Function at 0x180003170
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc8
mov rax, qword [0x18002b018]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov rbx, r9
mov rdi, r8
mov rax, rdx
mov rsi, rcx
mov qword [rbp - 0x41], rcx
mov qword [rbp - 0x39], r8
mov qword [rbp - 0x29], rbx
xor r15d, r15d
mov qword [rbp - 0x11], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], 0xf
mov byte [rbp - 0x11], r15b
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x1800031cf
mov rdx, qword [r8]
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20119
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x18000329f
mov qword [rsi], r15
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
xor r8d, r8d
lea rdx, [0x1800267c2]
mov rcx, rsi
call fcn.180002bb0
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x180003251
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x18000324c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180003434
mov rcx, r8
call fcn.180004da0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800033f4
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1800033ef
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180003428
jmp 0x1800033ec
mov dword [rbp - 0x49], r15d
mov dword [rbp - 0x19], r15d
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1800032b4
mov rdx, qword [rbx]
lea rax, [rbp - 0x49]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x19]
xor r8d, r8d
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180003350
mov edx, dword [rbp - 0x49]
lea ecx, [rax + 1]
call fcn.18000b678
mov r14, rax
test rax, rax
je 0x180003350
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1800032f7
mov rdx, qword [rbx]
lea rax, [rbp - 0x49]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x19]
xor r8d, r8d
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r8d, dword [rbp - 0x49]
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
mov qword [rbp - 0x51], 0xf
mov rdx, r14
lea rcx, [rbp - 0x69]
call fcn.180002bb0
movups xmm0, xmmword [rbp - 0x69]
movups xmmword [rbp - 0x29], xmm0
movups xmm0, xmmword [rbp - 0x59]
movups xmmword [rbp - 0x39], xmm0
mov rcx, r14
call fcn.18000b584
jmp 0x180003360
movups xmm0, xmmword [rbp - 1]
movups xmmword [rbp - 0x39], xmm0
movups xmm0, xmmword [rbp - 0x11]
movups xmmword [rbp - 0x29], xmm0
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [rbp - 0x29]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbp - 0x39]
movups xmmword [rsi + 0x10], xmm1
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x1800033af
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x1800033aa
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180003422
mov rcx, r8
call fcn.180004da0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800033f4
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1800033ef
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000342e
mov rcx, r8
call fcn.180004da0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov rax, rsi
mov byte [rbx], 0
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.180004d80
add rsp, 0xc8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18000b50c
nop
call fcn.18000b50c
int3
call fcn.18000b50c
nop
call fcn.18000b50c
int3