, 0x20
mov r9d, dword [rbp - 0x1b0]
cmp r9d, dword [rbp + 0x10]
sete dl
lea r8, [0x14010ca70]
mov qword [rbp - 0x48], r8
mov qword [rbp - 0x50], 0
lea rcx, [rbp - 0x50]
sub rsp, 0x20
call fcn.140016b90
add rsp, 0x20
mov ebx, dword [rbp - 0x1b0]
cmp ebx, 0xb
ja case.0x14010c89f.0
mov ebx, ebx
lea r9, [0x14010ca28]
movsxd rdx, dword [r9 + rbx*4]
lea r9, [rdx + r9]
jmp r9
mov r8d, dword [rbp - 0x1a0]
shr r8, 1
mov qword [rbp - 0x40], r8
mov qword [rbp - 0x38], rsi
cmp qword [rbp - 0x40], 0
je 0x14010c8e8
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x40]
lea r9, [rsi + rdx*2]
cmp word [r9 - 2], 0
jne 0x14010c8e8
lea rdx, [rbp - 0x40]
mov rax, qword [rbp - 0x40]
lea rcx, [rax - 1]
sub rsp, 0x20
call fcn.140115a40
add rsp, 0x20
mov rbx, qword [rbp - 0x40]
mov qword [rbp - 0x30], rbx
mov rsi, qword [rbp - 0x38]
mov qword [rbp - 0x28], rsi
lea rcx, [rbp - 0x30]
sub rsp, 0x20
call fcn.1400c9910
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
jmp 0x14010c9e0
mov ecx, dword [rbp - 0x1a8]
sub rsp, 0x20
call fcn.140115a70
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
jmp 0x14010c9e0
mov ecx, dword [rbp - 0x1a8]
bswap ecx
sub rsp, 0x20
call fcn.140115a70
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
jmp 0x14010c9e0
mov rcx, qword [rbp - 0x1a8]
sub rsp, 0x20
call fcn.14000d020
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
jmp 0x14010c9e0
lea rcx, [0x1401d00f0]
sub rsp, 0x20
call fcn.1400a9c50
add rsp, 0x20
mov rsi, rax
sub rsp, 8
lea rax, str.Cannot_read_the_given_value_as_a_string
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], 0x27
lea rdx, [rbp - 0x20]
push rdx
lea rbx, str.stdwindows_registry.d
mov qword [rbp - 8], rbx
mov qword [rbp - 0x10], reloc.WS2_32.dll_shutdown
lea r9, [rbp - 0x10]
mov r8d, 0x247
xor edx, edx
mov rcx, rsi
sub rsp, 0x20
call fcn.140102a50
add rsp, 0x30
mov rcx, rax
sub rsp, 0x20
call fcn.1400b3dc0
sub rsp, 8
call fcn.14010c9ef
add rsp, 8
jmp 0x14010ca04
mov rbx, qword [rbp - 0x1d0]
mov rsi, qword [rbp - 0x1c8]
mov rdi, qword [rbp - 0x1c0]
mov r12, qword [rbp - 0x1b8]
mov rsp, rbp
pop rbp
ret