Function at 0x18003fce0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov qword [rbp], 0xfffffffffffffffe
mov qword [rsp + 0x218], rbx
mov rax, qword [0x1801fdc38]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rbx, r8
mov r13, rdx
mov qword [rbp - 0x68], rdx
mov rdi, rcx
mov qword [rbp - 8], rdx
xor r15d, r15d
mov dword [rsp + 0x68], r15d
lea edx, [r15 + 0x5c]
xor r8d, r8d
mov rcx, rbx
call fcn.180015630
cmp rax, 0xffffffffffffffff
je 0x18003fd62
mov r9d, 0x20019
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.18003f7c0
mov r14, rax
jmp 0x18003fd9a
mov qword [rbp + 0x20], 7
mov qword [rbp + 0x18], r15
mov word [rbp + 8], r15w
mov r9d, 0x20019
lea r8, [rbp + 8]
xor edx, edx
mov rcx, rdi
call fcn.18003f7c0
mov r14, rax
cmp qword [rbp + 0x20], 8
jb 0x18003fd9a
mov rcx, qword [rbp + 8]
call fcn.1801196dc
mov qword [rbp - 0x80], r15
mov ecx, 0x70
call fcn.1801196e4
test rax, rax
je 0x18004023b
mov qword [rsp + 0x78], rax
mov qword [rax], rax
mov rax, qword [rsp + 0x78]
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x78]
mov qword [rax + 0x10], rax
mov rax, qword [rsp + 0x78]
mov byte [rax + 0x68], 1
mov rax, qword [rsp + 0x78]
mov byte [rax + 0x69], 1
test r14, r14
jne 0x18003fe16
lea rdx, [rsp + 0x70]
mov rcx, r13
call fcn.180040470
mov dword [rsp + 0x68], 1
mov r8, qword [rsp + 0x78]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x70]
call fcn.180040570
nop
jmp 0x180040268
mov dword [rsp + 0x64], r15d
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x6c], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x18003fea5
lea rdx, [rsp + 0x70]
mov rcx, r13
call fcn.180040470
mov dword [rsp + 0x68], 1
mov r8, qword [rsp + 0x78]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x70]
call fcn.180040570
nop
jmp 0x180040268
mov edx, dword [rsp + 0x64]
inc edx
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r15
lea rcx, [rbp - 0x40]
call fcn.1800061a0
nop
mov edx, dword [rsp + 0x60]
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], r15
lea rcx, [rbp - 0x60]
call fcn.180036b40
nop
mov ebx, r15d
mov r12, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x60]
cmp dword [rsp + 0x6c], ebx
jbe 0x1800400e5
mov r13, qword [rbp - 0x38]
sub r13, r12
sar r13, 1
mov rdi, qword [rbp - 0x58]
mov r15d, edi
sub r15d, esi
xor ecx, ecx
nop word [rax + rax]
mov dword [rbp - 0x70], ecx
mov dword [rsp + 0x64], r13d
mov dword [rsp + 0x60], r15d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x64]
mov r8, r12
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1800400d0
mov dword [rsp + 0x64], r13d
mov dword [rsp + 0x60], r15d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8, r12
mov edx, ebx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1800400d0
cmp dword [rbp - 0x70], 1
jne 0x1800400d0
cmp rsi, rdi
je 0x1800400d0
mov qword [rbp + 0x20], 7
xor eax, eax
mov qword [rbp + 0x18], rax
mov word [rbp + 8], ax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rbp + 8]
call fcn.180015970
nop
mov qword [rbp + 0x48], 7
xor eax, eax
mov qword [rbp + 0x40], rax
mov word [rbp + 0x30], ax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r12
lea rcx, [rbp + 0x30]
call fcn.180015970
nop
lea r8, [rbp + 8]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x60]
call fcn.180040b70
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.180041130
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x70]
call fcn.180040c40
nop
cmp qword [rbp + 0xa0], 8
jb 0x180040055
mov rcx, qword [rbp + 0x88]
call fcn.1801196dc
mov qword [rbp + 0xa0], 7
xor ecx, ecx
mov qword [rbp + 0x98], rcx
mov word [rbp + 0x88], cx
cmp qword [rbp + 0x78], 8
jb 0x180040082
mov rcx, qword [rbp + 0x60]
call fcn.1801196dc
xor ecx, ecx
mov qword [rbp + 0x78], 7
mov qword [rbp + 0x70], rcx
mov word [rbp + 0x60], cx
cmp qword [rbp + 0x48], 8
jb 0x1800400a4
mov rcx, qword [rbp + 0x30]
call fcn.1801196dc
xor ecx, ecx
mov qword [rbp + 0x48], 7
mov qword [rbp + 0x40], rcx
mov word [rbp + 0x30], cx
cmp qword [rbp + 0x20], 8
jb 0x1800400ca
mov rcx, qword [rbp + 8]
call fcn.1801196dc
mov rdi, qword [rbp - 0x58]
jmp 0x1800400d0
mov rdi, qword [rbp - 0x58]
jmp 0x1800400d2
xor ecx, ecx
inc ebx
cmp ebx, dword [rsp + 0x6c]
jb 0x18003ff10
mov r13, qword [rbp - 0x68]
xor r15d, r15d
lea rdx, [rsp + 0x70]
mov rcx, r13
call fcn.180040470
mov dword [rsp + 0x68], 1
test rsi, rsi
je 0x180040108
mov rcx, rsi
call fcn.1801196dc
nop
test r12, r12
je 0x180040116
mov rcx, r12
call fcn.1801196dc
nop
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rbx]
cmp rdi, rdi
jne 0x1800401c4
mov rdi, qword [rbx + 8]
mov rsi, rdi
cmp byte [rdi + 0x69], 0
jne 0x1800401a9
nop word [rax + rax]
mov rdx, qword [rsi + 0x10]
lea rcx, [rsp + 0x70]
call fcn.180040a00
mov rsi, qword [rsi]
cmp qword [rdi + 0x58], 8
jb 0x180040161
mov rcx, qword [rdi + 0x40]
call fcn.1801196dc
mov qword [rdi + 0x58], 7
mov qword [rdi + 0x50], r15
mov word [rdi + 0x40], r15w
cmp qword [rdi + 0x30], 8
jb 0x180040182
mov rcx, qword [rdi + 0x18]
call fcn.1801196dc
mov qword [rdi + 0x30], 7
mov qword [rdi + 0x28], r15
mov word [rdi + 0x18], r15w
mov rcx, rdi
call fcn.1801196dc
mov rdi, rsi
cmp byte [rsi + 0x69], 0
je 0x180040140
mov rbx, qword [rsp + 0x78]
mov qword [rbx + 8], rbx
mov rax, qword [rsp + 0x78]
mov qword [rax], rax
mov rax, qword [rsp + 0x78]
mov qword [rax + 0x10], rax
mov qword [rbp - 0x80], r15
jmp 0x180040231
cmp rdi, rbx
je 0x180040236
nop dword [rax]
mov r8, rdi
cmp byte [rdi + 0x69], 0
jne 0x18004021e
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x69], 0
jne 0x1800401fe
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x69], 0
jne 0x18004021e
nop
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x69], 0
je 0x1800401f0
jmp 0x18004021e
mov rax, qword [rdi + 8]
cmp byte [rax + 0x69], 0
jne 0x18004021b
cmp rdi, qword [rax + 0x10]
jne 0x18004021b
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x69], 0
je 0x180040208
mov rdi, rax
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x70]
call fcn.180040670
cmp rdi, rbx
jne 0x1800401d0
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
jmp 0x18004026d
mov qword [rbp - 0x70], r15
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x20]
call fcn.180119e6c
lea rdx, vtable.std::bad_alloc.0
mov qword [rbp - 0x20], rdx
lea rdx, [0x1801e98a0]
lea rcx, [rbp - 0x20]
call fcn.18011a040
int3
mov rcx, qword [rsp + 0x78]
call fcn.1801196dc
mov rax, r13
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.180119820
mov rbx, qword [rsp + 0x218]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret