Function at 0x180049304
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor r14d, r14d
lea rax, [rbp - 0x18]
mov r12, rdx
mov qword [rbp - 0x18], r14
mov rdi, rcx
mov qword [rbp - 0x10], r14
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionSeCEditReg_Values
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov r9d, 0x20019
xor r8d, r8d
mov r15d, r14d
mov r13d, r14d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov dword [rbp + 0x50], r14d
lea esi, [r14 + 8]
mov dword [rbp + 0x58], r14d
mov ebx, eax
test eax, eax
jne 0x18004952e
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x58]
mov qword [rsp + 0x58], r14
xor r9d, r9d
mov qword [rsp + 0x50], r14
xor r8d, r8d
mov qword [rsp + 0x48], r14
xor edx, edx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x18004952e
cmp dword [rbp + 0x50], r14d
jbe 0x18004952e
mov eax, dword [rbp + 0x58]
lea ecx, [rax + 2]
cmp ecx, eax
jb 0x18004952c
mov eax, ecx
mov ecx, 0xffffffff
add rax, rax
cmp rax, rcx
ja 0x18004952c
mov edx, eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x180049417
lea ebx, [rax + 8]
jmp 0x18004952e
xor r14d, r14d
mov ebx, 1
mov eax, dword [rbp + 0x58]
lea r9, [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
inc eax
mov qword [rsp + 0x38], r14
mov r8, rsi
mov qword [rsp + 0x30], r14
mov edx, r15d
mov qword [rsp + 0x28], r14
mov dword [rbp - 0x20], eax
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
jne 0x180049507
mov rcx, qword [rbp - 0x18]
lea r9, [rbp + 0x50]
lea r8, str.ValueType
mov dword [rbp + 0x50], ebx
mov rdx, rsi
add r15d, ebx
call fcn.180010b50
mov ecx, dword [rbp + 0x50]
lea r9d, [r14 + 0x5c]
lea r8d, [r14 + 0x2f]
mov r14d, dword [rbp - 0x20]
mov edx, r14d
lea eax, [rcx - 1]
cmp eax, 6
cmova ecx, ebx
mov dword [rbp + 0x50], ecx
mov rcx, rsi
call fcn.180012b44
xor ebx, ebx
cmp ebx, dword [rdi]
jae 0x1800494dc
mov rax, qword [r12]
lea rcx, [rbx + rbx*2]
mov rdx, qword [rax + rcx*8]
test rdx, rdx
je 0x1800494ca
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x1800494d0
inc ebx
cmp ebx, dword [rdi]
jb 0x1800494a6
mov r14d, dword [rbp - 0x20]
cmp ebx, dword [rdi]
jb 0x180049414
mov r9d, dword [rbp + 0x50]
lea rcx, [rbp - 0x10]
mov r8d, r14d
mov rdx, rsi
call fcn.18000d5d4
xor r14d, r14d
test eax, eax
jne 0x180049501
lea ebx, [rax + 1]
add r13d, ebx
jmp 0x18004941c
mov r14d, 8
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov r15, qword [rbp - 0x10]
xor ebx, ebx
cmp r14d, 0x103
cmovne ebx, r14d
xor r14d, r14d
jmp 0x18004952e
mov ebx, esi
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x180049543
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
jne 0x180049653
mov eax, dword [rdi]
lea r14d, [rax + r13]
cmp r14d, eax
jb 0x18004964c
lea rcx, [r14 + r14*2]
mov eax, 0xffffffff
shl rcx, 3
cmp rcx, rax
ja 0x18004964c
test r14d, r14d
je 0x18004965d
mov edx, ecx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
xor r10d, r10d
mov rsi, rax
test rax, rax
je 0x180049645
mov r8d, r10d
cmp dword [rdi], r10d
jbe 0x1800495d5
mov ecx, r8d
inc r8d
lea rdx, [rcx + rcx*2]
mov rcx, qword [r12]
mov rax, qword [rcx + rdx*8]
mov qword [rsi + rdx*8], rax
mov rax, qword [r12]
mov rcx, qword [rax + rdx*8 + 8]
mov qword [rsi + rdx*8 + 8], rcx
mov rax, qword [r12]
mov ecx, dword [rax + rdx*8 + 0x10]
mov dword [rsi + rdx*8 + 0x10], ecx
cmp r8d, dword [rdi]
jb 0x1800495a0
mov r8d, r10d
mov rdx, r15
test r15, r15
je 0x180049627
mov r9, qword [rdx]
test r9, r9
je 0x18004961e
cmp r8d, r13d
jae 0x18004961e
mov eax, dword [rdi]
add eax, r8d
lea rcx, [rax + rax*2]
mov qword [rsi + rcx*8], r9
mov qword [rdx], r10
mov eax, dword [rdi]
add eax, r8d
lea rcx, [rax + rax*2]
mov qword [rsi + rcx*8 + 8], r10
mov eax, dword [rdi]
add eax, r8d
inc r8d
lea rcx, [rax + rax*2]
mov eax, dword [rdx + 8]
mov dword [rsi + rcx*8 + 0x10], eax
mov rdx, qword [rdx + 0x10]
test rdx, rdx
jne 0x1800495e0
mov rcx, qword [r12]
test rcx, rcx
je 0x18004963c
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov dword [rdi], r14d
mov qword [r12], rsi
jmp 0x18004965d
mov ebx, 8
jmp 0x18004965d
mov eax, 0x216
jmp 0x180049671
lea eax, [rbx - 2]
cmp eax, 1
cmovbe ebx, r14d
mov edx, 0x137
mov rcx, r15
call fcn.180011f54
mov ecx, ebx
call fcn.18000ec90
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret