Function at 0x18021f680
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rsi, r8
mov rbx, rcx
mov rax, rdx
lea rcx, [rbp - 0x11]
xor r14d, r14d
mov qword [rsp + 0x20], rcx
mov rdi, r9
mov qword [rbp - 0x11], r14
mov rdx, qword [rsi]
xor r8d, r8d
mov rcx, rax
lea r9d, [r14 + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rbp - 0x19], eax
test eax, eax
je 0x18021f731
call fcn.180270610
lea rcx, str.___Failed_to_open_registry_key_
mov qword [rbp - 1], r14
mov qword [rbp + 0x17], rcx
lea r9, [rbp + 0x17]
lea rcx, [rbp - 0x19]
mov qword [rbp - 9], r14
movups xmm0, xmmword [rbp - 9]
mov qword [rbp + 7], r14
lea r8d, [r14 + 4]
movsd xmm1, qword [rbp + 7]
lea rdx, [rbp + 0x27]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov qword [rbp + 0x1f], 0x23
movaps xmmword [rbp + 0x27], xmm0
movsd qword [rbp + 0x37], xmm1
call fcn.18021f110
mov byte [rbx + 4], r14b
jmp 0x18021f895
mov rsi, qword [rdi]
lea rax, [rbp + 0xf]
mov rcx, qword [rbp - 0x11]
lea r9, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov rdx, rsi
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov dword [rbp + 0x77], r14d
mov dword [rbp + 0xf], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rbp - 0x19], eax
test eax, eax
je 0x18021f7d2
call fcn.180270610
lea rcx, str.___Failed_to_query_registry_value_
mov qword [rbp + 0x1f], 0x26
mov qword [rbp + 0x17], rcx
lea r9, [rbp + 0x17]
lea rcx, [rbp - 0x19]
mov qword [rbp - 9], r14
mov qword [rbp - 1], r14
lea rdx, [rbp + 0x27]
movups xmm0, xmmword [rbp - 9]
mov qword [rbp + 7], r14
mov r8d, 4
movsd xmm1, qword [rbp + 7]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
mov rcx, rax
movaps xmmword [rbp + 0x27], xmm0
movsd qword [rbp + 0x37], xmm1
call fcn.18021f110
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rbx + 4], r14b
jmp 0x18021f895
cmp dword [rbp + 0x77], 4
je 0x18021f839
call fcn.180270610
lea rcx, str.Registry_value_is_not_of_type_REG_DWORD:_
mov qword [rbp - 1], r14
mov qword [rbp + 0x17], rcx
lea r9, [rbp + 0x17]
mov qword [rbp - 9], r14
lea rdx, [rbp + 0x27]
movups xmm0, xmmword [rbp - 9]
mov qword [rbp + 7], r14
mov rcx, rax
movsd xmm1, qword [rbp + 7]
mov r8d, 4
movaps xmmword [rbp + 0x27], xmm0
mov qword [rbp + 0x1f], 0x2b
movsd qword [rbp + 0x37], xmm1
mov qword [rsp + 0x20], rdi
call fcn.18021f3e0
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rbx + 4], r14b
jmp 0x18021f895
mov rcx, qword [rbp - 0x11]
lea rax, [rbp + 0xf]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp + 0x13]
mov dword [rbp + 0x13], r14d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rbp - 0x19], eax
test eax, eax
je 0x18021f882
call fcn.180270610
lea rcx, str.___Failed_to_query_registry_value_2_
mov qword [rbp + 0x1f], 0x28
jmp 0x18021f779
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp + 0x13]
mov dword [rbx], eax
mov byte [rbx + 4], 1
lea r11, [rsp + 0x90]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret