Function at 0x140094500
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r10, r9
mov r12, r8
mov r15, rdx
mov rdi, rcx
mov rax, qword [rbp + 0x50]
mov byte [rax], 1
xor r14d, r14d
mov rbx, qword [rbp + 0x58]
mov dword [rbx], r14d
mov qword [rbp - 0x30], r14
mov dword [rbp + 0x78], r14d
mov dword [rbp + 0x60], r14d
mov rax, qword [rbp + 0x70]
mov qword [r11 - 0x68], rax
lea rax, [rbp + 0x60]
mov qword [r11 - 0x70], rax
lea rax, [rbp + 0x78]
mov qword [r11 - 0x78], rax
mov eax, dword [rbp + 0x68]
mov dword [rsp + 0x28], eax
mov byte [rsp + 0x20], r14b
lea r9d, [r14 + 2]
mov r8, r10
lea rcx, [rbp - 0x30]
call fcn.140094a04
mov dword [rbx], eax
test eax, eax
jne 0x14009469f
mov r13d, dword [rbp + 0x60]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov ebx, r14d
mov qword [rbp - 8], rbx
mov esi, r14d
test r13, r13
je 0x140094682
mov edx, r13d
call fcn.1400a05c0
mov rsi, rax
mov r14, rax
mov qword [rbp - 0x18], rax
lea r8, [r13*2]
lea rbx, [r8 + rax]
mov qword [rbp - 8], rbx
xor edx, edx
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov qword [rbp - 0x10], rbx
mov r8, r15
cmp qword [r15 + 0x18], 8
jb 0x1400945e9
mov r8, qword [r15]
lea rax, [rbp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
and qword [rsp + 0x20], 0
xor edx, edx
lea r9d, [rdx + 2]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov r13, qword [rbp + 0x58]
mov dword [r13], eax
test eax, eax
jne 0x1400946c2
mov rax, qword [rbp + 0x50]
xor r15d, r15d
mov byte [rax], r15b
mov eax, dword [rbp + 0x60]
dec eax
mov word [r14 + rax*2], r15w
mov rdx, r14
mov rcx, rdi
call fcn.1400d16f0
test rsi, rsi
jne 0x14009468b
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14009465d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
mov rax, rdi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r14, qword [rbp - 0x18]
jmp 0x1400945dc
sub rbx, rsi
sar rbx, 1
lea rdx, [rbx + rbx]
mov rcx, rsi
call fcn.14007e0f0
jmp 0x140094647
mov rdx, r12
mov rcx, rdi
call fcn.14008cc50
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14009465d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x14009465d
call fcn.1400abad4
mov r8, rax
cmp dword [rax], 4
jbe 0x140094742
mov rcx, r12
call fcn.1400df740
mov qword [rbp + 0x58], rax
mov ecx, dword [r13]
mov dword [rbp + 0x60], ecx
mov rcx, qword [rbp + 0x48]
call fcn.1400df740
mov qword [rbp + 0x50], rax
mov rcx, r15
call fcn.1400df740
mov qword [rbp - 0x28], rax
lea rax, str.Failed_to_read_registry_value._Return_default_value
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [0x140468e44]
mov rcx, r8
call fcn.14000f8a4
mov rdx, r12
mov rcx, rdi
call fcn.14008cc50
lea rcx, [rbp - 0x18]
call fcn.1401349f4
lea rcx, [rbp - 0x30]
call fcn.1401303f4
jmp 0x14009465d