Function at 0x1400438f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1f0
mov qword [rbp - 0x1d0], rbx
mov qword [rbp - 0x1c8], rsi
mov qword [rbp - 0x1c0], rdi
mov qword [rbp - 0x1b8], r12
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x20], r8
mov rdi, rdx
mov rbx, r9
mov qword [rdi], 0
mov qword [rdi + 8], 0
mov dword [rbp - 0x10], 0xffffffff
mov qword [rbp - 0x130], 0
lea rsi, [rbp - 0x130]
mov dword [rbp - 0xc], 8
mov r10, qword [rbp + 0x20]
mov rdx, qword [r10 + 8]
mov rax, qword [r10]
mov qword [rbp - 0x170], rax
mov qword [rbp - 0x168], rdx
lea rdx, [rbp - 0x170]
lea rcx, [rbp - 0x120]
call fcn.14000f370
lea rcx, [rbp - 0x120]
sub rsp, 0x20
call fcn.1400028b0
add rsp, 0x20
lea r8, [rbp - 0x10]
lea r9, [rbp - 0x130]
lea rdx, [rbp - 0xc]
push rdx
push r9
mov r9, r8
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov r12d, eax
cmp r12d, 0xea
jne 0x140043a1f
mov edx, dword [rbp - 0xc]
lea rcx, [0x140210ad0]
sub rsp, 0x20
call fcn.140007410
add rsp, 0x20
mov rsi, rdx
lea rcx, [rbp - 0x120]
sub rsp, 0x20
call fcn.1400028b0
add rsp, 0x20
lea r8, [rbp - 0x10]
lea r9, [rbp - 0xc]
push r9
push rsi
mov r9, r8
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov r12d, eax
mov r9d, r12d
lea r10, [0x140043cc0]
mov qword [rbp - 0x158], r10
xor r8d, r8d
mov qword [rbp - 0x160], r8
lea r8, [rbp - 0x160]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 0x1a8], rcx
mov qword [rbp - 0x1b0], 0x16
lea rdx, [rbp - 0x1b0]
mov ecx, 0x221
sub rsp, 0x20
call fcn.1400426e0
add rsp, 0x20
mov r9d, dword [rbp - 0x10]
cmp r9d, dword [rbp + 0x10]
sete dl
lea r8, [0x140043cd0]
mov qword [rbp - 0x138], r8
mov qword [rbp - 0x140], 0
lea rcx, [rbp - 0x140]
sub rsp, 0x20
call fcn.140004490
add rsp, 0x20
mov ebx, dword [rbp - 0x10]
cmp ebx, 0xb
ja case.0x140043ac8.0
mov ebx, ebx
lea r9, [0x140043c88]
movsxd rdx, dword [r9 + rbx*4]
lea r9, [rdx + r9]
jmp r9
mov r8d, dword [rbp - 0xc]
shr r8, 1
mov qword [rbp - 0x180], r8
mov qword [rbp - 0x178], rsi
cmp qword [rbp - 0x180], 0
je 0x140043b23
mov rax, qword [rbp - 0x180]
mov rdx, qword [rbp - 0x180]
lea r9, [rsi + rdx*2]
cmp word [r9 - 2], 0
jne 0x140043b23
lea rdx, [rbp - 0x180]
mov rax, qword [rbp - 0x180]
lea rcx, [rax - 1]
sub rsp, 0x20
call fcn.14005acc0
add rsp, 0x20
mov rbx, qword [rbp - 0x180]
mov qword [rbp - 0x190], rbx
mov rsi, qword [rbp - 0x178]
mov qword [rbp - 0x188], rsi
lea rcx, [rbp - 0x190]
sub rsp, 0x20
call fcn.14005acf0
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
jmp 0x140043c3f
mov ecx, dword [rbp - 0x130]
sub rsp, 0x20
call fcn.14003e660
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
jmp 0x140043c3f
mov ecx, dword [rbp - 0x130]
bswap ecx
sub rsp, 0x20
call fcn.14003e660
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
jmp 0x140043c3f
mov rcx, qword [rbp - 0x130]
sub rsp, 0x20
call fcn.14003e680
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
jmp 0x140043c3f
lea rcx, [0x14021cac0]
sub rsp, 0x20
call fcn.140009690
add rsp, 0x20
mov rsi, rax
sub rsp, 8
lea rax, str.Cannot_read_the_given_value_as_a_string
mov qword [rbp - 0x198], rax
mov qword [rbp - 0x1a0], 0x27
lea rdx, [rbp - 0x1a0]
push rdx
lea rbx, str.stdwindows_registry.d
mov qword [rbp - 0x148], rbx
mov qword [rbp - 0x150], 0x16
lea r9, [rbp - 0x150]
mov r8d, 0x247
xor edx, edx
mov rcx, rsi
sub rsp, 0x20
call fcn.1400357a0
add rsp, 0x30
mov rcx, rax
sub rsp, 0x20
call fcn.140007bc0
sub rsp, 8
call fcn.140043c4e
add rsp, 8
jmp 0x140043c63
mov rbx, qword [rbp - 0x1d0]
mov rsi, qword [rbp - 0x1c8]
mov rdi, qword [rbp - 0x1c0]
mov r12, qword [rbp - 0x1b8]
mov rsp, rbp
pop rbp
ret