Function at 0x140018244
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1430]
mov eax, 0x1530
call fcn.140030fc0
sub rsp, rax
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x1580], rbx
mov rax, qword [0x140055910]
xor rax, rsp
mov qword [rbp + 0x1420], rax
mov rbx, rdx
mov qword [rsp + 0x78], rdx
mov r14, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x210]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rbp - 0x78], 0x104
and qword [rsp + 0x60], 0
lea r12, [rbx + 8]
mov rcx, qword [r12]
mov rax, qword [rcx + 8]
and qword [rax], 0
mov rsi, qword [rcx]
test rsi, rsi
je 0x1400182f9
mov rdi, qword [rsi]
lea rcx, [rsi + 0x30]
call fcn.14000b9a0
lea rcx, [rsi + 0x10]
call fcn.14000b9a0
mov edx, 0x50
mov rcx, rsi
call fcn.14002fd38
mov rsi, rdi
test rdi, rdi
jne 0x1400182ca
mov rbx, qword [rsp + 0x78]
mov rax, qword [r12]
mov qword [rax], rax
mov rax, qword [r12]
mov qword [rax + 8], rax
xor esi, esi
mov qword [r12 + 8], rsi
mov rax, qword [r12]
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
call fcn.140016d8c
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x140018362
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x78]
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x1400183d1
lea rdx, str.Failed_to_open_registry_key__s
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
mov r8, r14
cmovle ebx, eax
mov ecx, ebx
call fcn.14000b12c
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400183ca
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
jmp 0x140018688
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0x210]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
test eax, eax
je 0x14001842d
lea rdx, str.Failed_to_examine_registry_key__s
jmp 0x14001839b
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x140018670
mov r13d, esi
mov r15d, 0x80070000
mov dword [rbp - 0x74], 0xff
mov word [rbp + 0x10], si
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x74]
lea r8, [rbp + 0x10]
mov edx, r13d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
nop dword [rax + rax]
test eax, eax
jne 0x1400186b3
cmp dword [rsp + 0x6c], 1
jne 0x14001857d
mov word [rbp + 0x420], si
mov dword [rsp + 0x68], 0x1000
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x420]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov r9d, 2
lea r8, [rbp + 0x10]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14001861f
mov rbx, qword [r12]
mov rbx, qword [rbx]
movabs rax, 0x333333333333333
cmp qword [r12 + 8], rax
je 0x1400186d1
mov r14, qword [rbx + 8]
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], rsi
mov ecx, 0x50
call fcn.140030034
mov rsi, rax
mov qword [rbp - 0x68], rax
lea rdi, [rax + 0x10]
mov qword [rbp - 0x80], rdi
lea rdx, [rbp + 0x10]
mov rcx, rdi
call fcn.14000ba10
nop
lea rcx, [rdi + 0x20]
lea rdx, [rbp + 0x420]
call fcn.14000ba10
nop
mov qword [rsi], rbx
mov qword [rsi + 8], r14
inc qword [r12 + 8]
mov qword [rbx + 8], rsi
mov qword [r14], rsi
xor esi, esi
mov qword [rbp - 0x68], rsi
mov rax, qword [r12]
mov r9, qword [rax]
lea r8, [r9 + 0x10]
lea rdx, [rbp - 0x58]
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.14001671c
jmp 0x140018662
cmp dword [rsp + 0x6c], 4
jne 0x140018662
mov dword [rsp + 0x68], esi
mov dword [rbp - 0x80], 4
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x10]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001861f
mov edx, dword [rsp + 0x68]
lea rcx, [rbp - 0x10]
call fcn.140012e84
nop
lea rcx, [rbp + 0x10]
mov qword [rbp - 0x38], rcx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x48]
mov rcx, rbx
call fcn.140019310
nop
lea rcx, [rbp - 0x30]
call fcn.14000b9a0
nop
lea rcx, [rbp - 0x10]
call fcn.14000b9a0
jmp 0x140018662
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx r8d, bx
or r8d, r15d
test ebx, ebx
cmovle r8d, ebx
movzx ecx, ax
or ecx, r15d
test eax, eax
lea rdx, str.Failed_to_read_registry_value_hr0x_08x
cmovle ecx, eax
call fcn.14000b12c
mov rbx, qword [rsp + 0x78]
inc r13d
cmp r13d, dword [rsp + 0x70]
jb 0x140018442
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140018686
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
xor eax, eax
mov rcx, qword [rbp + 0x1420]
xor rcx, rsp
call fcn.14002fd10
mov rbx, qword [rsp + 0x1580]
add rsp, 0x1530
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
lea rdx, str.Failed_to_enumerate_registry_key
mov ecx, ebx
call fcn.14000b12c
jmp 0x1400183b4
lea rcx, str.list_T__too_long
call fcn.14000fa40
int3