Function at 0x180166fc0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov r12, r8
mov r14, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rbp + 0x30], r15d
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
mov qword [rbp + 0x48], r15
lea r8, [rsp + 0x30]
mov edx, 0x400
lea rcx, [rbp + 0x38]
call fcn.1800dbb50
mov dword [rbp + 0x30], r15d
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x38]
sub rax, rcx
mov dword [rbp + 0x50], eax
lea rdi, [r14 + 8]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18016703d
mov rdx, qword [rdi]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x30]
xor r8d, r8d
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
jne 0x1801670f0
mov ecx, dword [rbp + 0x50]
mov r9, qword [rbp + 0x40]
mov r8, r9
mov rdx, qword [rbp + 0x38]
sub r8, rdx
cmp rcx, r8
jae 0x180167087
lea rax, [rdx + rcx]
mov qword [rbp + 0x40], rax
jmp 0x1801670c4
jbe 0x1801670c4
mov rax, qword [rbp + 0x48]
sub rax, rdx
cmp rcx, rax
jbe 0x1801670a8
lea r8, [rsp + 0x30]
mov rdx, rcx
lea rcx, [rbp + 0x38]
call fcn.1800dbb50
jmp 0x1801670c0
sub rcx, r8
lea rbx, [r9 + rcx]
mov r8, rcx
xor edx, edx
mov rcx, r9
call fcn.18020be10
mov qword [rbp + 0x40], rbx
mov rdx, qword [rbp + 0x38]
cmp qword [rdi + 0x18], 0x10
jb 0x1801670ce
mov rdi, qword [rdi]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180167245
cmp dword [rbp + 0x30], 3
jne 0x1801672d4
mov ecx, dword [rbp + 0x50]
mov rsi, qword [rbp + 0x40]
mov rdx, rsi
mov rbx, qword [rbp + 0x38]
sub rdx, rbx
cmp rcx, rdx
jae 0x180167122
lea rsi, [rcx + rbx]
mov qword [rbp + 0x40], rsi
jmp 0x180167166
jbe 0x180167166
mov rax, qword [rbp + 0x48]
sub rax, rbx
cmp rcx, rax
jbe 0x180167147
lea r8, [rsp + 0x30]
mov rdx, rcx
lea rcx, [rbp + 0x38]
call fcn.1800dbb50
mov rsi, qword [rbp + 0x40]
jmp 0x180167162
sub rcx, rdx
lea rbx, [rsi + rcx]
mov r8, rcx
xor edx, edx
mov rcx, rsi
call fcn.18020be10
mov rsi, rbx
mov qword [rbp + 0x40], rbx
mov rbx, qword [rbp + 0x38]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
mov r14, r15
mov qword [rsp + 0x48], r15
mov dword [rbp + 0x30], 1
sub rsi, rbx
mov rdi, qword [rsp + 0x40]
cmp rsi, 8
jb 0x1801671ce
shr rsi, 3
cmp rdi, r14
je 0x1801671a6
mov rax, qword [rbx]
mov qword [rdi], rax
add rdi, 8
mov qword [rsp + 0x40], rdi
jmp 0x1801671c0
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.1800cde50
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
add rbx, 8
sub rsi, 1
jne 0x180167190
mov rbx, qword [rbp + 0x38]
lea rax, [rsp + 0x38]
cmp r12, rax
je 0x1801671fc
mov rcx, r12
call fcn.1800929a0
mov rax, qword [rsp + 0x38]
mov qword [r12], rax
mov qword [r12 + 8], rdi
mov qword [r12 + 0x10], r14
mov r14, r15
mov rbx, qword [rbp + 0x38]
jmp 0x180167201
mov r15, qword [rsp + 0x38]
test r15, r15
je 0x180167277
sub r14, r15
sar r14, 3
lea rdx, [r14*8]
mov rax, r15
cmp rdx, 0x1000
jb 0x18016723a
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18016730c
mov rcx, r15
call fcn.1801e60f0
nop
jmp 0x180167273
mov rbx, qword [rbp + 0x38]
mov qword [rbp + 0x40], rbx
cmp eax, 2
jne 0x180167277
mov rax, qword [r12 + 8]
sub rax, qword [r12]
sar rax, 3
test rax, rax
je 0x180167277
mov rax, qword [rsi]
mov r8, r12
mov rdx, r14
mov rcx, rsi
call qword [rax + 0x28]
mov rbx, qword [rbp + 0x38]
test rbx, rbx
je 0x1801672ad
mov rdx, qword [rbp + 0x48]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x1801672a4
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801672ce
mov rcx, rbx
call fcn.1801e60f0
nop
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x250
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18010f960
nop
mov edx, 0xd8
lea rcx, [rbp + 0x60]
call fcn.180099460
lea rcx, [rbp + 0x60]
call fcn.1800f8980
nop
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.1800f88a0
lea rdx, [0x18027f0a8]
lea rcx, [rsp + 0x50]
call fcn.18020a9f0
nop
call fcn.18010f960
int3