Function at 0x18002fab0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x140
mov rax, qword [0x180046038]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov edi, edx
mov r13, rcx
mov dword [rbp - 0x80], 0x584f5ed0
mov dword [rbp - 0x7c], 0x2e2aa87f
mov dword [rbp - 0x78], 0xf46d5f88
mov dword [rbp - 0x74], 0xb4cf8ea7
mov dword [rbp - 0x70], 0x27591aa7
mov dword [rbp - 0x6c], 0x8f262501
mov dword [rbp - 0x68], 0x9ca56b93
mov dword [rbp - 0x64], 0x4a83a7d9
mov dword [rbp - 0x60], 0xc15fee20
mov dword [rbp - 0x5c], 0x335a11cf
mov dword [rbp - 0x58], 0xc00ffe93
mov dword [rbp - 0x54], 0x545c1f0a
mov dword [rbp - 0x50], 0x863fb89f
mov dword [rbp - 0x4c], 0x7a744c80
mov qword [rbp - 0x48], 0xf8a2
xor esi, esi
movabs rax, 0x32323a33333a3132
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 0x41c64e6d
mov qword [rbp - 0x30], 0x3039
mov qword [rbp - 0x28], 0x10000
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.180007828
cmp qword [rax + 0x18], 8
jb 0x18002fb90
mov rax, qword [rax]
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
lea rcx, [rsp + 0x60]
call fcn.180006a18
test ebx, ebx
jne 0x180030053
mov dword [rbp - 0x18], 1
mov dword [rbp - 8], 3
mov dword [rsp + 0x30], 0x58725ef7
mov dword [rsp + 0x34], 0x2e13a85c
movabs rax, 0x32323a33333a3132
mov qword [rsp + 0x48], 0x41c64e6d
mov qword [rsp + 0x50], 0x3039
mov qword [rsp + 0x58], 0x10000
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
cmp edi, 1
jne 0x18002fcb2
mov qword [rsp + 0x38], 0x5fee
call fcn.1800075fc
cmp qword [rax + 0x18], 8
jb 0x18002fc39
mov rax, qword [rax]
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 8]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
lea rcx, [rsp + 0x60]
call fcn.180006a18
test ebx, ebx
je 0x18002fc7a
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x180030053
mov ecx, dword [rbp - 0x18]
add ecx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
call fcn.1800124d0
mov rsi, rax
mov r8d, dword [rbp - 0x18]
inc r8d
xor edx, edx
mov rcx, rax
call fcn.18000e220
mov qword [rsp + 0x38], 0x5fee
jmp 0x18002fd33
mov qword [rsp + 0x38], 0x5fed
call fcn.1800075fc
cmp qword [rax + 0x18], 8
jb 0x18002fcca
mov rax, qword [rax]
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 8]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
lea rcx, [rsp + 0x60]
call fcn.180006a18
test ebx, ebx
jne 0x18002fc6b
mov ecx, dword [rbp - 0x18]
add ecx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
call fcn.1800124d0
mov rsi, rax
mov r8d, dword [rbp - 0x18]
inc r8d
xor edx, edx
mov rcx, rax
call fcn.18000e220
mov qword [rsp + 0x38], 0x5fed
movabs r12, 0x32323a33333a3132
xor r14d, r14d
mov dword [rsp + 0x30], 0x58725ef7
mov dword [rsp + 0x34], 0x2e13a85c
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 0x41c64e6d
mov qword [rsp + 0x50], 0x3039
mov qword [rsp + 0x58], 0x10000
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.1800075fc
cmp qword [rax + 0x18], 8
jb 0x18002fd89
mov rax, qword [rax]
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 8]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x60]
call fcn.180006a18
mov edx, dword [rbp - 0x18]
mov rcx, rsi
call fcn.180031af4
movdqa xmm0, xmmword [0x1800325e0]
movdqu xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0x41c64e6d
mov qword [rbp + 0x20], 0x3039
mov qword [rbp + 0x28], 0x100
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.180006b90
nop
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.180030784
mov rdi, rax
mov r15d, 0x1000
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x18002fe46
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r15
jb 0x18002fe41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180030086
call fcn.18000b91c
mov ecx, 0x30
call fcn.18000b8e0
mov rbx, rax
test rax, rax
je 0x18002fe68
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
xorps xmm1, xmm1
movups xmmword [rax + 0x20], xmm1
jmp 0x18002fe6b
mov rbx, r14
mov rax, qword [rbp - 0x20]
mov qword [rbx], rax
mov qword [rbx + 8], rdi
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.180006b90
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x18002fe91
mov r8, qword [rax]
lea rcx, [rbx + 0xf]
inc rcx
cmp byte [rcx], r14b
jne 0x18002fe95
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x18002fe9f
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x18002fee6
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r15
jb 0x18002fee1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003008c
call fcn.18000b91c
lea rcx, [rbx + 0x1f]
inc rcx
cmp byte [rcx], r14b
jne 0x18002feea
xor edx, edx
mov al, byte [rdx + r13]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x18002fef4
movdqa xmm0, xmmword [0x180032680]
movdqu xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov r13d, 0x41c64e6d
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], 0x3039
mov qword [rbp + 0x28], 0x100
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.180007298
mov rdi, rax
cmp qword [rax + 0x18], 0x10
jb 0x18002ff48
mov rdi, qword [rax]
movdqa xmm0, xmmword [0x180032670]
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], 0x3039
mov qword [rbp - 0x58], 0x100
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x80]
call fcn.180007298
cmp qword [rax + 0x18], 0x10
jb 0x18002ff85
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x18002ffd6
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r15
jb 0x18002ffd1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180030092
call fcn.18000b91c
movdqa xmm0, xmmword [0x1800325f0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], r14b
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x18003001e
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r15
jb 0x180030019
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180030080
call fcn.18000b91c
movdqa xmm0, xmmword [0x1800325f0]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], r14b
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
mov r9, rbx
lea r8, [0x1800319dc]
xor edx, edx
xor ecx, ecx
call rdi
mov rcx, rsi
call fcn.1800124bc
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.18000ba30
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180012344
int3
call fcn.180012344
int3
call fcn.180012344
nop
call fcn.180012344
nop
lea rcx, [rdx + 0x60]
jmp fcn.1800053bc