Function at 0x10008d8cc
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x38
xor ebp, ebp
lea rax, [r11 + 0x20]
mov rdi, rdx
mov rsi, rcx
mov byte [rcx], bpl
mov byte [rdx], bpl
lea r13, [0x10001f280]
mov r9d, 0x2000000
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rdx, r13
mov qword [r11 + 0x20], rbp
mov qword [r11 - 0x48], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea r12d, [rbp + 4]
mov ebx, eax
cmp eax, 2
je 0x10008d9d3
mov dword [rsp + 0x78], ebp
mov dword [rsp + 0x70], ebp
mov dword [rsp + 0x80], r12d
cmp eax, ebp
je 0x10008d942
mov edx, 0xfb3013b
jmp 0x10008dae2
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x80]
lea r13, [0x10001f2f0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x10008d9c9
cmp dword [rsp + 0x78], r12d
jne 0x10008d9e9
cmp dword [rsp + 0x70], ebp
je 0x10008d9e9
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x70]
mov r9d, r12d
xor r8d, r8d
mov rdx, r13
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], ebp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
cmp eax, ebp
je 0x10008d9c4
mov edx, 0xfc7013b
jmp 0x10008dae2
mov byte [rsi], 1
jmp 0x10008d9e9
mov r8d, eax
mov edx, 0xfcf013b
jmp 0x10008d9de
mov edx, 0xfd5013b
mov r8d, 2
xor r9d, r9d
mov rcx, r13
call fcn.1000b51b8
mov rcx, qword [rsp + 0x88]
cmp rcx, rbp
je 0x10008da04
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x88], rbp
lea rax, [rsp + 0x88]
lea r13, [0x10001f320]
mov r9d, 0x2000000
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rdx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, 2
je 0x10008db01
mov dword [rsp + 0x78], ebp
mov dword [rsp + 0x70], ebp
mov dword [rsp + 0x80], r12d
cmp eax, ebp
je 0x10008da5a
mov edx, 0xfec013b
jmp 0x10008dae2
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x80]
lea r13, [0x1000123b8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x10008daf7
cmp dword [rsp + 0x78], r12d
jne 0x10008db17
mov ecx, dword [rsp + 0x70]
mov eax, ecx
and eax, 8
cmp al, bpl
je 0x10008db17
and ecx, 0xfffffff7
lea rax, [rsp + 0x70]
mov r9d, r12d
mov dword [rsp + 0x70], ecx
mov rcx, qword [rsp + 0x88]
xor r8d, r8d
mov rdx, r13
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
cmp eax, ebp
je 0x10008daf2
mov edx, 0x1001013b
mov r8d, eax
xor r9d, r9d
mov rcx, r13
call fcn.1000b51b8
jmp 0x10008db19
mov byte [rdi], 1
jmp 0x10008db17
mov r8d, eax
mov edx, 0x1009013b
jmp 0x10008db0c
mov edx, 0x100f013b
mov r8d, 2
xor r9d, r9d
mov rcx, r13
call fcn.1000b51b8
mov ebx, ebp
cmp ebx, 5
jne 0x10008db25
mov ecx, 0xb0c
jmp 0x10008db34
cmp byte [rsi], bpl
jne 0x10008db2f
cmp byte [rdi], bpl
je 0x10008db48
mov ecx, 0xb0a
call fcn.1000ba420
lea rcx, [0x1000048e8]
mov rdx, rax
call fcn.1000b99b0
mov rcx, qword [rsp + 0x88]
cmp rcx, rbp
je 0x10008db5b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
add rsp, 0x38
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.1000b7bec