Function at 0x1400125e8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0x88
mov qword [rbp - 9], 0xfffffffffffffffe
mov rax, qword [0x140045ee0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rdi, r9
mov r14, r8
mov rsi, rcx
xor r15d, r15d
mov qword [rbp - 0x19], r15
test rdx, rdx
je 0x140012664
mov qword [rbp - 0x19], r15
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140012883
mov rsi, qword [rbp - 0x19]
mov dword [rbp - 0x25], r15d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x25]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140012883
mov eax, dword [rbp - 0x25]
sub eax, 1
je 0x140012842
sub eax, 2
je 0x1400127e3
sub eax, 1
je 0x14001278c
cmp eax, 7
je 0x1400126e6
mov rcx, qword [rbp + 0x5f]
mov ebx, 0x81333006
mov r9d, ebx
lea r8, str.onecoreenduserwindowsupdate_ruximplugliblibplugregistryhelper.cpp
mov edx, 0x47
call fcn.140003bf8
jmp 0x140012883
mov dword [rbp - 0x21], r15d
mov dword [rbp - 0x29], 8
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x21]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140012883
cmp dword [rbp - 0x21], 0xb
je 0x140012742
mov ebx, 0x8007139f
jmp 0x140012883
mov ebx, r15d
test ebx, ebx
js 0x140012883
mov rbx, qword [rbp - 0x11]
movsx rax, byte [rdi + 0x20]
cmp rax, 2
je 0x14001280b
add rax, 1
je 0x140012786
sub rax, 1
je 0x140012786
sub rax, 1
je 0x140012786
sub rax, 1
je 0x140012786
cmp rax, 1
je 0x140012786
mov rcx, rdi
call fcn.140006614
mov byte [rdi + 0x20], 2
jmp 0x14001280b
lea r9, [rbp - 0x29]
mov r8, r14
xor edx, edx
mov rcx, rsi
call fcn.140010aec
mov ebx, eax
test eax, eax
js 0x140012883
mov ebx, dword [rbp - 0x29]
movsx rax, byte [rdi + 0x20]
cmp rax, 1
je 0x1400127df
add rax, 1
je 0x1400127db
sub rax, 1
je 0x1400127db
sub rax, 1
je 0x1400127db
sub rax, 1
je 0x1400127db
cmp rax, 1
je 0x1400127db
mov rcx, rdi
call fcn.140006614
mov byte [rdi + 0x20], 1
mov dword [rdi], ebx
jmp 0x14001283d
lea r9, [rbp - 0x11]
mov r8, r14
mov rcx, rsi
call fcn.140010da8
mov ebx, eax
test eax, eax
js 0x140012883
mov rbx, qword [rbp - 0x11]
movsx rax, byte [rdi + 0x20]
cmp rax, 3
jne 0x140012810
mov qword [rdi], rbx
jmp 0x14001283d
add rax, 1
je 0x140012836
sub rax, 1
je 0x140012836
sub rax, 1
je 0x140012836
sub rax, 1
je 0x140012836
cmp rax, 1
je 0x140012836
mov rcx, rdi
call fcn.140006614
mov qword [rdi], rbx
mov byte [rdi + 0x20], 3
mov ebx, r15d
jmp 0x140012883
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r15w
lea r9, [rbp - 1]
mov r8, r14
xor edx, edx
mov rcx, rsi
call fcn.140010bc4
mov ebx, eax
test eax, eax
js 0x140012879
lea rdx, [rbp - 1]
mov rcx, rdi
call fcn.1400124e0
mov ebx, r15d
lea rcx, [rbp - 1]
call fcn.140006614
nop
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140012898
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140030780
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret