Function at 0x7ff670d977b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov r15, r9
mov rdx, r8
mov rsi, rcx
xor r13d, r13d
mov qword [rbp - 9], r13
mov dword [rbp + 0x6f], r13d
lea rcx, [rbp - 9]
mov qword [rsp + 0x20], rcx
lea r9d, [r13 + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7ff670d9783e
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x19]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 9]
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x7ff670d97858
mov rcx, qword [rbp - 9]
call qword [sym.imp.advapi32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], 0xf
mov byte [rsi], r13b
jmp 0x7ff670d97968
cmp dword [rbp - 0x19], 1
jne 0x7ff670d97834
mov ebx, dword [rbp + 0x6f]
xorps xmm0, xmm0
movdqu xmmword [rbp - 1], xmm0
mov rdi, r13
mov qword [rbp + 0xf], r13
cmp rbx, 2
jb 0x7ff670d978e0
and rbx, 0xfffffffffffffffe
cmp rbx, 0x1000
jb 0x7ff670d978ac
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x7ff670d97b5e
call fcn.7ff670dbe3bc
test rax, rax
je 0x7ff670d97b51
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x7ff670d978c1
test rbx, rbx
je 0x7ff670d978be
mov rcx, rbx
call fcn.7ff670dbe3bc
mov r14, rax
jmp 0x7ff670d978c1
mov r14, r13
mov qword [rbp - 1], r14
lea rdi, [rbx + r14]
mov qword [rbp + 0xf], rdi
mov r8, rbx
xor edx, edx
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 7], rdi
jmp 0x7ff670d978e4
mov r14, qword [rbp - 1]
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 9]
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rbp - 9]
call qword [sym.imp.advapi32.dll_RegCloseKey]
test ebx, ebx
je 0x7ff670d9798c
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
test r14, r14
je 0x7ff670d97968
sub rdi, r14
sar rdi, 1
add rdi, rdi
mov rax, r14
cmp rdi, 0x1000
jb 0x7ff670d9795d
add rdi, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff670d97b51
mov rdx, rdi
mov rcx, r14
call fcn.7ff670dbdfe4
mov rax, rsi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r15, 0xffffffffffffffff
mov r9d, r15d
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [rbp - 0x15], eax
xorps xmm0, xmm0
test eax, eax
je 0x7ff670d97918
movsxd r12, eax
movdqu xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x27], r13
movabs rax, 0x7fffffffffffffff
cmp r12, rax
ja 0x7ff670d97b64
cmp r12, 0x1000
jb 0x7ff670d97a17
lea rcx, [r12 + 0x27]
cmp rcx, r12
jbe 0x7ff670d97b58
call fcn.7ff670dbe3bc
test rax, rax
je 0x7ff670d97b03
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x7ff670d97a22
mov rcx, r12
call fcn.7ff670dbe3bc
mov rbx, rax
mov qword [rbp + 0x17], rbx
lea r13, [rbx + r12]
mov qword [rbp + 0x27], r13
mov r8, r12
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x1f], r13
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov eax, dword [rbp - 0x15]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, r15d
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_WideCharToMultiByte]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
test eax, eax
jne 0x7ff670d97abe
mov qword [rsi + 0x18], 0xf
mov byte [rsi], r12b
test rbx, rbx
je 0x7ff670d9792a
sub r13, rbx
mov rax, rbx
cmp r13, 0x1000
jb 0x7ff670d97aae
add r13, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff670d97b03
mov rdx, r13
mov rcx, rbx
call fcn.7ff670dbdfe4
jmp 0x7ff670d9792a
mov qword [rsi + 0x18], r12
inc r15
cmp byte [rbx + r15], r12b
jne 0x7ff670d97ac2
mov r8, r15
mov rdx, rbx
mov rcx, rsi
call fcn.7ff670d8a160
nop
test rbx, rbx
je 0x7ff670d97b16
sub r13, rbx
mov rax, rbx
cmp r13, 0x1000
jb 0x7ff670d97b0a
add r13, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff670d97b0a
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r13
mov rcx, rbx
call fcn.7ff670dbdfe4
nop
test r14, r14
je 0x7ff670d97968
sub rdi, r14
sar rdi, 1
add rdi, rdi
mov rax, r14
cmp rdi, 0x1000
jb 0x7ff670d9795d
add rdi, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff670d9795d
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.7ff670d81f30
nop
call fcn.7ff670d81f30
nop
call fcn.7ff670da52e0
int3