Function at 0x140094220
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r10, r9
mov r12, r8
mov r15, rdx
mov rdi, rcx
mov rax, qword [rbp + 0x50]
mov byte [rax], 1
xor r14d, r14d
mov rbx, qword [rbp + 0x58]
mov dword [rbx], r14d
mov qword [rbp - 0x30], r14
mov dword [rbp + 0x78], r14d
mov dword [rbp + 0x60], r14d
mov rax, qword [rbp + 0x70]
mov qword [r11 - 0x68], rax
lea rax, [rbp + 0x60]
mov qword [r11 - 0x70], rax
lea rax, [rbp + 0x78]
mov qword [r11 - 0x78], rax
mov eax, dword [rbp + 0x68]
mov dword [rsp + 0x28], eax
mov byte [rsp + 0x20], r14b
lea r9d, [r14 + 2]
mov r8, r10
lea rcx, [rbp - 0x30]
call fcn.140094724
mov dword [rbx], eax
test eax, eax
jne 0x1400943bf
mov r13d, dword [rbp + 0x60]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov ebx, r14d
mov qword [rbp - 8], rbx
mov esi, r14d
test r13, r13
je 0x1400943a2
mov edx, r13d
call fcn.1400a0830
mov rsi, rax
mov r14, rax
mov qword [rbp - 0x18], rax
lea r8, [r13*2]
lea rbx, [r8 + rax]
mov qword [rbp - 8], rbx
xor edx, edx
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov qword [rbp - 0x10], rbx
mov r8, r15
cmp qword [r15 + 0x18], 8
jb 0x140094309
mov r8, qword [r15]
lea rax, [rbp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
and qword [rsp + 0x20], 0
xor edx, edx
lea r9d, [rdx + 2]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov r13, qword [rbp + 0x58]
mov dword [r13], eax
test eax, eax
jne 0x1400943e2
mov rax, qword [rbp + 0x50]
xor r15d, r15d
mov byte [rax], r15b
mov eax, dword [rbp + 0x60]
dec eax
mov word [r14 + rax*2], r15w
mov rdx, r14
mov rcx, rdi
call fcn.1400d71b0
test rsi, rsi
jne 0x1400943ab
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14009437d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
mov rax, rdi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r14, qword [rbp - 0x18]
jmp 0x1400942fc
sub rbx, rsi
sar rbx, 1
lea rdx, [rbx + rbx]
mov rcx, rsi
call fcn.14007de10
jmp 0x140094367
mov rdx, r12
mov rcx, rdi
call fcn.14008c970
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14009437d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x14009437d
call fcn.1400abd44
mov r8, rax
cmp dword [rax], 4
jbe 0x140094462
mov rcx, r12
call fcn.1400c75e0
mov qword [rbp + 0x58], rax
mov ecx, dword [r13]
mov dword [rbp + 0x60], ecx
mov rcx, qword [rbp + 0x48]
call fcn.1400c75e0
mov qword [rbp + 0x50], rax
mov rcx, r15
call fcn.1400c75e0
mov qword [rbp - 0x28], rax
lea rax, str.Failed_to_read_registry_value._Return_default_value
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [0x1404666c7]
mov rcx, r8
call fcn.14000f8a4
mov rdx, r12
mov rcx, rdi
call fcn.14008c970
lea rcx, [rbp - 0x18]
call fcn.140135b34
lea rcx, [rbp - 0x30]
call fcn.140130a94
jmp 0x14009437d