Function at 0x1400946d8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r14d, dword [rbp + 0x58]
mov r13d, r9d
mov rbx, r8
mov rdi, rdx
mov r12, rcx
cmp r14d, 0x4000000
ja 0x1400948dd
mov r8, qword [rbp + 0x70]
mov rdx, rcx
mov rcx, rbx
mov r9d, 0x20019
call fcn.1400c2524
mov esi, eax
test eax, eax
je 0x140094786
call fcn.1400a4e1c
cmp dword [rax], 5
jbe 0x14009477f
cmp qword [rbx + 0x18], 8
mov dword [rbp + 0x58], esi
jb 0x140094746
mov rbx, qword [rbx]
lea rcx, str.Could_not_open_or_create_the_registry_path._Return_default_value
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rcx
lea rdx, [0x1403efed8]
lea rcx, [rbp + 0x58]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140005c2c
mov eax, esi
jmp 0x1400948e2
cmp qword [rdi + 0x18], 8
mov r8, rdi
jb 0x140094793
mov r8, qword [rdi]
mov r15, qword [rbp + 0x60]
mov r9d, r13d
mov rcx, qword [r12]
xor edx, edx
mov qword [rsp + 0x30], r15
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x140094832
call fcn.1400a4e1c
cmp dword [rax], 5
jbe 0x14009477f
cmp qword [rbx + 0x18], 8
mov dword [rbp + 0x58], esi
jb 0x1400947da
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
mov qword [rbp - 0x18], rbx
jb 0x1400947e8
mov rdi, qword [rdi]
lea rcx, str.Failed_to_get_registry_value_size._Return_default_value
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], rcx
lea rdx, [0x1403eff65]
lea rcx, [rbp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001eb0
jmp 0x14009477f
mov eax, dword [r15]
mov rsi, qword [rbp + 0x68]
mov ecx, eax
shr rcx, 1
cmp byte [rbp + 0x50], 0
cmove ecx, eax
mov dword [rsi], ecx
cmp ecx, 1
jb 0x140094858
cmp ecx, r14d
ja 0x140094858
xor eax, eax
jmp 0x1400948e2
call fcn.1400a4e1c
cmp dword [rax], 4
jbe 0x1400948dd
cmp qword [rbx + 0x18], 8
mov ecx, dword [r15]
mov dword [rbp + 0x78], ecx
mov ecx, dword [rsi]
mov dword [rbp - 0x20], ecx
mov dword [rbp + 0x58], r14d
jb 0x14009487b
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
mov qword [rbp - 0x10], rbx
jb 0x140094889
mov rdi, qword [rdi]
lea rcx, str.Registry_value_is_empty_or_bigger_than_max_length._Return_default_value
mov qword [rbp - 0x18], rdi
mov qword [rbp - 8], rcx
lea rdx, [0x1403eff0e]
lea rcx, [rbp + 0x58]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x78]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 8]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400022c4
mov eax, SafeArrayGetDim
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret