Function at 0x140008bb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
xor ebx, ebx
mov r12, r8
mov dword [rbp - 0x1c], ebx
mov rax, rcx
mov dword [rbp - 0x20], ebx
mov dword [rbp - 0x24], ebx
mov dword [rbp - 0x28], ebx
test rcx, rcx
je 0x140008e57
test rdx, rdx
je 0x140008e57
test r8, r8
je 0x140008e57
test r9, r9
je 0x140008e57
mov r14, qword [rbp + 0x68]
test r14, r14
je 0x140008e57
mov rsi, qword [rbp + 0x78]
test rsi, rsi
je 0x140008e57
mov r15d, dword [rbp + 0x70]
cmp r15d, 1
ja 0x140008c3e
cmp dword [rsi], 1
jne 0x140008c3e
xor eax, eax
jmp 0x140008e65
lea rcx, [rbp - 0x24]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, [rbp - 0x1c]
mov rcx, rax
mov qword [rsp + 0x20], rbx
mov rdx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x140008c79
mov ecx, edi
call fcn.140002874
mov eax, edi
jmp 0x140008e65
lea rax, [rbp - 0x28]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
mov rdx, r14
mov qword [rsp + 0x20], rbx
mov rcx, r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140008c6b
mov ecx, dword [rbp - 0x24]
cmp r15d, 1
ja 0x140008cc7
mov eax, dword [rbp - 0x20]
cmp dword [rbp - 0x1c], eax
jne 0x140008cbc
cmp ecx, dword [rbp - 0x28]
je 0x140008cc7
mov dword [rsi], 1
jmp 0x140008c37
inc ecx
mov edi, 0xfffffffe
and ecx, edi
mov dword [rbp - 0x24], ecx
add ecx, 2
call fcn.14000c800
mov qword [rbp - 0x18], rax
mov r12, rax
test rax, rax
jne 0x140008cf1
mov ebx, 0xe
jmp 0x140008e5c
mov ecx, dword [rbp - 0x28]
inc ecx
and ecx, edi
mov dword [rbp - 0x28], ecx
add ecx, 2
call fcn.14000c800
mov qword [rbp - 0x10], rax
mov r13, rax
test rax, rax
jne 0x140008d1a
lea rcx, [rbp - 0x18]
call fcn.14000cca4
jmp 0x140008ce7
mov rcx, qword [rbp + 0x48]
lea rax, [rbp - 0x24]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x1c]
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rdx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140008e40
mov rcx, qword [rbp + 0x58]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov rdx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140008e40
mov r8d, dword [rbp - 0x1c]
mov ecx, dword [rbp - 0x24]
cmp r8d, dword [rbp - 0x20]
jne 0x140008dd6
cmp ecx, dword [rbp - 0x28]
jne 0x140008dd6
test ecx, ecx
je 0x140008dae
mov r9, r12
mov rdx, r13
sub r9, r13
mov al, byte [rdx]
cmp byte [r9 + rdx], al
jne 0x140008dd6
inc ebx
inc rdx
cmp ebx, ecx
jb 0x140008d9d
lea eax, [r15 - 2]
test eax, 0xfffffffd
jne 0x140008e22
mov dword [rsp + 0x28], 3
mov r9, r12
mov dword [rsp + 0x20], ecx
mov rdx, r14
mov rcx, qword [rbp + 0x50]
call fcn.140009670
jmp 0x140008e22
lea eax, [r15 - 3]
cmp eax, 1
ja 0x140008e1c
mov dword [rsp + 0x28], 1
mov r9, r12
mov dword [rsp + 0x20], ecx
mov rdx, r14
mov rcx, qword [rbp + 0x50]
call fcn.140009670
mov eax, dword [rbp - 0x28]
mov r9, r13
mov r8d, dword [rbp - 0x20]
mov rdx, r14
mov rcx, qword [rbp + 0x60]
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], eax
call fcn.140009670
mov dword [rsi], 1
lea rcx, [rbp - 0x18]
call fcn.14000cca4
lea rcx, [rbp - 0x10]
call fcn.14000cca4
xor ecx, ecx
call fcn.140002874
jmp 0x140008c37
lea rcx, [rbp - 0x18]
call fcn.14000cca4
lea rcx, [rbp - 0x10]
call fcn.14000cca4
jmp 0x140008c6b
mov ebx, 0x57
mov ecx, ebx
call fcn.140002874
mov eax, ebx
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret