Function at 0x180002f10
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov qword [rbp - 0x69], 0xfffffffffffffffe
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rbp - 0x61], rdx
xor r14d, r14d
mov dword [rbp - 0x79], r14d
mov dword [rbp - 0x75], r14d
test r8d, r8d
je 0x180002f7a
mov edx, r8d
lea rcx, [rbp + 7]
call fcn.180001100
nop
mov dword [rbp - 0x79], 1
mov r8, rax
lea rcx, [rbp - 0x19]
call fcn.180003fd0
nop
lea ebx, [r14 + 3]
jmp 0x180002fa6
mov qword [rbp - 0x41], 0xf
mov qword [rbp - 0x49], r14
mov byte [rbp - 0x59], 0
xor r8d, r8d
lea rdx, [0x180007420]
lea rcx, [rbp - 0x59]
call fcn.180003a90
lea rax, [rbp - 0x59]
mov ebx, 4
mov dword [rbp - 0x79], ebx
mov r8, rax
mov rdx, rdi
lea rcx, [rbp - 0x39]
call fcn.180004080
nop
test bl, 4
je 0x18000302b
and ebx, 0xfffffffb
mov rax, qword [rbp - 0x41]
cmp rax, 0x10
jb 0x18000301b
inc rax
mov rcx, qword [rbp - 0x59]
cmp rax, 0x1000
jb 0x180003016
test cl, 0x1f
je 0x180002fe6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180002ff6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x180003006
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x180003013
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1800058d8
mov qword [rbp - 0x41], 0xf
mov qword [rbp - 0x49], r14
mov byte [rbp - 0x59], 0
test bl, 2
je 0x18000309d
and ebx, 0xfffffffd
mov rax, qword [rbp - 1]
cmp rax, 0x10
jb 0x18000308d
inc rax
mov rcx, qword [rbp - 0x19]
cmp rax, 0x1000
jb 0x180003088
test cl, 0x1f
je 0x180003058
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180003068
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x180003078
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x180003085
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1800058d8
mov qword [rbp - 1], 0xf
mov qword [rbp - 9], r14
mov byte [rbp - 0x19], 0
test bl, 1
je 0x1800030fc
mov rax, qword [rbp + 0x1f]
cmp rax, 0x10
jb 0x1800030fc
inc rax
mov rcx, qword [rbp + 7]
cmp rax, 0x1000
jb 0x1800030f7
test cl, 0x1f
je 0x1800030c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800030d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800030e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800030f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1800058d8
mov dword [rbp - 0x6d], 4
mov dword [rbp - 0x71], r14d
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0x10
cmovae rdx, qword [rbp - 0x39]
lea rax, [rbp - 0x6d]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x75]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x71]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180003146
cmp dword [rbp - 0x71], 4
jne 0x180003146
mov ebx, dword [rbp - 0x75]
jmp 0x18000314c
mov ebx, r14d
mov dword [rbp - 0x75], ebx
mov rax, qword [rbp - 0x21]
cmp rax, 0x10
jb 0x1800031a6
inc rax
mov rcx, qword [rbp - 0x39]
cmp rax, 0x1000
jb 0x1800031a1
test cl, 0x1f
je 0x180003171
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180003181
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x180003191
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x18000319e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1800058d8
mov qword [rbp - 0x21], 0xf
mov qword [rbp - 0x29], r14
mov byte [rbp - 0x39], 0
mov rcx, rdi
call fcn.180003a00
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.180005870
add rsp, 0xe0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret