Function at 0x1000813f8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x490
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rsi, rcx
mov rax, r8
xor ebp, ebp
lea rcx, [rsp + 0x38]
lea r9d, [rbp + 9]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rdi, rdx
mov qword [rsp + 0x38], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea r12, [0x10000c564]
mov ebx, eax
cmp eax, ebp
je 0x100081470
lea rcx, [0x10001e818]
xor r9d, r9d
mov r8d, eax
xor edx, edx
call fcn.1000ba5ac
mov edx, 0x410013a
mov rcx, rdi
jmp 0x1000817bb
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea rdx, [0x10001e838]
xor r8d, r8d
mov dword [rsp + 0x30], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, ebp
je 0x1000814d1
lea rcx, [0x10001e608]
xor r9d, r9d
mov r8d, eax
xor edx, edx
call fcn.1000ba5ac
mov edx, 0x420013a
lea rcx, [0x10001e838]
jmp 0x1000817bb
mov eax, dword [rsp + 0x30]
mov ecx, 0x897
shr rax, 1
mov word [rsp + rax*2 + 0x70], bp
call fcn.1000ba420
mov rcx, rax
call fcn.1000b99b0
lea rcx, [0x10001e850]
mov r8, rdi
mov rdx, rsi
call fcn.1000b99b0
mov ecx, 0x892
call fcn.1000ba420
mov rcx, rax
call fcn.1000b99b0
lea rdx, [rsp + 0x70]
lea rcx, [0x100013bc0]
call fcn.1000b99b0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x34]
lea rdx, [0x10001e868]
xor r8d, r8d
mov dword [rsp + 0x30], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, ebp
je 0x100081585
lea rcx, [0x10001e608]
xor r9d, r9d
mov r8d, eax
xor edx, edx
call fcn.1000ba5ac
mov edx, 0x434013a
lea rcx, [0x10001e868]
jmp 0x1000817bb
mov eax, dword [rsp + 0x30]
mov ecx, 0x898
shr rax, 1
mov word [rsp + rax*2 + 0x70], bp
call fcn.1000ba420
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.1000b99b0
mov rcx, r12
call fcn.1000b99b0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x34]
lea rdx, [0x10001e878]
xor r8d, r8d
mov dword [rsp + 0x30], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, ebp
jne 0x10008162d
mov eax, dword [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [0x1000048e8]
shr rax, 1
mov word [rsp + rax*2 + 0x70], bp
call fcn.1000b99b0
lea rcx, [rsp + 0x70]
call fcn.1000811e4
mov ebx, eax
cmp eax, ebp
je 0x100081652
xor r9d, r9d
mov r8d, eax
mov edx, 0x44a013a
xor ecx, ecx
call fcn.1000b51b8
jmp 0x100081652
cmp eax, 2
jne 0x100081793
mov ecx, 0x884
call fcn.1000ba420
mov rcx, rax
call fcn.1000b99b0
mov rcx, r12
call fcn.1000b99b0
mov ebx, ebp
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea rdx, [0x10001e888]
xor r8d, r8d
mov dword [rsp + 0x30], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, ebp
jne 0x100081738
mov eax, dword [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [0x1000048e8]
shr rax, 1
mov word [rsp + rax*2 + 0x70], bp
call fcn.1000b99b0
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
cmp eax, ebp
jne 0x100081701
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov ecx, 0x881
mov edi, eax
call fcn.1000ba420
xor r9d, r9d
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.1000ba5ac
xor r9d, r9d
mov r8d, edi
mov edx, 0x37d013a
xor ecx, ecx
call fcn.1000b51b8
jmp 0x10008171d
mov ecx, 0x882
call fcn.1000ba420
mov rcx, rax
call fcn.1000b99b0
mov rcx, r12
call fcn.1000b99b0
mov edi, ebp
cmp edi, ebp
je 0x100081759
lea rcx, [rsp + 0x70]
xor r9d, r9d
mov r8d, edi
mov edx, 0x468013a
call fcn.1000b51b8
jmp 0x100081759
cmp eax, 2
jne 0x100081761
mov ecx, 0x886
call fcn.1000ba420
mov rcx, rax
call fcn.1000b99b0
mov rcx, r12
call fcn.1000b99b0
mov edi, ebp
cmp ebx, ebp
jne 0x1000817c6
mov ebx, edi
jmp 0x1000817c6
mov ecx, 0x885
call fcn.1000ba420
mov edx, edi
mov rcx, rax
call fcn.1000b99b0
mov rcx, r12
call fcn.1000b99b0
cmp ebx, ebp
mov r8d, edi
mov edx, 0x478013a
lea rcx, [0x10001e888]
cmove ebx, edi
jmp 0x1000817be
mov ecx, 0x885
call fcn.1000ba420
mov edx, ebx
mov rcx, rax
call fcn.1000b99b0
mov rcx, r12
call fcn.1000b99b0
mov edx, 0x456013a
lea rcx, [0x10001e878]
mov r8d, ebx
xor r9d, r9d
call fcn.1000b51b8
mov rcx, r12
call fcn.1000b99b0
mov rcx, qword [rsp + 0x38]
cmp rcx, rbp
je 0x1000817de
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1000ef870
add rsp, 0x490
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret