Function at 0x140007e58
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14003c280]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, qword [rbp + 0x60]
xor r13d, r13d
mov r14, r9
mov r15, rdx
test rsi, rsi
jne 0x140007ea7
lea r8, str.psczValue
mov edx, 0x13b
lea rcx, str.onecore_basecbsutilcbsreg.cpp
call fcn.140006cac
mov qword [rbp - 0x18], r13
mov ebx, r13d
mov qword [rbp - 0x20], r13
mov rdi, r13
mov dword [rbp - 0xc], r13d
mov r12d, r13d
mov dword [rbp - 0x10], r13d
mov rcx, 0xffffffff80000002
test r15, r15
je 0x140007f45
lea rax, [rbp - 0x18]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ecx, eax
add eax, 0xfffffffe
cmp eax, 1
ja 0x140007f0a
movzx ebx, cx
or ebx, 0x80070000
test ecx, ecx
cmovle ebx, ecx
jmp 0x14000811c
test ecx, ecx
je 0x140007f3f
movzx ebx, cx
lea r9, str.Failed_to_open_the_registry_root:_n_a__key:__S.
or ebx, 0x80070000
mov qword [rsp + 0x20], r15
test ecx, ecx
cmovle ebx, ecx
mov edx, ebx
mov r8d, 1
mov ecx, 0x4000000
call fcn.140006a50
jmp 0x14000811c
mov rcx, qword [rbp - 0x18]
jmp 0x140007f49
mov qword [rbp - 0x18], rcx
cmp qword [rsi], r13
je 0x14000803d
mov rcx, qword [rsi]
lea rdx, [rbp - 0x20]
call fcn.140007870
mov ebx, eax
test eax, eax
jns 0x140007f82
lea r9, str.Failed_to_determine_size_of_string.
mov edx, eax
mov r8d, 1
mov ecx, 0x4000000
call fcn.140006a50
jmp 0x14000811c
mov rdi, qword [rbp - 0x20]
mov edx, 0xffffffff
mov eax, edx
lea rcx, [rdi*2 - 4]
cmp rcx, rdx
cmovbe eax, ecx
cmp rdx, rcx
mov dword [rbp - 0x10], eax
sbb ebx, ebx
and ebx, 0x80070216
cmp rcx, rdx
jbe 0x140007fb9
lea r9, str.Failed_to_convert_cchValue_to_DWORD
mov edx, ebx
jmp 0x140007f6d
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0xc]
mov rax, qword [rsi]
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140008008
lea r12d, [rax + 1]
mov eax, dword [rbp - 0xc]
dec eax
cmp eax, 1
jbe 0x140008089
mov ebx, 0x8007000d
lea r9, str.Registry_value_is_not_a_string_type.
jmp 0x140007fb5
cmp eax, 0xea
je 0x140007fec
cmp eax, 2
jne 0x14000801e
mov ebx, 0x80070002
jmp 0x14000811c
movzx ebx, ax
lea r9, str.Failed_initial_query_of_value_to_get_type__size__and_value_of_registry_value:__S
or ebx, 0x80070000
mov qword [rsp + 0x20], r14
test eax, eax
cmovle ebx, eax
jmp 0x140007f28
lea rax, [rbp - 0x10]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0xc]
mov rdx, r14
mov qword [rsp + 0x20], r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
cmp eax, 2
je 0x140008014
test eax, eax
je 0x140007fec
movzx ebx, ax
lea r9, str.Failed_to_query_value_to_get_type_and_size_of_registry_root:_n_a__value:__S
or ebx, 0x80070000
mov qword [rsp + 0x20], r14
test eax, eax
cmovle ebx, eax
jmp 0x140007f28
test r12d, r12d
jne 0x14000810a
mov edi, dword [rbp - 0x10]
mov rcx, rsi
shr rdi, 1
add rdi, 2
mov rdx, rdi
call fcn.140006f1c
mov ebx, eax
test eax, eax
jns 0x1400080bc
mov qword [rsp + 0x20], r14
lea r9, str.Failed_to_allocate_string_to_read_registry_value:__S
mov edx, eax
jmp 0x140007f2a
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0xc]
mov rax, qword [rsi]
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x14000810a
movzx ebx, ax
lea r9, str.Failed_to_query_registry_value:__S
or ebx, 0x80070000
mov qword [rsp + 0x20], r14
test eax, eax
cmovle ebx, eax
jmp 0x140007f28
mov rax, qword [rsi]
mov word [rax + rdi*2 - 4], r13w
mov rax, qword [rsi]
mov word [rax + rdi*2 - 2], r13w
test r15, r15
je 0x140008136
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140008136
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14001b900
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret