Function at 0x1000158e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x450
mov rax, qword [0x10001e100]
xor rax, rsp
mov qword [rsp + 0x440], rax
movdqu xmm0, xmmword [rdx]
lea rax, [rsp + 0x30]
mov rdi, r8
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x38]
movdqu xmmword [r8], xmm0
lea rdx, [0x100003598]
xor r12d, r12d
xor r8d, r8d
mov rbp, rcx
mov dword [rsp + 0x30], 0x400
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], r12d
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x100015c47
lea rcx, [rdi + 0x14]
lea r8, [rsp + 0x40]
mov esi, 0x100
sub r8, rcx
mov rdx, rsi
mov ebx, r12d
lea rax, [rdx + 0x7ffffefe]
cmp rax, r12
je 0x10001599b
movzx eax, word [r8 + rcx]
cmp ax, r12w
je 0x10001599b
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x100015977
cmp rdx, r12
jne 0x1000159a9
sub rcx, 2
mov ebx, 0x8007007a
cmp ebx, r12d
mov word [rcx], r12w
jl 0x100015c62
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x38]
lea rdx, [0x1000035b8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x30], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x100015c47
lea rcx, [rdi + 0x214]
lea rdx, [rsp + 0x40]
mov ebx, r12d
sub rdx, rcx
lea rax, [rsi + 0x7ffffefe]
cmp rax, r12
je 0x100015a28
movzx eax, word [rdx + rcx]
cmp ax, r12w
je 0x100015a28
mov word [rcx], ax
add rcx, 2
sub rsi, 1
jne 0x100015a05
cmp rsi, r12
jne 0x100015a36
sub rcx, 2
mov ebx, 0x8007007a
cmp ebx, r12d
mov word [rcx], r12w
jl 0x100015c62
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x38]
lea rdx, [0x1000035d0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov esi, 4
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x100015c47
mov eax, dword [rsp + 0x34]
lea r9, [rsp + 0x38]
lea rdx, [0x1000035f0]
mov dword [rdi + 0x414], eax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x100015c47
mov eax, dword [rsp + 0x34]
lea r9, [rsp + 0x38]
lea rdx, [0x100003610]
mov dword [rdi + 0x418], eax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x100015c47
mov eax, dword [rsp + 0x34]
lea r9, [rsp + 0x38]
lea rdx, [0x100003620]
mov dword [rdi + 0x10], eax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x100015c47
mov eax, dword [rsp + 0x34]
lea r9, [rsp + 0x38]
lea rdx, [0x100003648]
mov dword [rdi + 0x41c], eax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x100015c47
mov eax, dword [rsp + 0x34]
lea r9, [rsp + 0x38]
lea rdx, [0x100003670]
mov dword [rdi + 0x420], eax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x100015c47
mov eax, dword [rsp + 0x34]
lea r9, [rsp + 0x38]
lea rdx, [0x1000036a0]
mov dword [rdi + 0x424], eax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x100015c47
mov eax, dword [rsp + 0x34]
lea r9, [rsp + 0x38]
lea rdx, [0x1000036d0]
mov dword [rdi + 0x428], eax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r12d
je 0x100015c58
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r12d
cmovle ebx, eax
jmp 0x100015c62
mov ecx, dword [rsp + 0x34]
mov dword [rdi + 0x42c], ecx
mov eax, ebx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1000169f0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret