Function at 0x140011ec0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xfd0]
mov eax, 0x10d0
call fcn.14005f060
sub rsp, rax
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x1118], rbx
mov rax, qword [0x1401385c0]
xor rax, rsp
mov qword [rbp + 0xfc8], rax
mov rbx, r8
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x70], rdx
xor r15d, r15d
mov dword [rsp + 0x40], r15d
mov dword [rbp + 0xfa0], r15d
mov rdx, r8
lea rcx, [rsp + 0x48]
call fcn.1400029b0
nop
cmp qword [rax + 0x18], 8
jb 0x140011f34
mov rax, qword [rax]
lea rcx, [rbp + 0xfa0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9d, 2
mov r8, rax
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x140011f7d
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.140003f50
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r15
mov word [rsp + 0x48], r15w
test esi, esi
je 0x140011fd4
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140002960
nop
cmp qword [rax + 0x18], 0x10
jb 0x140011fad
mov rax, qword [rax]
mov r9d, esi
mov r8, rax
lea rdx, str.Could_not_query_value_size_while_attempting_to_get_registry_value_as_string_with_name__s___i_.
lea rcx, [rbp - 0x80]
call fcn.140005290
lea rdx, [0x140135110]
lea rcx, [rbp - 0x80]
call fcn.140060304
nop
mov edx, dword [rbp + 0xfa0]
shr rdx, 1
mov qword [rbp + 0xfb8], r15
mov qword [rbp + 0xfc0], r15
mov qword [rbp + 0xfc0], 7
mov qword [rbp + 0xfb8], r15
mov word [rbp + 0xfa8], r15w
xor r8d, r8d
lea rcx, [rbp + 0xfa8]
call fcn.1400031b0
nop
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1400029b0
nop
lea rcx, [rbp + 0xfa8]
cmp qword [rbp + 0xfc0], 8
cmovae rcx, qword [rbp + 0xfa8]
cmp qword [rax + 0x18], 8
jb 0x140012044
mov rax, qword [rax]
lea rdx, [rbp + 0xfa0]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
mov r9d, 2
mov r8, rax
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x14001208d
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.140003f50
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r15
mov word [rsp + 0x48], r15w
test esi, esi
je 0x1400120e4
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140002960
nop
cmp qword [rax + 0x18], 0x10
jb 0x1400120bd
mov rax, qword [rax]
mov r9d, esi
mov r8, rax
lea rdx, str.Could_not_get_registry_value_as_string_with_name__s___i_.
lea rcx, [rbp - 0x80]
call fcn.140005290
lea rdx, [0x140135110]
lea rcx, [rbp - 0x80]
call fcn.140060304
nop
lea rdx, [rbp + 0xfa8]
cmp qword [rbp + 0xfc0], 8
cmovae rdx, qword [rbp + 0xfa8]
mov r8d, dword [rbp + 0xfa0]
shr r8d, 1
dec r8d
mov rcx, rdi
call fcn.1400028c0
nop
mov dword [rsp + 0x40], 1
mov r8, qword [rbp + 0xfc0]
cmp r8, 8
jb 0x14001213c
inc r8
mov rdx, qword [rbp + 0xfa8]
lea rcx, [rbp + 0xfa8]
call fcn.140003f50
mov qword [rbp + 0xfc0], 7
mov qword [rbp + 0xfb8], r15
mov word [rbp + 0xfa8], r15w
mov rax, rdi
mov rcx, qword [rbp + 0xfc8]
xor rcx, rsp
call fcn.14005f0d0
mov rbx, qword [rsp + 0x1118]
add rsp, 0x10d0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret