Function at 0x180022bd0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
lea rax, [0x18035464f]
mov qword [rsp + 0x38], rax
lea rax, [0x18035467b]
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x38]
call fcn.180024c60
add rsi, rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x48], 0
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0x88]
lea rdi, [rsp + 0x38]
mov rdx, rdi
call fcn.180024c60
mov rsi, qword [rsp + 0xa8]
call fcn.18004b900
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rdi
mov rcx, 0xffffffff80000002
mov rdx, rsi
xor r8d, r8d
mov r9d, 0x20019
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x180022cbd
movabs rax, 0x8000000000000000
mov qword [rbx], rax
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x180022e9d
mov rcx, qword [rsp + 0x90]
add rdx, rdx
mov r8d, 2
jmp 0x180022e98
mov rdi, qword [rsp + 0x38]
mov dword [rsp + 0x34], 0x800
mov rax, qword [0x180380fe8]
movzx eax, byte [rax]
mov ecx, 0x800
mov edx, 1
call fcn.18000a890
test rax, rax
je 0x180022f22
mov r15, rax
mov qword [rsp + 0x70], 0x800
mov qword [rsp + 0x78], rax
mov r14, qword [rsp + 0x90]
mov dword [rsp + 0x58], 0
lea r12, [rsp + 0x34]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x180022e07
lea r13, [rsp + 0x58]
lea rbp, [rsp + 0x70]
jmp 0x180022d80
mov r15, qword [rsp + 0x78]
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
mov r9, r13
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x180022e07
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.1800562c0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], edx
mov qword [rsp + 0x38], 1
cmp edx, 0x800700ea
jne 0x180022ed0
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x800700ea
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x80], rdx
mov r8d, dword [rsp + 0x34]
test r8, r8
je 0x180022df1
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rbp
call fcn.180028950
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x180022d50
mov rcx, r13
call fcn.180056c30
jmp 0x180022d50
mov eax, dword [rsp + 0x34]
and eax, 0xfffffffe
add rax, r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x38]
call fcn.18002ce90
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x180022e4c
mov rcx, qword [rsp + 0x60]
cmp byte [rcx + rax - 1], 0
jne 0x180022e4e
dec rax
jne 0x180022e40
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rbx], xmm0
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x180022e77
mov r8d, 1
mov rcx, r15
call fcn.18000a8a0
mov rcx, rdi
call sub.advapi32.dll_RegCloseKey
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x180022e9d
add rdx, rdx
mov r8d, 2
mov rcx, r14
call fcn.18000a8a0
mov rdx, qword [rsp + 0xa0]
test rdx, rdx
je 0x180022ebb
add rdx, rdx
mov r8d, 2
mov rcx, rsi
call fcn.18000a8a0
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs rcx, 0x8000000000000000
mov qword [rbx], rcx
test rax, rax
je 0x180022eec
lea rcx, [rsp + 0x40]
call fcn.180056c30
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x180022f04
mov r8d, 1
mov rcx, r15
call fcn.18000a8a0
mov rcx, rdi
call sub.advapi32.dll_RegCloseKey
mov rdx, qword [rsp + 0x88]
test rdx, rdx
jne 0x180022ca7
jmp 0x180022e9d
mov ecx, 1
mov edx, 0x800
call fcn.1800debd0
ud2