Function at 0x140023330
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x178
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], 0xfffffffffffffffe
mov rsi, r9
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [r9], xmm0
mov dword [rbp + 0xec], 0xffffffff
mov qword [rbp + 0xe0], 0
mov dword [rbp + 0xe8], 8
lea rdi, [rbp - 0x40]
mov rcx, rdi
call fcn.140022090
mov rcx, rdi
call fcn.140022330
lea r15, [rbp + 0xe8]
mov qword [rsp + 0x28], r15
lea rdi, [rbp + 0xe0]
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0xec]
mov rcx, rbx
mov rdx, rax
xor r8d, r8d
call sub.ADVAPI32.dll_RegQueryValueExW
mov r14d, eax
cmp eax, 0xea
jne 0x140023409
mov edx, dword [rbp + 0xe8]
lea rcx, [0x1400b7008]
call fcn.14002e9f0
mov rdi, rdx
lea rcx, [rbp - 0x40]
call fcn.140022330
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0xec]
mov rcx, rbx
mov rdx, rax
xor r8d, r8d
call sub.ADVAPI32.dll_RegQueryValueExW
mov r14d, eax
test r14d, r14d
jne 0x1400234e3
mov eax, dword [rbp + 0x150]
cmp dword [rbp + 0xec], eax
sete cl
lea r8, [0x140023660]
xor edx, edx
call fcn.140057ee0
mov eax, dword [rbp + 0xec]
dec eax
cmp eax, 0xa
ja case.0x14002344e.3
lea rcx, [0x1400957b4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov eax, dword [rbp + 0xe8]
mov edx, eax
shr edx, 1
mov qword [rbp + 0xd0], rdx
mov qword [rbp + 0xd8], rdi
cmp eax, 2
jb 0x140023492
cmp word [rdi + rdx*2 - 2], 0
jne 0x140023492
dec rdx
lea rcx, [rbp + 0xd0]
call fcn.140015e00
mov rdx, qword [rbp + 0xd0]
mov rdi, qword [rbp + 0xd8]
mov rcx, rdx
mov rdx, rdi
call fcn.140003b50
jmp 0x1400234c2
mov rcx, qword [rbp + 0xe0]
call fcn.140059310
jmp 0x1400234c2
mov ecx, dword [rbp + 0xe0]
jmp 0x1400234bd
mov ecx, dword [rbp + 0xe0]
bswap ecx
call fcn.140059b50
mov qword [rsi], rax
mov qword [rsi + 8], rdx
lea rcx, [rbp - 0x40]
call fcn.140022270
nop
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, [0x1400beb30]
call fcn.14002da30
mov rsi, rax
lea rax, [0x140094df0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
movups xmm0, xmmword [0x140094e58]
movups xmmword [rsi + 0x10], xmm0
movups xmm0, xmmword [0x140094e68]
movups xmmword [rsi + 0x20], xmm0
movups xmm0, xmmword [0x140094e78]
movups xmmword [rsi + 0x30], xmm0
movups xmm0, xmmword [0x140094e88]
movups xmmword [rsi + 0x40], xmm0
mov rax, qword [0x140094e98]
mov qword [rsi + 0x50], rax
lea rax, str.stdwindows_registry.d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x221
mov qword [rsp + 0x20], reloc.WS2_32.dll_shutdown
lea r9, str.Cannot_read_the_requested_value
mov r8d, 0x1f
mov rcx, rsi
mov edx, r14d
call fcn.140022450
mov rcx, rsi
call fcn.140011610
lea rcx, [0x1400beb30]
call fcn.14002da30
mov rsi, rax
lea rax, [0x140094df0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
movups xmm0, xmmword [0x140094e58]
movups xmmword [rsi + 0x10], xmm0
movups xmm0, xmmword [0x140094e68]
movups xmmword [rsi + 0x20], xmm0
movups xmm0, xmmword [0x140094e78]
movups xmmword [rsi + 0x30], xmm0
movups xmm0, xmmword [0x140094e88]
movups xmmword [rsi + 0x40], xmm0
mov rax, qword [0x140094e98]
mov qword [rsi + 0x50], rax
lea rax, str.stdwindows_registry.d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x247
mov qword [rsp + 0x20], reloc.WS2_32.dll_shutdown
lea r9, str.Cannot_read_the_given_value_as_a_string
mov r8d, 0x27
mov rcx, rsi
xor edx, edx
call fcn.140022450
mov rcx, rsi
call fcn.140011610
int3