Function at 0x180008550
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7b8]
sub rsp, 0x8b8
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1800851e8]
xor rax, rsp
mov qword [rbp + 0x7a0], rax
mov r12, r9
mov r15, r8
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x38], rdx
mov r13, qword [rbp + 0x820]
mov rax, qword [rbp + 0x828]
lea rdx, [0x1800602c0]
test rax, rax
cmovne rdx, rax
lea rcx, [rsp + 0x60]
call fcn.180008150
nop
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
cmp qword [r14 + 0x18], rax
ja 0x180008656
lea rcx, [rbp - 0x80]
call fcn.180007c90
mov rdi, rax
lea rsi, [r14 + 8]
cmp rsi, rax
je 0x180008616
mov rcx, rsi
call fcn.180003c70
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x10], xmm1
xor eax, eax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], 7
mov word [rdi], ax
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x180008656
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008651
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008ab0
call fcn.18001c898
lea rdx, [r14 + 8]
cmp qword [rdx + 0x18], 8
jb 0x180008664
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1800086ec
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.180008150
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180008a66
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008a61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008a92
jmp 0x180008a61
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SoftWare
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180008784
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.180008150
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180008a66
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008a61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008a98
jmp 0x180008a61
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180008823
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.180008150
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180008a66
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008a61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008a9e
jmp 0x180008a61
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1800088d1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.180008150
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180008a66
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008a61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008aa4
jmp 0x180008a61
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x60]
call fcn.18003ab60
mov dword [rsp + 0x50], 0x400
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp - 0x60]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x180008950
test eax, eax
jne 0x1800089c2
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.180008150
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180008a66
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008a61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008aaa
jmp 0x180008a61
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.180008150
nop
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov rcx, rbx
call fcn.180008150
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x180008a28
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008a22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008ab6
call fcn.18001c898
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180008a66
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008a61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008a8c
call fcn.18001c898
mov rax, rbx
mov rcx, qword [rbp + 0x7a0]
xor rcx, rsp
call fcn.18001c9b0
add rsp, 0x8b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18003e394
int3
call fcn.18003e394
int3
call fcn.18003e394
int3
call fcn.18003e394
int3
call fcn.18003e394
int3
call fcn.18003e394
nop
call fcn.18003e394
nop
call fcn.18003e394
int3