Function at 0x18004f290
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x10], edx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xc0
mov rsi, r9
mov r15, rcx
xor r12d, r12d
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x51], rcx
lea r13, vtable.CVolObject.0
mov qword [rbp - 0x51], r13
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x41], r12
lea rax, vtable.CWString.0
mov qword [rbp - 0x51], rax
lea rax, [rbp - 0x31]
mov qword [rbp + 0x1f], rax
mov qword [rbp - 0x31], rcx
mov qword [rbp - 0x31], r13
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], r12
lea rdi, vtable.CVolMem.0
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x19], r12
mov qword [rbp - 9], r12
mov qword [rbp - 0x11], r12
mov qword [rbp - 1], 0x40
mov qword [rbp - 0x39], r12
mov qword [rbp - 1], 0xfe
mov rdx, qword [r8 + 0x18]
lea r14, [0x1802d91d0]
test rdx, rdx
jne 0x18004f34a
cmp qword [r8 + 0x48], rdx
mov rdx, r14
je 0x18004f34a
mov rdx, qword [r8 + 0x38]
mov eax, 0x101
mov r9d, 0x201
cmp dword [rbp + 0x7f], 0
cmovne r9d, eax
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18004f3bb
mov rdx, r14
mov rcx, r15
call fcn.180004100
nop
lea rax, [rbp - 0x31]
mov qword [rbp + 0x1f], rax
mov qword [rbp - 0x31], rdi
mov rdx, qword [rbp - 0x19]
test rdx, rdx
je 0x18004f3a6
lea rcx, [rbp - 0x31]
mov rax, qword [rbp - 0x31]
call qword [rax + 0x18]
mov qword [rbp - 0x19], r12
mov qword [rbp - 9], r12
mov qword [rbp - 0x11], r12
mov qword [rbp - 0x31], r13
jmp 0x18004f502
mov rdx, qword [rsi + 0x18]
test rdx, rdx
jne 0x18004f3d1
cmp qword [rsi + 0x48], rdx
mov rdx, r14
je 0x18004f3d1
mov rdx, qword [rsi + 0x38]
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0xf]
xor r8d, r8d
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18004f4aa
mov ecx, dword [rbp + 0x67]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1800ab4c4
mov rbx, rax
mov ecx, dword [rbp + 0x67]
test rcx, rcx
je 0x18004f432
movzx eax, r12w
mov rdi, rbx
rep stosw word [rdi], ax
lea rdi, vtable.CVolMem.0
mov rdx, qword [rsi + 0x18]
test rdx, rdx
jne 0x18004f448
cmp qword [rsi + 0x48], rdx
mov rdx, r14
je 0x18004f448
mov rdx, qword [rsi + 0x38]
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0xf]
xor r8d, r8d
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov qword [rbp - 0x39], r12
mov rdx, qword [rbp - 0x19]
test rdx, rdx
je 0x18004f47f
lea rcx, [rbp - 0x31]
mov rax, qword [rbp - 0x31]
call qword [rax + 0x18]
mov qword [rbp - 0x19], r12
mov qword [rbp - 9], r12
mov qword [rbp - 0x11], r12
test rbx, rbx
je 0x18004f4a2
cmp word [rbx], 0
je 0x18004f4a2
mov rdx, rbx
lea rcx, [rbp - 0x31]
call fcn.1800a4440
mov rcx, rbx
call fcn.1800ab4bc
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x39]
test rdx, rdx
jne 0x18004f4c9
cmp qword [rbp - 9], rdx
cmovne r14, qword [rbp - 0x19]
mov rdx, r14
mov rcx, r15
call fcn.180004100
nop
lea rax, [rbp - 0x31]
mov qword [rbp + 0x1f], rax
mov qword [rbp - 0x31], rdi
mov rdx, qword [rbp - 0x19]
test rdx, rdx
je 0x18004f4f2
lea rcx, [rbp - 0x31]
mov rax, qword [rbp - 0x31]
call qword [rax + 0x18]
mov qword [rbp - 0x19], r12
mov qword [rbp - 9], r12
mov qword [rbp - 0x11], r12
mov qword [rbp - 0x31], r13
mov qword [rbp - 0x51], r13
mov rax, r15
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret