Function at 0x140008118
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r10, r9
mov r15, r8
mov r14, rdx
mov rdi, rcx
mov rax, qword [rbp + 0x50]
mov byte [rax], 1
xor r12d, r12d
mov rbx, qword [rbp + 0x58]
mov dword [rbx], r12d
mov qword [rbp + 0x70], r12
mov dword [rbp + 0x68], r12d
mov dword [rbp + 0x60], r12d
lea rax, [rbp + 0x60]
mov qword [r11 - 0x70], rax
lea rax, [rbp + 0x68]
mov qword [r11 - 0x78], rax
lea r9d, [r12 + 2]
mov r8, r10
lea rcx, [rbp + 0x70]
call fcn.1400077b4
mov dword [rbx], eax
test eax, eax
jne 0x1400082b7
mov r13d, dword [rbp + 0x60]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
mov ebx, r12d
mov qword [rbp - 0x10], rbx
mov esi, r12d
xor eax, eax
test r13, r13
je 0x1400082a3
mov edx, r13d
lea rcx, [rbp - 0x20]
call fcn.1400083e8
lea rbx, [r13*2]
mov r8, rbx
xor edx, edx
mov r13, qword [rbp - 0x20]
mov rcx, r13
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rax, [rbx + r13]
mov qword [rbp - 0x18], rax
mov rsi, r13
mov r12, r13
mov rax, r13
mov rbx, qword [rbp - 0x10]
mov r8, r14
cmp qword [r14 + 0x18], 8
jae 0x1400082ac
lea rax, [rbp + 0x68]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
and qword [rsp + 0x20], 0
xor edx, edx
lea r9d, [rdx + 2]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x58]
mov dword [rcx], eax
test eax, eax
jne 0x1400082c4
mov rax, qword [rbp + 0x50]
xor r14d, r14d
mov byte [rax], r14b
mov eax, dword [rbp + 0x60]
dec eax
mov word [r12 + rax*2], r14w
mov rdx, r13
mov rcx, rdi
call fcn.140007fb0
test rsi, rsi
je 0x140008269
sub rbx, rsi
sar rbx, 1
lea rdx, [rbx + rbx]
mov rcx, rsi
call fcn.140006900
mov rcx, qword [rbp + 0x70]
test rcx, rcx
je 0x14000827e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rax, rdi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r13, qword [rbp - 0x20]
jmp 0x1400081ed
mov r8, qword [r14]
mov r12, rax
jmp 0x1400081fb
mov rdx, r15
mov rcx, rdi
call fcn.140007050
jmp 0x140008269
call fcn.1400085ac
mov rbx, rax
cmp dword [rax], 4
jbe 0x140008346
mov rcx, r15
call fcn.140008ab0
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0x58]
mov ecx, dword [rax]
mov dword [rbp + 0x60], ecx
mov rcx, qword [rbp + 0x48]
call fcn.140008ab0
mov qword [rbp + 0x58], rax
mov rcx, r14
call fcn.140008ab0
mov qword [rbp - 0x30], rax
lea rax, str.Failed_to_read_registry_value._Return_default_value
mov qword [rbp - 0x28], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
lea rdx, [0x140024478]
mov rcx, rbx
call fcn.140002388
mov rdx, r15
mov rcx, rdi
call fcn.140007050
lea rcx, [rbp - 0x20]
call fcn.14000f1cc
lea rcx, [rbp + 0x70]
call fcn.14000afec
jmp 0x14000827e