Function at 0x1400ab80c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r14d, dword [rbp + 0x58]
mov r13d, r9d
mov rbx, r8
mov rdi, rdx
mov r12, rcx
cmp r14d, 0x4000000
ja 0x1400aba11
mov r8, qword [rbp + 0x70]
mov rdx, rcx
mov rcx, rbx
mov r9d, 0x20019
call fcn.1400b2da8
mov esi, eax
test eax, eax
je 0x1400ab8ba
call fcn.140091ae4
cmp dword [rax], 5
jbe 0x1400ab8b3
cmp qword [rbx + 0x18], 8
mov dword [rbp + 0x58], esi
jb 0x1400ab87a
mov rbx, qword [rbx]
lea rcx, str.Could_not_open_or_create_the_registry_path._Return_default_value
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rcx
lea rdx, [0x14044c699]
lea rcx, [rbp + 0x58]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140005ba8
mov eax, esi
jmp 0x1400aba16
cmp qword [rdi + 0x18], 8
mov r8, rdi
jb 0x1400ab8c7
mov r8, qword [rdi]
mov r15, qword [rbp + 0x60]
mov r9d, r13d
mov rcx, qword [r12]
xor edx, edx
mov qword [rsp + 0x30], r15
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x1400ab966
call fcn.140091ae4
cmp dword [rax], 5
jbe 0x1400ab8b3
cmp qword [rbx + 0x18], 8
mov dword [rbp + 0x58], esi
jb 0x1400ab90e
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
mov qword [rbp - 0x18], rbx
jb 0x1400ab91c
mov rdi, qword [rdi]
lea rcx, str.Failed_to_get_registry_value_size._Return_default_value
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], rcx
lea rdx, [0x14044c601]
lea rcx, [rbp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001fa0
jmp 0x1400ab8b3
mov eax, dword [r15]
mov rsi, qword [rbp + 0x68]
mov ecx, eax
shr rcx, 1
cmp byte [rbp + 0x50], 0
cmove ecx, eax
mov dword [rsi], ecx
cmp ecx, 1
jb 0x1400ab98c
cmp ecx, r14d
ja 0x1400ab98c
xor eax, eax
jmp 0x1400aba16
call fcn.140091ae4
cmp dword [rax], 4
jbe 0x1400aba11
cmp qword [rbx + 0x18], 8
mov ecx, dword [r15]
mov dword [rbp + 0x78], ecx
mov ecx, dword [rsi]
mov dword [rbp - 0x20], ecx
mov dword [rbp + 0x58], r14d
jb 0x1400ab9af
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
mov qword [rbp - 0x10], rbx
jb 0x1400ab9bd
mov rdi, qword [rdi]
lea rcx, str.Registry_value_is_empty_or_bigger_than_max_length._Return_default_value
mov qword [rbp - 0x18], rdi
mov qword [rbp - 8], rcx
lea rdx, [0x14044c642]
lea rcx, [rbp + 0x58]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x78]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 8]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400023b4
mov eax, SafeArrayGetDim
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret