Function at 0x180017770
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x88
mov rax, qword [0x18008b0c0]
xor rax, rsp
mov qword [rbp + 7], rax
mov r12, r9
mov r10, r8
mov rax, rdx
mov r14, rcx
mov qword [rbp - 0x31], rcx
xor r13d, r13d
mov dword [rbp - 0x39], r13d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], 7
mov word [rcx], r13w
mov dword [rbp - 0x39], 1
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r10
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800179e3
mov dword [rbp - 0x29], r13d
mov dword [rbp - 0x19], r13d
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x19]
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800179d9
cmp dword [rbp - 0x19], 1
jne 0x1800179d9
xorps xmm0, xmm0
mov ebx, dword [rbp - 0x29]
movdqu xmmword [rbp - 0x11], xmm0
mov esi, r13d
mov qword [rbp - 1], r13
cmp rbx, 2
jb 0x1800178b2
and rbx, 0xfffffffffffffffe
cmp rbx, 0x1000
jb 0x18001787b
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x180017a06
call fcn.1800624dc
test rax, rax
je 0x1800179c7
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180017890
test rbx, rbx
je 0x18001788d
mov rcx, rbx
call fcn.1800624dc
mov rdi, rax
jmp 0x180017890
mov rdi, r13
mov qword [rbp - 0x11], rdi
lea rsi, [rbx + rdi]
mov qword [rbp - 1], rsi
mov r8, rbx
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov r15, rsi
mov qword [rbp - 9], rsi
jmp 0x1800178ba
mov r15, qword [rbp - 9]
mov rdi, qword [rbp - 0x11]
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180017998
mov ebx, dword [rbp - 0x29]
sub rbx, 2
shr rbx, 1
mov rcx, r15
sub rcx, rdi
sar rcx, 1
cmp rbx, rcx
jae 0x180017905
lea rax, [rdi + rbx*2]
mov qword [rbp - 9], rax
jmp 0x180017945
jbe 0x180017945
mov rax, rsi
sub rax, rdi
sar rax, 1
cmp rbx, rax
jbe 0x18001792b
mov rdx, rbx
lea rcx, [rbp - 0x11]
call fcn.180032800
mov rsi, qword [rbp - 1]
mov rdi, qword [rbp - 0x11]
jmp 0x180017945
sub rbx, rcx
add rbx, rbx
mov r8, rbx
xor edx, edx
mov rcx, r15
call sub.VCRUNTIME140.dll_memset
add r15, rbx
mov qword [rbp - 9], r15
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x180017950
mov rax, qword [r14 + 0x18]
cmp rdx, rax
ja 0x18001798c
mov r15, r14
cmp rax, 7
jbe 0x18001796f
mov r15, qword [r14]
mov qword [r14 + 0x10], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, rdi
mov rcx, r15
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + r15], r13w
jmp 0x180017998
mov r9, rdi
mov rcx, r14
call fcn.18002a4f0
nop
test rdi, rdi
je 0x1800179d9
sub rsi, rdi
sar rsi, 1
add rsi, rsi
mov rax, rdi
cmp rsi, 0x1000
jb 0x1800179ce
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800179ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rsi
mov rcx, rdi
call fcn.1800620a0
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, r14
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.180061d10
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.180002420
int3