Function at 0x1280b580
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0xd0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x12a52ee0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rcx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Keyboard_LayoutPreload
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1280b800
xor r13d, r13d
mov r12d, r13d
mov qword [rsp + 0xa0], 7
mov qword [rsp + 0x98], r13
mov word [rsp + 0x88], r13w
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x30], r13d
mov rcx, rdi
call fcn.128338d0
nop dword [rax]
inc r12d
mov r8d, r12d
lea rdx, [0x129b47c8]
lea rcx, [rsp + 0x80]
call fcn.12804810
mov dword [rsp + 0x30], 0x12
lea rdx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 8
cmovae rdx, qword [rsp + 0x88]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1280b7b8
xor edx, edx
lea r8d, [rax + 0x10]
lea rcx, [rsp + 0xa8]
call fcn.1295abc4
cmp eax, 0xffff
jae 0x1280b6af
mov ecx, eax
shl ecx, 0x10
or eax, ecx
mov r8d, eax
mov qword [rsp + 0x40], r8
mov rdx, qword [rdi + 0x18]
test rdx, rdx
jne 0x1280b6c5
mov rcx, r13
jmp 0x1280b6d0
mov rcx, qword [rdi + 0x28]
sub rcx, rdx
sar rcx, 3
mov rbx, qword [rdi + 0x20]
mov rax, rbx
sub rax, rdx
sar rax, 3
cmp rax, rcx
jae 0x1280b6f3
mov qword [rbx], r8
lea rax, [rbx + 8]
mov qword [rdi + 0x20], rax
jmp 0x1280b620
cmp rdx, rbx
jbe 0x1280b6fd
call fcn.1295850c
mov rsi, qword [rdi]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rbx
mov rcx, qword [rdi + 0x20]
mov rbp, qword [rdi + 0x18]
mov rax, rcx
sub rax, rbp
test rax, 0xfffffffffffffff8
jne 0x1280b725
mov rbx, r13
jmp 0x1280b745
cmp rbp, rcx
jbe 0x1280b72f
call fcn.1295850c
test rsi, rsi
je 0x1280b739
cmp rsi, qword [rdi]
je 0x1280b73e
call fcn.1295850c
sub rbx, rbp
sar rbx, 3
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x70], xmm0
lea r9, [rsp + 0x40]
mov r8d, 1
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.12898c10
mov rbp, qword [rdi + 0x18]
cmp rbp, qword [rdi + 0x20]
jbe 0x1280b777
call fcn.1295850c
mov rsi, qword [rdi]
test rsi, rsi
jne 0x1280b789
call fcn.1295850c
mov r11, r13
jmp 0x1280b78c
mov r11, qword [rsi]
lea rcx, [rbp + rbx*8]
cmp rcx, qword [r11 + 0x20]
ja 0x1280b7ae
test rsi, rsi
je 0x1280b7a1
mov rax, qword [rsi]
jmp 0x1280b7a4
mov rax, r13
cmp rcx, qword [rax + 0x18]
jae 0x1280b620
call fcn.1295850c
jmp 0x1280b620
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rsp + 0xa0], 8
jb 0x1280b7dc
mov rcx, qword [rsp + 0x88]
call fcn.12958250
mov qword [rsp + 0xa0], 7
mov qword [rsp + 0x98], r13
mov word [rsp + 0x88], r13w
mov eax, 1
jmp 0x1280b802
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.12959850
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret