Function at 0x1800329b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov rax, qword [0x1800a98a0]
xor rax, rsp
mov qword [rbp + 0x290], rax
movups xmm0, xmmword [str.UserDefined]
xor edi, edi
mov r12d, r9d
movsd xmm1, qword [0x18008f120]
mov r13d, r8d
movups xmmword [rbp - 0x78], xmm0
mov rbx, rdx
mov qword [rbp - 0x80], rcx
mov r15, rcx
mov qword [rsp + 0x60], rdi
movsd qword [rbp - 0x68], xmm1
mov r14d, edi
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetSystemDefaultLangID]
movzx eax, ax
lea r9, [rbp - 0x78]
lea r8, str._s_d
mov dword [rsp + 0x20], eax
lea edx, [rdi + 0x18]
lea rcx, [rbp - 0x40]
call fcn.18001b9d8
test eax, eax
js 0x180032b48
test r15, r15
je 0x180032b48
test rbx, rbx
je 0x180032b48
lea rax, [rsp + 0x60]
mov esi, 0x20019
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x180032ab5
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rdx, [rbp - 0x78]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
jne 0x18004940d
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x58], rdi
xor r9d, r9d
mov qword [rsp + 0x50], rdi
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x18004940d
mov esi, edi
cmp dword [rsp + 0x6c], edi
ja 0x1800491e8
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.180033470
mov rbx, qword [rsp + 0x3f0]
add rsp, 0x3a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x180032b1e
cmp r14d, 0x100
jae 0x180032b0e
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x70]
lea rax, [rbp]
mov dword [rsp + 0x70], 0x10
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x60]
lea rax, [rsp + 0x74]
mov dword [rsp + 0x68], 0x282
mov qword [rsp + 0x28], rax
mov edx, esi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
test eax, eax
jne 0x1800493e4
cmp dword [rsp + 0x74], 7
jne 0x1800493e4
mov ecx, dword [rsp + 0x68]
mov eax, ecx
mov word [rbp - 0x42], di
shr rax, 1
add rax, 2
cmp rax, 0x141
ja 0x180049295
and rcx, 0xfffffffffffffffe
cmp rcx, 0x282
jae 0x1800493f5
mov word [rbp + rcx], di
add rcx, 2
cmp rcx, 0x282
jae 0x1800493f5
mov word [rbp + rcx], di
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x60]
call fcn.1800741a4
test eax, eax
je 0x1800493e4
lea rcx, [rbp]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
cmp eax, 0x3f
jg 0x1800493e4
lea rcx, [rbp]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
movsxd rcx, eax
lea rax, [rbp + 2]
lea rcx, [rax + rcx*2]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
cmp eax, 0xff
jg 0x1800493e4
mov edi, dword [rsp + 0x78]
test r13d, r13d
jne 0x1800492f4
test r12d, r12d
jne 0x1800492fa
jmp 0x18004930d
bt edi, 0x1a
jb 0x18004930d
test r12d, r12d
je 0x1800493e2
bt edi, 0x1b
jae 0x1800493e2
mov rcx, qword [0x1800a9f20]
xor edx, edx
mov r8d, 0x284
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x18004940d
mov dword [rax], edi
lea r8, [rbp]
lea rdi, [rax + 4]
mov edx, 0x40
mov rcx, rdi
call fcn.18001d138
test eax, eax
js 0x18004940d
lea rcx, [rbp]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
movsxd rcx, eax
lea r8, [rbp + 2]
mov edx, 0x100
lea r8, [r8 + rcx*2]
lea rcx, [rbx + 0x84]
call fcn.18001d138
test eax, eax
js 0x18004940d
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
test eax, eax
je 0x1800493d0
movzx eax, word [rdi]
test ax, ax
je 0x1800493d0
xor r15d, r15d
movzx ecx, ax
call qword [sym.imp.ntdll.dll_iswspace]
test eax, eax
je 0x1800493ac
add rdi, 2
movzx eax, word [rdi]
test ax, ax
jne 0x180049393
cmp word [rdi], r15w
mov r15, qword [rbp - 0x80]
je 0x1800493d0
mov rdx, rbx
mov rcx, r15
call fcn.180032c64
cmp eax, 0xffffffff
je 0x1800493fb
cmp eax, 1
jne 0x1800493e2
inc r14d
jmp 0x1800493e2
mov rcx, qword [0x1800a9f20]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor edi, edi
inc esi
cmp esi, dword [rsp + 0x6c]
jb 0x1800491e8
jmp 0x180032b0e
call fcn.18003361c
int3
mov rcx, qword [0x1800a9f20]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180032b48
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop
jmp 0x180032b48