Function at 0x7ff6bb000d50
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x168
mov rax, qword [0x7ff6bb0bb010]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0x100
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x7ff6bb0a2840]
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7ff6bb0012e7
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, [0x7ff6bb0a2868]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x170], rbx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.advapi32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.advapi32.dll_RegCloseKey]
test ebx, ebx
jne 0x7ff6bb001290
mov qword [rsp + 0x178], rbp
lea rbx, [0x7ff6bb0a2880]
mov qword [rsp + 0x180], rsi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x160], rdi
mov rdx, rbx
mov qword [rsp + 0x158], r14
mov qword [rsp + 0x150], r15
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x7ff6bb000e77
lea rax, [0x7ff6bb1535e0]
dec rax
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x7ff6bb000e35
movups xmm0, xmmword [0x7ff6bb0a2898]
mov ecx, dword [0x7ff6bb0a28b8]
mov esi, 0x19
movups xmm1, xmmword [0x7ff6bb0a28a8]
lea rbp, [0x7ff6bb0a28c0]
mov r14d, esi
movups xmmword [rax], xmm0
mov r15, rbp
lea edi, [rsi - 4]
movups xmmword [rax + 0x10], xmm1
mov dword [rax + 0x20], ecx
jmp 0x7ff6bb00121e
lea rdx, [0x7ff6bb0a28e0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x7ff6bb000eee
lea rax, [0x7ff6bb1535e0]
dec rax
nop dword [rax + rax]
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x7ff6bb000ea0
movups xmm0, xmmword [0x7ff6bb0a28f0]
mov ecx, dword [0x7ff6bb0a2910]
mov esi, 4
movups xmm1, xmmword [0x7ff6bb0a2900]
lea rbp, [0x7ff6bb0a2934]
movups xmmword [rax], xmm0
lea r15, [0x7ff6bb0a2920]
movups xmmword [rax + 0x10], xmm1
mov dword [rax + 0x20], ecx
lea r14d, [rsi + 0xd]
lea rbx, [0x7ff6bb0a2914]
lea edi, [rsi + 1]
jmp 0x7ff6bb00121e
lea rbx, [0x7ff6bb0a293c]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x7ff6bb000f59
lea rax, [0x7ff6bb1535e0]
dec rax
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x7ff6bb000f12
movups xmm0, xmmword [0x7ff6bb0a2948]
mov ecx, dword [0x7ff6bb0a2968]
mov esi, 0xa
movups xmm1, xmmword [0x7ff6bb0a2958]
lea rbp, [0x7ff6bb0a2980]
movups xmmword [rax], xmm0
lea r15, [0x7ff6bb0a2970]
movups xmmword [rax + 0x10], xmm1
mov dword [rax + 0x20], ecx
lea edi, [rsi - 6]
lea r14d, [rsi + 4]
jmp 0x7ff6bb00121e
lea rdx, [0x7ff6bb0a298c]
lea rcx, [rsp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x7ff6bb000fd7
lea rax, [0x7ff6bb1535e0]
dec rax
nop word [rax + rax]
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x7ff6bb000f80
mov ecx, dword [0x7ff6bb0a29b8]
lea rbp, [0x7ff6bb0a29d8]
movups xmm0, xmmword [0x7ff6bb0a2998]
mov r14d, 0xf
lea r15, [0x7ff6bb0a29c8]
movups xmm1, xmmword [0x7ff6bb0a29a8]
lea rbx, [0x7ff6bb0a29c0]
movups xmmword [rax], xmm0
lea edi, [r14 - 8]
movups xmmword [rax + 0x10], xmm1
mov dword [rax + 0x20], ecx
movzx ecx, word [0x7ff6bb0a29bc]
mov word [rax + 0x24], cx
jmp 0x7ff6bb001219
lea rbx, [0x7ff6bb0a29e8]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x7ff6bb001049
lea rax, [0x7ff6bb1535e0]
dec rax
nop dword [rax + rax]
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x7ff6bb001000
movups xmm0, xmmword [0x7ff6bb0a29f8]
movzx ecx, word [0x7ff6bb0a2a18]
mov esi, 7
movups xmm1, xmmword [0x7ff6bb0a2a08]
lea rbp, [0x7ff6bb0a2a30]
movups xmmword [rax], xmm0
lea r15, [0x7ff6bb0a2a20]
movups xmmword [rax + 0x10], xmm1
mov word [rax + 0x20], cx
lea edi, [rsi + 8]
lea r14d, [rsi + 3]
jmp 0x7ff6bb00121e
lea rdx, [0x7ff6bb0a2a38]
lea rcx, [rsp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
lea rbx, [0x7ff6bb0a2a40]
test rax, rax
jne 0x7ff6bb0011c4
mov rdx, rbx
lea rcx, [rsp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x7ff6bb0011c4
lea rbx, [0x7ff6bb0a2aa0]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x7ff6bb0010fb
lea rax, [0x7ff6bb1535e0]
dec rax
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x7ff6bb0010a6
movups xmm0, xmmword [0x7ff6bb0a2ab0]
movzx ecx, byte [0x7ff6bb0a2ad8]
mov esi, 0xc
movups xmm1, xmmword [0x7ff6bb0a2ac0]
lea rbp, [0x7ff6bb0a2af0]
movups xmmword [rax], xmm0
lea r15, [0x7ff6bb0a2ae0]
movsd xmm0, qword [0x7ff6bb0a2ad0]
lea edi, [rsi - 3]
movups xmmword [rax + 0x10], xmm1
lea r14d, [rsi + 1]
movsd qword [rax + 0x20], xmm0
mov byte [rax + 0x28], cl
jmp 0x7ff6bb00121e
lea rbx, [0x7ff6bb0a2b00]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
lea rax, [0x7ff6bb1535e0]
nop
nop
dec rax
nop
cmp byte [rax + 1], 0
lea rax, [rax + 1]
nop
test byte [rdi], 0xb7
or eax, 0xa1a17
lea rbp, [0x7ff6bb0a2b68]
movups xmm0, xmmword [0x7ff6bb0a2b28]
mov esi, 0xa
lea r15, [0x7ff6bb0a2b50]
movups xmm1, xmmword [0x7ff6bb0a2b38]
movups xmmword [rax], xmm0
lea edi, [rsi + 0x18]
movups xmmword [rax + 0x10], xmm1
mov word [rax + 0x20], cx
lea r14d, [rsi + 9]
movzx ecx, byte [0x7ff6bb0a2b4a]
mov byte [rax + 0x22], cl
jmp 0x7ff6bb00121e
lea rax, [0x7ff6bb1535e0]
dec rax
nop
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x7ff6bb0011d0
mov ecx, dword [0x7ff6bb0a2a70]
lea rbp, [0x7ff6bb0a2a90]
movups xmm0, xmmword [0x7ff6bb0a2a50]
mov edi, 0xa
lea r15, [0x7ff6bb0a2a78]
movups xmm1, xmmword [0x7ff6bb0a2a60]
movups xmmword [rax], xmm0
lea r14d, [rdi + 9]
movups xmmword [rax + 0x10], xmm1
mov dword [rax + 0x20], ecx
movzx ecx, byte [0x7ff6bb0a2a74]
mov byte [rax + 0x24], cl
mov esi, 0xb
mov r8, rdi
lea rcx, [0x7ff6bb13e280]
mov rdx, rbx
call fcn.7ff6bb01a2b0
mov r8, rdi
lea rcx, [0x7ff6bb13e2c0]
mov rdx, rbx
call fcn.7ff6bb01a2b0
mov r8, r14
lea rcx, [0x7ff6bb13e260]
mov rdx, r15
call fcn.7ff6bb01a2b0
mov r8, rsi
lea rcx, [0x7ff6bb13e2a0]
mov rdx, rbp
call fcn.7ff6bb01a2b0
mov r15, qword [rsp + 0x150]
mov r14, qword [rsp + 0x158]
mov rdi, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x180]
mov rbp, qword [rsp + 0x178]
jmp 0x7ff6bb0012df
lea rax, [0x7ff6bb1535e0]
dec rax
nop word [rax + rax]
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x7ff6bb0012a0
movups xmm0, xmmword [0x7ff6bb0a2bc0]
mov ecx, dword [0x7ff6bb0a2be8]
movups xmm1, xmmword [0x7ff6bb0a2bd0]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x7ff6bb0a2be0]
movups xmmword [rax + 0x10], xmm1
movsd qword [rax + 0x20], xmm0
mov dword [rax + 0x28], ecx
movzx ecx, byte [0x7ff6bb0a2bec]
mov byte [rax + 0x2c], cl
mov rbx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.7ff6bb030660
add rsp, 0x168
ret