Function at 0x180090790
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xe8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x60], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
lea rcx, [rbp - 0x18]
mov rdx, r8
mov r8, r9
call fcn.180071400
mov dword [rbp + 0x34], 0
mov dword [rbp + 0x54], 0
mov rdx, qword [rbp - 0x10]
lea r14, [rbp + 0x54]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x34]
mov rcx, rdi
mov qword [rbp + 0x38], rdx
xor r8d, r8d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
je 0x18009084b
mov qword [rsi + 8], 0
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x18009083a
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x38]
call fcn.180039420
nop
add rsp, 0xe8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov eax, dword [rbp + 0x34]
dec eax
cmp eax, 0xa
ja case.0x180090867.5
lea rcx, [0x1801f20a8]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov r15d, dword [rbp + 0x54]
mov eax, r15d
shr eax, 1
mov qword [rbp + 0x58], rax
mov eax, 2
cmp r15d, 2
jb 0x18009089e
mov rax, qword [rbp + 0x58]
lea ebx, [rax + rax]
mov edx, 2
mov rcx, rbx
call fcn.180039440
test rax, rax
je 0x180090be9
mov dword [rbp + 0x48], r15d
mov qword [rsp + 0x28], r14
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, qword [rbp + 0x38]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jne 0x180090ac6
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x58]
call fcn.1800e8680
mov rdi, rax
mov rbx, rdx
mov qword [rbp], 0
mov qword [rbp + 8], 1
mov qword [rbp + 0x10], 0
mov rax, rdx
shr rax, 1
mov r8d, ebx
and r8d, 1
add r8, rax
je 0x180090920
mov rcx, rbp
xor edx, edx
call fcn.1801ce8d0
lea rax, [rdi + rbx*2]
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], rax
mov word [rbp + 0x28], 0
lea rcx, [rbp + 0x18]
mov rdx, rbp
call fcn.180070c30
mov rax, qword [rbp + 0x10]
movups xmm0, xmmword [rbp]
movups xmmword [rbp + 0x1c], xmm0
mov qword [rbp + 0x2c], rax
mov dword [rsi], 2
jmp 0x180090b8e
mov ebx, dword [rbp + 0x54]
test rbx, rbx
mov qword [rbp + 0x58], rbx
je 0x180090ae6
mov edx, 1
mov rcx, rbx
call fcn.180039440
test rax, rax
jne 0x180090aeb
mov ecx, 1
mov rdx, rbx
call fcn.1801ddec0
jmp 0x180090c05
cmp dword [rbp + 0x54], 8
jne case.0x180090867.5
mov qword [rbp + 0x18], 0
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x18]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, qword [rbp + 0x38]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jne 0x18009080e
mov rax, qword [rbp + 0x18]
mov dword [rsi], 1
mov qword [rsi + 8], rax
jmp 0x18009081f
cmp dword [rbp + 0x54], 4
jne case.0x180090867.5
mov dword [rbp + 0x18], 0
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x18]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, qword [rbp + 0x38]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jne 0x18009080e
mov eax, dword [rbp + 0x18]
mov dword [rsi], 0
mov dword [rsi + 4], eax
jmp 0x18009081f
mov qword [rsi + 8], 0
mov dword [rsi + 0x10], 0x8007000d
jmp 0x180090819
mov r15d, dword [rbp + 0x54]
mov eax, r15d
shr eax, 1
mov qword [rbp + 0x58], rax
mov eax, 2
cmp r15d, 2
jb 0x180090a8b
mov rax, qword [rbp + 0x58]
lea ebx, [rax + rax]
mov edx, 2
mov rcx, rbx
call fcn.180039440
test rax, rax
je 0x180090bf8
mov dword [rbp + 0x48], r15d
mov qword [rsp + 0x28], r14
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, qword [rbp + 0x38]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
je 0x180090b53
mov qword [rsi + 8], 0
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
cmp dword [rbp + 0x48], 2
jb 0x18009081f
jmp 0x180090bb0
mov eax, 1
mov qword [rsp + 0x28], r14
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, qword [rbp + 0x38]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
je 0x180090bca
mov qword [rsi + 8], 0
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
mov rdx, qword [rbp + 0x58]
test edx, edx
je 0x18009081f
mov r8d, 1
mov rcx, qword [rbp + 0x48]
call fcn.180039420
jmp 0x18009081f
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x58]
call fcn.1800e8680
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov byte [rbp - 0x20], 0
mov rcx, rbp
lea rdx, [rbp - 0x30]
call fcn.180075f70
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x2c], rax
movups xmm0, xmmword [rbp]
movups xmmword [rbp + 0x1c], xmm0
mov dword [rsi], 4
movups xmm0, xmmword [rbp + 0x18]
mov rax, qword [rbp + 0x24]
movups xmmword [rsi + 4], xmm0
mov qword [rsi + 0x10], rax
mov rax, qword [rbp + 0x2c]
mov qword [rsi + 0x18], rax
cmp dword [rbp + 0x48], 2
jb 0x18009081f
mov rdx, qword [rbp + 0x58]
add edx, edx
mov r8d, 2
mov rcx, qword [rbp + 0x40]
call fcn.180039420
jmp 0x18009081f
mov dword [rsi], 3
mov rax, qword [rbp + 0x58]
mov qword [rsi + 8], rax
mov rcx, qword [rbp + 0x48]
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rax
jmp 0x18009081f
mov ecx, 2
mov rdx, rbx
call fcn.1801ddec0
jmp 0x180090c05
mov ecx, 2
mov rdx, rbx
call fcn.1801ddec0
ud2