Function at 0x180005e44
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov rbx, qword [rdx + 0x18]
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1800b2bf8]
test rbx, rbx
jne 0x18002cd6c
mov rbx, qword [rdi + 0x20]
test rbx, rbx
je 0x18002cd9d
sub rbx, qword [rax + 0x9e8]
add rbx, rax
je 0x18002cd9d
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rsi
call fcn.180011d50
test al, al
je 0x18002cd80
mov r8, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rsi
call fcn.180008bc8
test eax, eax
js 0x180005f78
mov rcx, qword [rsp + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x180005f78
xor edi, edi
xor edx, edx
lea rax, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 0x200
call qword [sym.imp.ntdll.dll_NtEnumerateValueKey]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0x8000001a
je 0x180005f65
test eax, eax
js 0x180005f9b
lea rax, [rsp + 0x5c]
mov r9b, 1
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x38]
movzx eax, word [rsp + 0x58]
xor edx, edx
mov rcx, rsi
mov word [rsp + 0x38], ax
mov word [rsp + 0x3a], ax
call fcn.18000f720
mov rcx, qword [rsp + 0x30]
mov ebx, eax
test eax, eax
js 0x18002cd8a
inc edi
mov edx, edi
jmp 0x180005ef2
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor eax, eax
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.180024680
mov rbx, qword [rsp + 0x290]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rsp + 0x30]
jmp 0x18002cd8a
push rbx
sub rsp, 0x20
cmp dword [rcx], 0
mov rbx, rcx
je 0x180008fc5
cmp dword [rcx], 5
je 0x180008fe4
lea r8, [rsp + 0x30]
xor edx, edx
call fcn.180011d50
test al, al
je 0x180008fee
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rbx + 8]
call fcn.180008eac
mov rdx, rax
test rax, rax
je 0x180008fb9
mov ecx, dword [rbx]
cmp ecx, 1
jne 0x180008fce
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call fcn.180008964
add rsp, 0x20
pop rbx
ret
mov eax, 0xc0000016
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
cmp ecx, 4
jne 0x18002dd06
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x180005e44
add rsp, 0x20
pop rbx
jmp 0x18005ea24
mov eax, 0xc000000d
add rsp, 0x20
pop rbx
ret
movups xmm0, xmmword [rbx + 8]
movups xmmword [rsp + 0x38], xmm0
psrldq xmm0, 8
movq rcx, xmm0
test rcx, rcx
jne 0x18002cd3f
and qword [rsp + 0x40], rcx
jmp 0x18002cd4a
sub rax, qword [r8]
add rcx, rax
mov qword [rsp + 0x40], rcx
mov r9b, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rsi
call fcn.18000f720
test eax, eax
js 0x180005f78
mov rbx, qword [rbx]
jmp 0x180005e76
lea r8, [rax + 0x9e8]
sub rbx, qword [r8]
add rbx, rax
jne 0x18002cd20
jmp 0x180005e86
mov eax, 0xc000000d
jmp 0x180005f78
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov eax, ebx
jmp 0x180005f78
mov eax, 0xc0000016
jmp 0x180005f78
cmp ecx, 6
jne 0x18002dd19
mov rcx, rbx
call fcn.18005ec34
nop
jmp 0x180008fb2
lea eax, [rcx - 2]
cmp eax, 1
jbe 0x18002dd3b
lea eax, [rcx - 7]
cmp eax, 1
ja 0x180008fee
mov rcx, rbx
call fcn.18005eeb0
nop
jmp 0x180008fb2
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call fcn.18005f514
nop
jmp 0x180008fb2
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x178]
sub rsp, 0x270
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov rdx, qword [rcx + 8]
mov rdi, rcx
mov rax, qword [0x1800b2bf8]
mov rbx, qword [rdx + 0x18]
test rbx, rbx
je 0x18005eadf
lea r8, [rax + 0x9e8]
sub rbx, qword [r8]
add rbx, rax
je 0x18005eadf
movups xmm0, xmmword [rbx + 8]
movups xmmword [rsp + 0x50], xmm0
psrldq xmm0, 8
movq rcx, xmm0
test rcx, rcx
jne 0x18005ea98
and qword [rsp + 0x58], rcx
jmp 0x18005eaa3
sub rax, qword [r8]
add rcx, rax
mov qword [rsp + 0x58], rcx
mov r9b, 1
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rdi
call fcn.18000f720
test eax, eax
js 0x18005ec05
mov rbx, qword [rbx]
mov rax, qword [0x1800b2bf8]
test rbx, rbx
je 0x18005eadb
lea r8, [rax + 0x9e8]
sub rbx, qword [r8]
add rbx, rax
jne 0x18005ea79
mov rdx, qword [rdi + 8]
mov rdx, qword [rdx + 0x20]
test rdx, rdx
je 0x18005ec00
mov rcx, qword [rax + 0x9e8]
sub rdx, rcx
add rdx, rax
je 0x18005ec00
mov rdx, qword [rdx + 0x20]
test rdx, rdx
je 0x18005eb0e
sub rdx, rcx
add rdx, rax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
call fcn.180008bc8
test eax, eax
js 0x18005ec05
mov rcx, qword [rsp + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x18005ec05
xor esi, esi
xor edx, edx
jmp 0x18005eba3
test ebx, ebx
js 0x18005ebeb
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
movzx eax, word [rsp + 0x6c]
mov word [rsp + 0x40], ax
mov word [rsp + 0x42], ax
call fcn.18005e740
test eax, eax
js 0x18005eb8d
mov r9b, 1
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rdi
call fcn.18000f720
mov ebx, eax
jmp 0x18005eb96
cmp eax, 0x8000001a
jne 0x18005ebd6
xor ebx, ebx
test ebx, ebx
js 0x18005ebeb
mov rcx, qword [rsp + 0x30]
inc esi
mov edx, esi
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 0x200
call qword [sym.imp.ntdll.dll_NtEnumerateKey]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0x8000001a
jne 0x18005eb43
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor eax, eax
jmp 0x18005ec05
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov eax, ebx
jmp 0x18005ec05
mov eax, 0xc0000016
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.180024680
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret