Function at 0x10012b500
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov rsi, rcx
or rdi, 0xffffffffffffffff
mov qword [r11 + 0x20], rdi
mov eax, dword [0x10029a8b0]
and eax, 0x20004
cmp eax, 0x20004
jne 0x10012b54f
mov rax, qword [0x1004e2d48]
test rax, rax
je 0x10012b54f
mov r8, rcx
mov rdx, qword [0x1004e2d48]
lea rcx, [r11 + 0x20]
call fcn.100126900
xor ebp, ebp
mov qword [rsi], rbp
mov dword [rsp + 0x70], ebp
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9d, [rbp + 1]
xor r8d, r8d
lea rdx, [0x1000392a0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x10012b5c3
test byte [0x10029a8b0], 2
je 0x10012b912
mov rcx, qword [0x1004e2b40]
test rcx, rcx
je 0x10012b912
mov r9d, eax
mov r8, qword [0x1004e2b40]
mov edx, 0xf7400
mov rcx, qword [0x1004e2550]
call fcn.100126850
jmp 0x10012b912
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1000393f0]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 2
jne 0x10012b653
mov eax, dword [0x10029a8b0]
and eax, 0x20002
cmp eax, 0x20002
jne 0x10012b912
mov rax, qword [0x1004e2b48]
test rax, rax
je 0x10012b912
cmp qword [0x10023faa8], 0xffffffffffffffff
je 0x10012b912
mov qword [rsp + 0x20], rbp
mov r9, qword [0x1004e2b48]
mov r8d, 0xfa800
mov rdx, qword [0x1004e2558]
mov rcx, qword [0x10023faa8]
call qword [0x10023faf0]
jmp 0x10012b912
test eax, eax
je 0x10012b694
test byte [0x10029a8b0], 2
je 0x10012b912
mov rax, qword [0x1004e2b50]
test rax, rax
je 0x10012b912
mov r9d, ebx
mov r8, qword [0x1004e2b50]
mov edx, 0xfc000
mov rcx, qword [0x1004e2560]
call fcn.100126850
jmp 0x10012b912
cmp dword [rsp + 0x70], ebp
jne 0x10012b6f5
mov ebx, 0x57
test byte [0x10029a8b0], 2
je 0x10012b912
mov rax, qword [0x1004e2b58]
test rax, rax
je 0x10012b912
cmp qword [0x10023faa8], 0xffffffffffffffff
je 0x10012b912
mov qword [rsp + 0x20], rbp
mov r9, qword [0x1004e2b58]
mov r8d, 0xfdc00
mov rdx, qword [0x1004e2568]
mov rcx, qword [0x10023faa8]
call qword [0x10023faf0]
jmp 0x10012b912
call fcn.100058d10
mov rcx, qword [rax + 0x38]
mov r10, qword [rcx]
mov ecx, dword [rsp + 0x70]
inc rcx
shr rcx, 1
mov eax, 2
mul rcx
mov rdx, rax
cmovo rdx, rdi
cmp rdx, 0xffffffffffffffff
jne 0x10012b725
mov rdi, rbp
jmp 0x10012b743
mov rax, qword [r10]
mov byte [rsp + 0x20], 6
mov r9d, 0x3fb
lea r8, [0x100037b10]
mov rcx, r10
call qword [rax + 0x48]
mov rdi, rax
test rdi, rdi
jne 0x10012b78f
lea ebx, [rdi + 0xe]
test byte [0x10029a8b0], 2
je 0x10012b8c3
mov rcx, qword [0x1004e2b60]
test rcx, rcx
je 0x10012b8c3
cmp qword [0x10023faa8], 0xffffffffffffffff
je 0x10012b8c3
mov r9, qword [0x1004e2b60]
mov r8d, 0xffc00
mov rdx, qword [0x1004e2570]
jmp 0x10012b8b1
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, [0x1000393f0]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x10012b7fe
test byte [0x10029a8b0], 2
je 0x10012b8c3
mov rax, qword [0x1004e2b68]
test rax, rax
je 0x10012b8c3
mov r9d, ebx
mov r8, qword [0x1004e2b68]
mov edx, 0x103800
mov rcx, qword [0x1004e2578]
call fcn.100126850
jmp 0x10012b8c3
cmp dword [rsp + 0x78], 7
je 0x10012b84b
mov ebx, 0x57
test byte [0x10029a8b0], 2
je 0x10012b8c3
mov rax, qword [0x1004e2b70]
test rax, rax
je 0x10012b8c3
cmp qword [0x10023faa8], 0xffffffffffffffff
je 0x10012b8c3
mov r9, qword [0x1004e2b70]
mov r8d, 0x105400
mov rdx, qword [0x1004e2580]
jmp 0x10012b8b1
mov eax, dword [rsp + 0x70]
cmp eax, 2
jne 0x10012b85b
cmp bp, word [rdi]
je 0x10012b871
jmp 0x10012b879
cmp eax, 4
jb 0x10012b879
shr rax, 1
cmp bp, word [rdi + rax*2 - 2]
jne 0x10012b879
cmp bp, word [rdi + rax*2 - 4]
jne 0x10012b879
mov qword [rsi], rdi
jmp 0x10012b912
mov ebx, 0x57
test byte [0x10029a8b0], 2
je 0x10012b8c3
mov rax, qword [0x1004e2b78]
test rax, rax
je 0x10012b8c3
cmp qword [0x10023faa8], 0xffffffffffffffff
je 0x10012b8c3
mov r9, qword [0x1004e2b78]
mov r8d, 0x109000
mov rdx, qword [0x1004e2588]
mov qword [rsp + 0x20], rbp
mov rcx, qword [0x10023faa8]
call qword [0x10023faf0]
test rdi, rdi
je 0x10012b912
mov rax, rdi
mov edx, 0x200
and rax, 0xffffffffffffe000
je 0x10012b8e2
cmp word [rax + 4], dx
jne 0x10012b8e2
mov rax, qword [rax + 0x28]
mov rax, qword [rax + 8]
mov rcx, qword [rax + 0x10]
dec rcx
not rcx
and rcx, rdi
je 0x10012b8ff
cmp word [rcx + 4], dx
jne 0x10012b8ff
mov rcx, qword [rcx + 0x28]
mov rcx, qword [rcx + 8]
test byte [rcx + 0x28], 8
jne 0x10012b912
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 0x28]
mov eax, dword [0x10029a8b0]
and eax, 0x20002
cmp eax, 0x20002
jne 0x10012b94c
mov rax, qword [0x1004e2b80]
test rax, rax
je 0x10012b94c
mov r9d, ebx
mov r8, qword [0x1004e2b80]
mov edx, 0x10d000
mov rcx, qword [0x1004e2590]
call fcn.100126850
nop
lea rcx, [rsp + 0x88]
call fcn.100126960
mov eax, ebx
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret