Function at 0x18005ed88
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xf0
mov rax, qword [0x18019bca8]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov rax, qword [rbp + 0x77]
xor edi, edi
mov qword [rbp - 0x49], rax
mov r13d, edi
mov rax, qword [rbp + 0x7f]
mov r14d, edi
mov qword [rbp - 0x51], r9
mov r15d, edi
lea ebx, [rdi + 1]
mov qword [rbp - 0x61], r8
mov dword [rsp + 0x48], ebx
mov r12d, edi
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x71], rdi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x44], edi
mov dword [rbp - 0x75], edi
xor edx, edx
lea rcx, [rbp - 0x39]
lea r8d, [rdx + 0x28]
call sub.msvcrt.dll_memset
lea rax, [rbp - 0x59]
mov dword [rbp - 0x79], edi
mov qword [rsp + 0x38], rax
lea rsi, [rbp - 0x39]
mov rax, qword [rbp - 0x61]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x30], rdi
lea r8, [rbp - 0x11]
test ebx, ebx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x4c], 0x10
mov rcx, qword [rax]
cmove rsi, r13
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
mov ebx, eax
cmp eax, 0x103
je 0x1800c5886
lea r15, [rsi + 8]
mov esi, dword [rsp + 0x44]
mov eax, dword [rsp + 0x40]
mov dword [rbp - 0x69], eax
test ebx, ebx
jne 0x1800c583c
cmp dword [rsp + 0x48], edi
jne 0x18005ee78
test esi, esi
je 0x18005ef8c
xor edx, edx
lea rcx, [r15 - 8]
lea r8d, [rdx + 0x28]
call sub.msvcrt.dll_memset
mov rax, qword [rbp - 0x71]
lea r8, [rbp - 0x11]
mov qword [r15 + 8], rax
lea rcx, [rsp + 0x58]
mov rax, qword [rbp - 0x61]
mov qword [rsp + 0x58], rdi
mov rdx, qword [rax]
call fcn.18005f30c
test eax, eax
jne 0x18005ef1b
mov eax, r12d
lea r9, [r15 - 8]
shr eax, 1
lea r8, [rsp + 0x58]
mov dword [r15], eax
call fcn.18005f0d4
test eax, eax
js 0x18005ef1b
mov ecx, dword [r15]
mov r10d, 0xffffffff
mov edx, r10d
mov r9d, 0x80070216
lea eax, [rcx + rcx]
cmp eax, ecx
cmovae edx, eax
sbb ebx, ebx
and ebx, r9d
cmp eax, ecx
jb 0x1800c588f
cmp dword [rsp + 0x48], edi
je 0x18005ef96
add edx, dword [rsp + 0x40]
inc r14d
cmp edx, dword [rsp + 0x40]
mov eax, r10d
cmovae eax, edx
sbb ebx, ebx
and ebx, r9d
mov dword [rsp + 0x40], eax
cmp edx, dword [rbp - 0x69]
jb 0x1800c588f
mov ebx, dword [rbp - 0x79]
lea rcx, [rsp + 0x58]
inc ebx
mov dword [rbp - 0x79], ebx
call fcn.18005f368
lea rax, [rbp - 0x59]
mov dword [rsp + 0x4c], 0x10
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x4c]
mov rax, qword [rbp - 0x61]
lea r8, [rbp - 0x11]
mov qword [rsp + 0x30], rdi
mov edx, ebx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
mov ebx, eax
cmp eax, 0x103
jne 0x18005ee5b
mov r15d, dword [rsp + 0x40]
mov ebx, edi
cmp dword [rsp + 0x48], edi
jne 0x18005efd6
test esi, esi
jne 0x18005ef8c
test r12d, r12d
je 0x18005f063
mov ebx, 0x80004005
jmp 0x1800c58b3
mov eax, edx
lea r8, [rsp + 0x50]
add qword [rbp - 0x71], rax
mov ecx, r12d
call fcn.180020d88
mov esi, eax
test eax, eax
js 0x1800c5868
mov ebx, esi
test esi, esi
js 0x1800c589e
mov esi, dword [rsp + 0x44]
add r15, 0x28
mov r12d, dword [rsp + 0x50]
add esi, r10d
mov dword [rsp + 0x44], esi
jmp 0x18005ef1b
test r14d, r14d
je 0x18005f086
mov edx, 0xffffffff
mov eax, r14d
mov ecx, edx
mov dword [rsp + 0x48], edi
mov r8d, 0x80070216
lea rsi, [rax + rax*4]
shl rsi, 3
cmp rsi, rdx
cmovbe ecx, esi
cmp rdx, rsi
sbb ebx, ebx
and ebx, r8d
cmp rsi, rdx
ja 0x1800c584f
lea eax, [rcx + r15]
cmp eax, ecx
cmovae edx, eax
sbb ebx, ebx
and ebx, r8d
cmp eax, ecx
jb 0x1800c584f
mov ecx, edx
mov r15d, edx
call qword [sym.imp.msvcrt.dll_malloc]
mov r13, rax
test rax, rax
je 0x1800c58ae
mov r12d, dword [rsp + 0x40]
mov r8d, r15d
xor edx, edx
mov dword [rsp + 0x50], r12d
mov rcx, rax
mov dword [rsp + 0x44], r14d
call sub.msvcrt.dll_memset
lea rax, [rsi + r13]
mov qword [rbp - 0x71], rax
mov eax, dword [rbp - 0x75]
inc eax
mov dword [rbp - 0x75], eax
cmp eax, 2
jge 0x18005f07e
mov ebx, dword [rsp + 0x48]
mov r15d, dword [rsp + 0x40]
jmp 0x18005edf2
test ebx, ebx
js 0x1800c58c2
mov ecx, dword [rsp + 0x40]
lea eax, [r14 + r14*4]
lea edi, [rcx + rax*8]
mov rax, qword [rbp - 0x51]
mov qword [rax], r13
mov rax, qword [rbp - 0x49]
mov dword [rax], r14d
mov rax, qword [rbp - 0x41]
mov dword [rax], edi
mov eax, ebx
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.18008b970
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
jle 0x1800c5849
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0x18005ee6a
cmp dword [0x18019cca4], edi
je 0x18005f07e
mov ecx, ebx
call fcn.180096ba4
nop
jmp 0x18005f07e
cmp dword [0x18019cca4], edi
je 0x18005efb3
mov ecx, esi
call fcn.180096ba4
mov r10d, 0xffffffff
jmp 0x18005efb3
mov esi, dword [rsp + 0x44]
jmp 0x18005ef77
cmp dword [0x18019cca4], edi
je 0x1800c589e
mov ecx, ebx
call fcn.180096ba4
lea rcx, [rsp + 0x58]
call fcn.18005f368
nop
jmp 0x18005f07e
mov ebx, 0x8007000e
cmp dword [0x18019cca4], edi
je 0x1800c58c2
mov ecx, ebx
call fcn.180096ba4
mov rcx, r13
call qword [sym.imp.msvcrt.dll_free]
mov r14d, edi
mov r13, rdi
jmp 0x18005f091