Function at 0x180017f60
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xbb0]
sub rsp, 0xcb0
mov r15d, dword [rbp + 0xc18]
mov rsi, rcx
mov ebx, dword [rbp + 0xc18]
mov edi, r15d
imul eax, r15d, 0xa48
mov dword [rsp + 0x4c], eax
cmp r15d, eax
ja 0x180018344
mov r13, qword [rbp + 0xc10]
mov ecx, 1
mov r14, qword [rsp + 0x30]
mov r12, qword [rsp + 0x30]
xor eax, eax
cmp edi, 0x8f75
ja 0x1800181ed
je 0x180018183
cmp edi, 0x10a
ja 0x180018071
je 0x180018056
cmp edi, 0xf
je 0x180018037
cmp edi, 0x14
je 0x180018008
cmp edi, 0x41
jne 0x180018309
mov r14d, eax
jmp 0x180018309
movsx eax, word [r8]
mov dword [rbp + 0xb20], eax
movzx eax, word [rsi]
mov word [rbp + 0xb36], ax
movzx eax, word [r13]
mov word [rbp + 0xb38], ax
mov dword [rbp + 0xb1c], 4
jmp 0x180018309
mov rax, qword [rsi]
movsx rdx, word [r13]
mov rcx, qword [rax]
mov eax, dword [r9]
mov rdx, qword [rcx + rdx*8 - 8]
mov ecx, 1
mov dword [rdx], eax
jmp 0x180018309
movzx eax, word [rsi]
mov word [rbp + 0x418], ax
movzx eax, word [r13]
mov word [rbp + 0x41a], ax
jmp 0x180018309
cmp edi, 0xec4
je 0x180018114
cmp edi, 0x2ffd
je 0x1800180fa
cmp edi, 0x5fb9
jne 0x180018309
mov eax, dword [0x1800a10e0]
lea rdx, [rsp + 0x60]
movups xmm0, xmmword [str.Target_Phx.Targets.Architectures.Msil.Register.SR15T]
mov dword [rbp - 0x70], eax
mov r9d, 0x20019
movzx eax, byte [0x1800a10e4]
xor r8d, r8d
movups xmm1, xmmword [0x1800a10c0]
mov rcx, 0xffffffff80000002
mov byte [rbp - 0x6c], al
movaps xmmword [rsp + 0x60], xmm0
lea rax, [rsp + 0x50]
movups xmm0, xmmword [0x1800a10d0]
mov qword [rsp + 0x50], 0xffffffff80000002
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rbp - 0x80], xmm0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x1800181d2
mov dword [rsp + 0x44], 4
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x38], rax
jmp 0x180018309
movzx eax, word [r9]
lea rdx, [rbp + 0x5c0]
mov ecx, 0xffffffd1
mov word [rbp + 0xb3a], ax
call qword [0x1800d5910]
mov rdx, qword [rbp + 0xbf8]
lea r9, [rbp + 0xc18]
xor eax, eax
mov dword [rbp + 0xc18], 0x200
mov word [0x1800d5918], ax
xor r8d, r8d
lea rax, [rbp + 0x7c0]
mov ecx, 0xad
mov qword [rsp + 0x20], rax
call fcn.18006bdd0
mov r9, qword [rbp + 0xc08]
mov ecx, 1
mov r8, qword [rbp + 0xc00]
jmp 0x180018309
test r12, r12
jne 0x18001831f
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.LogPixels
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18001831d
mov rcx, qword [rsp + 0x50]
mov r14d, dword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9, qword [rbp + 0xc08]
mov ecx, 1
mov r8, qword [rbp + 0xc00]
movsxd r12, eax
jmp 0x180018309
cmp edi, 0x187ba
ja 0x1800182f1
je 0x1800182bf
cmp edi, 0xbf31
je 0x180018276
cmp edi, 0xc462
je 0x18001825d
cmp edi, 0xeeed
jne 0x180018309
mov rax, qword [rsp + 0x38]
lea rdx, [rbp + 0xc18]
mov dword [rbp + 0xc18], eax
lea rcx, [rsp + 0x30]
mov rax, qword [rsi]
mov r8d, 0x92
mov qword [rsp + 0x30], rax
call fcn.18004ff10
mov r9, qword [rbp + 0xc08]
mov ecx, 1
mov r8, qword [rbp + 0xc00]
jmp 0x180018309
mov qword [rbp + 0x522], rax
mov dword [rbp + 0x54c], eax
mov word [rbp + 0x52a], ax
jmp 0x180018309
mov rax, qword [rsi]
lea r9, [rsp + 0x38]
mov word [rbp + 0xc18], cx
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0xc18]
mov qword [rsp + 0x30], rax
mov edx, 0x27
mov dword [rsp + 0x38], r14d
call fcn.180030a70
mov r9, qword [rbp + 0xc08]
mov ecx, 1
mov r8, qword [rbp + 0xc00]
mov qword [rsp + 0x38], r14
jmp 0x180018309
mov ecx, 0xffffffef
lea rdx, [rbp - 0x30]
call qword [0x1800d5910]
movzx eax, word [rbp + 0x52a]
mov ecx, 1
mov r9, qword [rbp + 0xc08]
mov r8, qword [rbp + 0xc00]
mov word [0x1800d5918], ax
jmp 0x180018309
cmp edi, 0x24b12
je 0x180018303
cmp edi, 0x30e6a
je 0x180018344
jmp 0x180018309
mov ebx, dword [rbp + 0x54c]
imul eax, r15d, 0xbc
add edi, eax
cmp edi, dword [rsp + 0x4c]
ja 0x180018344
jmp 0x180017fcb
xor eax, eax
mov dword [rbp + 0xc18], eax
lea rdx, [rbp + 0xc18]
mov rax, qword [rsi]
lea rcx, [rsp + 0x30]
mov r8d, 0x92
mov qword [rsp + 0x30], rax
call fcn.18004ff10
mov eax, ebx
mov rbx, qword [rsp + 0xcf0]
add rsp, 0xcb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret