Function at 0x180010720
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r13
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0x98
mov rax, qword [0x1800470b8]
xor rax, rsp
mov qword [rbp - 9], rax
cmp qword [rdx + 0x18], 8
mov r15, r9
mov r13, qword [rbp + 0x77]
mov r14, r8
jb 0x180010756
mov rdx, qword [rdx]
mov r9d, dword [rbp + 0x7f]
lea rax, [rbp - 0x31]
mov rcx, qword [rcx]
or r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180010781
xor al, al
jmp 0x180010984
mov qword [rsp + 0x80], rdi
mov rdx, r14
xor edi, edi
mov qword [rsp + 0x78], r12
xor r12b, r12b
mov dword [r13], edi
cmp qword [r14 + 0x18], 8
mov dword [rbp - 0x35], edi
mov dword [rbp - 0x39], edi
jb 0x1800107aa
mov rdx, qword [r14]
mov rcx, qword [rbp - 0x31]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x35]
mov qword [rsp + 0x90], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x88], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x1800107e8
test eax, eax
jne 0x180010959
mov ecx, dword [rbp - 0x39]
mov eax, 2
mul rcx
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.180017d00
mov ecx, dword [rbp - 0x39]
mov rsi, rax
test rcx, rcx
je 0x18001081c
movzx eax, di
mov rdi, rsi
rep stosw word [rdi], ax
xor edi, edi
cmp qword [r14 + 0x18], 8
jb 0x180010826
mov r14, qword [r14]
mov rcx, qword [rbp - 0x31]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x35]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18001094c
cmp dword [rbp - 0x35], 1
jne 0x180010873
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x180010856
mov r8, rbx
mov rdx, rsi
mov rcx, r15
call fcn.180003d10
jmp 0x180010942
mov eax, dword [rbp - 0x35]
cmp eax, 7
je 0x180010884
cmp eax, 2
jne 0x180010942
mov r8d, dword [rbp - 0x39]
lea rcx, [rbp - 0x29]
movdqa xmm0, xmmword [0x180040ba0]
inc r8d
shr r8, 1
mov rdx, rsi
movdqu xmmword [rbp - 0x19], xmm0
mov word [rbp - 0x29], di
call fcn.180003d10
lea rax, [rbp - 0x29]
cmp r15, rax
je 0x180010906
mov rdx, qword [r15 + 0x18]
cmp rdx, 8
jb 0x1800108f3
mov rcx, qword [r15]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1800108ee
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001099f
mov rcx, rdi
call fcn.180017cf8
movups xmm0, xmmword [rbp - 0x29]
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm1
jmp 0x180010942
mov rdx, qword [rbp - 0x11]
cmp rdx, 8
jb 0x180010942
mov rcx, qword [rbp - 0x29]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001093d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001099f
call fcn.180017cf8
mov eax, dword [rbp - 0x35]
mov r12b, 1
mov dword [r13], eax
test rsi, rsi
je 0x180010959
mov rcx, rsi
call fcn.180017cf8
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x88]
movzx eax, r12b
mov r12, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.180017e90
add rsp, 0x98
pop r15
pop r14
pop r13
pop rbp
ret
call fcn.18001c36c
int3