Function at 0x140009540
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xfd0]
mov eax, 0x10d0
call fcn.1400641b0
sub rsp, rax
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x1118], rbx
mov rax, qword [0x140132280]
xor rax, rsp
mov qword [rbp + 0xfc8], rax
mov rbx, r8
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x70], rdx
xor r15d, r15d
mov dword [rsp + 0x40], r15d
mov dword [rbp + 0xfa0], r15d
mov rdx, r8
lea rcx, [rsp + 0x48]
call fcn.140002ec0
nop
cmp qword [rax + 0x18], 8
jb 0x1400095b4
mov rax, qword [rax]
lea rcx, [rbp + 0xfa0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9d, 2
mov r8, rax
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x1400095fd
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.1400046b0
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r15
mov word [rsp + 0x48], r15w
test esi, esi
je 0x140009654
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140002e70
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000962d
mov rax, qword [rax]
mov r9d, esi
mov r8, rax
lea rdx, str.Could_not_query_value_size_while_attempting_to_get_registry_value_as_string_with_name__s___i_.
lea rcx, [rbp - 0x80]
call fcn.140007170
lea rdx, [0x14012e008]
lea rcx, [rbp - 0x80]
call fcn.140066028
nop
mov edx, dword [rbp + 0xfa0]
shr rdx, 1
mov qword [rbp + 0xfb8], r15
mov qword [rbp + 0xfc0], r15
mov qword [rbp + 0xfc0], 7
mov qword [rbp + 0xfb8], r15
mov word [rbp + 0xfa8], r15w
xor r8d, r8d
lea rcx, [rbp + 0xfa8]
call fcn.140003880
nop
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140002ec0
nop
lea rcx, [rbp + 0xfa8]
cmp qword [rbp + 0xfc0], 8
cmovae rcx, qword [rbp + 0xfa8]
cmp qword [rax + 0x18], 8
jb 0x1400096c4
mov rax, qword [rax]
lea rdx, [rbp + 0xfa0]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
mov r9d, 2
mov r8, rax
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x14000970d
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.1400046b0
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r15
mov word [rsp + 0x48], r15w
test esi, esi
je 0x14000976c
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140002e70
mov rbx, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000973f
mov rbx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, rbx
lea rdx, str.Could_not_get_registry_value_as_string_with_name__s___i_.
lea rcx, [rbp - 0x80]
call fcn.140007170
lea rdx, [0x14012e008]
lea rcx, [rbp - 0x80]
call fcn.140066028
nop
lea rdx, [rbp + 0xfa8]
cmp qword [rbp + 0xfc0], 8
cmovae rdx, qword [rbp + 0xfa8]
mov r8d, dword [rbp + 0xfa0]
shr r8d, 1
dec r8d
mov rcx, rdi
call fcn.140002e20
nop
mov dword [rsp + 0x40], 1
mov r8, qword [rbp + 0xfc0]
cmp r8, 8
jb 0x1400097c4
inc r8
mov rdx, qword [rbp + 0xfa8]
lea rcx, [rbp + 0xfa8]
call fcn.1400046b0
mov qword [rbp + 0xfc0], 7
mov qword [rbp + 0xfb8], r15
mov word [rbp + 0xfa8], r15w
mov rax, rdi
mov rcx, qword [rbp + 0xfc8]
xor rcx, rsp
call fcn.140063ed0
mov rbx, qword [rsp + 0x1118]
add rsp, 0x10d0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret