Function at 0x140021970
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x1400b8288]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r12, rcx
mov r13, r8
lea rcx, [rdx + 0x24]
mov r15, rdx
xor r14d, r14d
lea r8, [rsp + 0x40]
mov edx, 0x20019
mov qword [rsp + 0x40], r14
mov ebp, r14d
call fcn.140055f9c
mov rsi, qword [rsp + 0x40]
mov edi, eax
test eax, eax
jns 0x1400219ee
mov r9d, eax
mov r8d, 0x502
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmountmountedimagestore.c
mov qword [rsp + 0x20], r14
lea rcx, str.StateStoreGetMountedImageWimbootEntries
call fcn.140046874
jmp 0x140021a07
test rsi, rsi
jne 0x140021a31
lea ecx, [rsi + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov edi, 0x80070490
test rsi, rsi
je 0x140021a1b
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
cmp edi, 0x80070490
jne 0x140021b27
mov edi, 1
jmp 0x140021cff
mov qword [rsp + 0x28], r14
lea rdx, str.Wimboot_entries
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
test ebx, ebx
jne 0x140021a02
lea r8, str.Wimboot_entries
mov rcx, rsi
call fcn.14000cc68
mov rbx, rax
test rax, rax
jne 0x140021acc
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov ebx, 0x80070000
or ecx, ebx
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140021ab9
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, ebx
test eax, eax
cmovle edi, eax
jmp 0x140021abe
mov edi, 0x80004005
mov r9d, edi
mov r8d, 0x509
jmp 0x1400219d4
mov rcx, rbx
call fcn.140030840
mov rbp, rax
test rax, rax
jne 0x140021b02
mov edi, 0x8007000e
mov qword [rsp + 0x20], r14
mov r9d, edi
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmountmountedimagestore.c
mov r8d, 0x50d
lea rcx, str.StateStoreGetMountedImageWimbootEntries
call fcn.140046874
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
jmp 0x140021a07
test edi, edi
jns 0x140021b51
mov r9d, edi
mov qword [rsp + 0x20], r14
mov r8d, 0x5dc
lea rdx, str.onecore_base_ntsetupopktoolsosimagewimgapilibmount.c
lea rcx, str.pDeleteWimBackedFilesAndWimBootEntries
call fcn.140046874
jmp 0x140021cff
lea rdx, [0x1400a1980]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_wcsstr]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140021cff
lea r14, str.pDeleteWimBackedFilesAndWimBootEntries
add rbx, 2
lea rdx, [0x1400a1980]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsstr]
nop dword [rax + rax]
xor r9d, r9d
mov rsi, rax
test rax, rax
jne 0x140021bd4
lea r8d, [rax + 0x40]
lea rax, [rsp + 0x50]
sub rbx, rax
lea rdx, [rsp + 0x50]
lea rcx, [r8 + 0x7fffffbe]
test rcx, rcx
je 0x140021c25
movzx eax, word [rbx + rdx]
test ax, ax
je 0x140021c25
mov word [rdx], ax
add rdx, 2
sub r8, 1
jne 0x140021bb0
jmp 0x140021c25
mov rcx, rsi
sub rcx, rbx
sar rcx, 1
cmp rcx, 0x7ffffffe
jbe 0x140021bf3
mov edi, 0x80070057
mov word [rsp + 0x50], r9w
jmp 0x140021c41
lea rax, [rsp + 0x50]
mov r8d, 0x40
sub rbx, rax
lea rdx, [rsp + 0x50]
lea rax, [r8 - 0x40]
add rax, rcx
je 0x140021c25
movzx eax, word [rbx + rdx]
test ax, ax
je 0x140021c25
mov word [rdx], ax
add rdx, 2
sub r8, 1
jne 0x140021c06
test r8, r8
lea rax, [rdx - 2]
cmovne rax, rdx
neg r8
sbb edi, edi
not edi
and edi, 0x8007007a
mov word [rax], r9w
test edi, edi
js 0x140021cf3
lea r8, [rsp + 0x48]
lea rdx, str._I64d
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_swscanf_s]
nop dword [rax + rax]
test eax, eax
jle 0x140021cf3
mov rbx, qword [rsp + 0x48]
lea r9, [0x1400218e0]
mov rcx, qword [r15 + 0x10]
mov r8, rbx
mov qword [rsp + 0x20], r13
call fcn.140071398
test eax, eax
jns 0x140021cb8
mov r8, qword [r15 + 0x10]
lea r9, str.Failed_to_enumerate_and_delete_wimboot_entries.
mov dword [rsp + 0x30], 0x5fa
mov rdx, r12
mov qword [rsp + 0x28], r14
mov ecx, 2
mov dword [rsp + 0x20], eax
call fcn.14002aaa0
mov rcx, qword [r15 + 0x10]
mov rdx, rbx
call fcn.140070b0c
mov edi, eax
test eax, eax
jns 0x140021cf3
mov r8, qword [r15 + 0x10]
lea r9, str.Failed_to_remove_wimboot_entry.
mov dword [rsp + 0x30], 0x600
mov rdx, r12
mov qword [rsp + 0x28], r14
mov ecx, 2
mov dword [rsp + 0x20], eax
call fcn.14002aaa0
mov rbx, rsi
test rsi, rsi
jne 0x140021b7a
test rbp, rbp
je 0x140021d24
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140096bd0
mov rbx, qword [rsp + 0x138]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret