Function at 0x408120
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x00535d58]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rbp, rcx
test rcx, rcx
jne 0x408169
xor eax, eax
jmp 0x40844c
xor eax, eax
lea rdi, [0x004f7838]
mov rsi, qword [0x0053fa70]
mov r14d, 1
mov rcx, r14
repe cmpsw word [rsi], word [rdi]
je 0x40818c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
xor r13d, r13d
test al, al
je 0x408426
call fcn.0049d8dc
mov rcx, rax
mov eax, r13d
test rcx, rcx
setne al
test eax, eax
jne 0x4081bc
mov ecx, 0x80004005
call fcn.004034c0
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x38], rdi
lea rdx, str.SYSTEMCurrentControlSetControlMediaCategories_
or rbx, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x408205
movzx esi, dx
mov ecx, esi
call fcn.0049f018
test rax, rax
je 0x408226
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.0040a480
mov rdi, qword [rsp + 0x38]
jmp 0x408226
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.00409ff0
mov rdi, qword [rsp + 0x38]
mov qword [rsp + 0x48], r13
lea rdx, [0x004f8b00]
lea rcx, [rsp + 0x50]
call fcn.00419a30
nop
mov r15, qword [rax]
mov ecx, dword [r15 - 0x10]
mov dword [rsp + 0x30], ecx
mov r12, r15
sub r12, rdi
sar r12, 1
mov eax, dword [rdi - 0x10]
mov dword [rsp + 0x34], eax
lea esi, [rax + rcx]
sub r14d, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, esi
or eax, r14d
jge 0x40827e
mov edx, esi
lea rcx, [rsp + 0x38]
call fcn.004034e0
mov rdi, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
cmp r12, rax
ja 0x40828b
lea r15, [rdi + r12*2]
movsxd rdx, ecx
add rdx, rdx
lea rcx, [rdi + rax*2]
mov r9, rdx
mov r8, r15
call fcn.004c80e0
test esi, esi
js 0x40841b
cmp esi, dword [rdi - 0xc]
jg 0x40841b
mov dword [rdi - 0x10], esi
movsxd rax, esi
mov word [rdi + rax*2], 0
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x4082dd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rsi, qword [rsp + 0x38]
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4083fe
mov r12, qword [rsp + 0x40]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x30], 0x80
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.Name
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4083d2
mov eax, dword [rsp + 0x34]
cmp eax, 1
je 0x408362
cmp eax, 2
jne 0x4083d2
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x40837b
test al, 1
jne 0x4083d2
shr rax, 1
cmp word [rsp + rax*2 + 0x5e], 0
je 0x408382
jmp 0x4083d2
mov word [rsp + 0x60], 0
xor eax, eax
mov rcx, rbx
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x60]
lea rcx, [0x0053fa70]
call fcn.00409ff0
nop
test r12, r12
je 0x4083b7
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rsi - 0x18]
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x408426
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x408426
test r12, r12
je 0x4083e1
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rsi - 0x18]
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x4083fa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x40844c
lea rdx, [rsi - 0x18]
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x408417
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x40844c
mov ecx, 0x80070057
call fcn.004034c0
nop
mov rcx, qword [0x0053fa70]
sub rbp, rcx
movzx eax, word [rcx]
movzx edx, word [rcx + rbp]
sub eax, edx
jne 0x408443
add rcx, 2
test edx, edx
jne 0x408430
test eax, eax
sete r13b
mov eax, r13d
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.004c7bc0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret