Function at 0x140012bd8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rsi, rcx
call fcn.14001a598
nop
lea rax, [0x140003bc8]
mov qword [rsi], rax
lea rbp, [rsi + 0x200]
mov qword [rsp + 0x90], rbp
mov qword [rbp], rsi
lea rcx, [rbp + 8]
call fcn.140028da4
nop
xor edi, edi
mov byte [rbp + 0x30], dil
lea r14d, [rdi + 0x40]
mov rcx, r14
call fcn.140037668
mov rbx, rax
mov qword [rax + 8], rdi
mov dword [rax + 0x38], 1
mov r12, rax
lea rcx, [rsp + 0x88]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::_Lockit::constructor_void____ptr64]
cmp qword [0x140049de8], rdi
jne 0x140012c72
mov qword [0x140049de8], rbx
mov r12, rdi
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
inc qword [0x140049df0]
lea rcx, [rsp + 0x88]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::_Lockit::destructor_void____ptr64]
cmp r12, rdi
je 0x140012c94
mov rcx, r12
call fcn.1400375e4
mov rbx, qword [0x140049de8]
mov rcx, r14
call fcn.140037668
mov qword [rax + 8], rbx
mov dword [rax + 0x38], edi
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x38], rdi
mov qword [rax], rax
mov rax, qword [rbp + 0x28]
mov qword [rax + 0x10], rax
lea rcx, [rbp + 0x40]
call fcn.140030dac
nop
mov rcx, rbp
call fcn.1400206d8
nop
mov byte [rsi + 0x290], dil
mov r12d, 0x30
mov rcx, r12
call fcn.140037668
mov rbx, rax
mov qword [rax + 8], rdi
mov dword [rax + 0x28], 1
mov rbp, rax
lea rcx, [rsp + 0x90]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::_Lockit::constructor_void____ptr64]
cmp qword [0x140049df8], rdi
jne 0x140012d1e
mov qword [0x140049df8], rbx
mov rbp, rdi
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
inc qword [0x140049e00]
lea rcx, [rsp + 0x90]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::_Lockit::destructor_void____ptr64]
cmp rbp, rdi
je 0x140012d40
mov rcx, rbp
call fcn.1400375e4
mov rbx, qword [0x140049df8]
mov rcx, r12
call fcn.140037668
mov qword [rax + 8], rbx
mov dword [rax + 0x28], edi
mov qword [rsi + 0x288], rax
mov qword [rsi + 0x298], rdi
mov qword [rax], rax
mov rax, qword [rsi + 0x288]
mov qword [rax + 0x10], rax
mov dword [rsi + 0x2a0], edi
mov dword [rsi + 0x2a4], edi
mov dword [rsi + 0x2a8], 1
mov dword [rsi + 0x2ac], edi
mov qword [rsi + 0x2b0], rdi
lea rcx, [0x140048170]
mov rax, qword [0x140048170]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi + 0x2b8], rax
lea rcx, [0x140048170]
mov rax, qword [0x140048170]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi + 0x2c0], rax
mov dword [rsi + 0x2c8], edi
mov byte [rsi + 0x2cc], dil
lea rcx, [rsi + 0x2cd]
call fcn.14002a1bc
mov byte [rsi + 0x2e0], dil
mov r12d, 0x20
mov rcx, r12
call fcn.140037668
mov rbx, rax
mov qword [rax + 8], rdi
mov dword [rax + 0x1c], 1
mov rbp, rax
lea rcx, [rsp + 0x88]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::_Lockit::constructor_void____ptr64]
cmp qword [0x140049e08], rdi
jne 0x140012e34
mov qword [0x140049e08], rbx
mov rbp, rdi
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
inc qword [0x140049e10]
lea rcx, [rsp + 0x88]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::_Lockit::destructor_void____ptr64]
cmp rbp, rdi
je 0x140012e56
mov rcx, rbp
call fcn.1400375e4
mov rbx, qword [0x140049e08]
mov rcx, r12
call fcn.140037668
mov qword [rax + 8], rbx
mov dword [rax + 0x1c], edi
mov qword [rsi + 0x2d8], rax
mov qword [rsi + 0x2e8], rdi
mov qword [rax], rax
mov rax, qword [rsi + 0x2d8]
mov qword [rax + 0x10], rax
mov qword [rsi + 0x2f8], rdi
mov qword [rsi + 0x300], rdi
mov qword [rsi + 0x308], rdi
mov qword [0x140049b20], rsi
mov rcx, rsi
call fcn.1400131dc
mov ebx, 2
mov dword [rsp + 0x80], ebx
lea ebp, [rbx + 2]
mov dword [rsp + 0x88], ebp
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r12d, [rbx + 0xe]
mov r9d, r12d
lea r8, [0x140003af8]
lea rdx, [0x140003b40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
mov r14, 0xffffffff80000001
cmp eax, edi
jne 0x140012f19
mov ecx, dword [rsp + 0x80]
cmp ecx, ebx
jb 0x140012f64
mov dword [rsp + 0x88], ebp
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9d, r12d
lea r8, [0x140003af8]
lea rdx, [0x140003b40]
mov rcx, r14
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
cmp eax, edi
jne 0x140012f68
mov ecx, dword [rsp + 0x80]
cmp ecx, ebx
jbe 0x140012f6a
mov ecx, ebx
cmp ecx, ebx
setl al
mov byte [rsi + 0x2cc], al
cmp al, dil
je 0x140012f89
cmp ecx, 1
setne dil
mov dword [rsi + 0x2c8], edi
jmp 0x140012fe9
mov dword [rsp + 0x80], edi
mov dword [rsp + 0x88], ebp
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9d, r12d
lea r8, [0x140003ad0]
lea rdx, [0x140003240]
mov rcx, r14
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
cmp eax, edi
jne 0x140012fe3
cmp dword [rsp + 0x80], ebx
cmovbe ebx, dword [rsp + 0x80]
mov dword [rsi + 0x2c8], ebx
mov rax, rsi
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret