Function at 0x180022130
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov rsi, rcx
lea rdx, [0x18035469c]
lea rcx, [rsp + 0x38]
mov r8d, 0x12
call fcn.180022bd0
xor eax, eax
cmp rax, qword [rsp + 0x38]
jno 0x180022182
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 1
mov qword [rsp + 0x80], 0
jmp 0x180022199
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rsp + 0x38]
movaps xmmword [rsp + 0x70], xmm0
lea rdx, [0x18035469c]
lea rcx, [rsp + 0x38]
mov r8d, 0x12
call fcn.180022bd0
movabs rax, 0x8000000000000000
mov rdi, qword [rsp + 0x38]
xor edx, edx
cmp rdi, rax
mov ebx, 1
cmovne rbx, qword [rsp + 0x40]
cmove rdi, rdx
cmovne rdx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.1800f95b0
mov r14, rax
test rdi, rdi
je 0x1800221fa
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call fcn.18000a8a0
mov rax, r14
shr rax, 0x24
cmp eax, 0x55f
setae al
xor r14b, 1
mov ebp, 0xb
test al, r14b
jne 0x1800223e1
lea rax, [0x18035464f]
mov qword [rsp + 0x38], rax
lea rax, [0x18035467b]
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0xa8]
lea rdx, [rsp + 0x38]
call fcn.180024c60
lea rax, [0x1803546ae]
mov qword [rsp + 0x38], rax
lea rax, [0x1803546c7]
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0x88]
lea rbx, [rsp + 0x38]
mov rdx, rbx
call fcn.180024c60
mov rdi, qword [rsp + 0xb0]
call fcn.18004b900
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rbx
mov rcx, 0xffffffff80000002
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x20019
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x18002230d
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x1800222e6
mov rcx, qword [rsp + 0x90]
add rdx, rdx
mov r8d, 2
call fcn.18000a8a0
mov rdx, qword [rsp + 0xa8]
test rdx, rdx
je 0x1800223df
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.18000a8a0
jmp 0x1800223df
mov r15, qword [rsp + 0x38]
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x34], 0
mov r14, qword [rsp + 0x90]
mov dword [rsp + 0x38], 0
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov rcx, r15
mov rdx, r14
xor r8d, r8d
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
test eax, eax
je 0x180022391
movzx ecx, bx
or ecx, 0x80070000
test ebx, ebx
cmovle ecx, ebx
call fcn.1800562c0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], edx
mov byte [rsp + 0x38], 1
test rax, rax
je 0x180022397
lea rcx, [rsp + 0x40]
call fcn.180056c30
jmp 0x180022397
mov ebp, dword [rsp + 0x34]
jmp 0x180022397
mov rcx, r15
call sub.advapi32.dll_RegCloseKey
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x1800223bd
add rdx, rdx
mov r8d, 2
mov rcx, r14
call fcn.18000a8a0
mov rdx, qword [rsp + 0xa8]
test rdx, rdx
je 0x1800223db
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.18000a8a0
test ebx, ebx
je 0x1800223e1
xor ebp, ebp
mov dword [rsp + 0xa8], ebp
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x88], rax
lea rax, [fcn.1800fea10]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x98], rax
lea rax, [0x180020110]
mov qword [rsp + 0xa0], rax
lea rax, [0x1803546d0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x58], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 2
lea rcx, [rsp + 0xc0]
lea rdx, [rsp + 0x38]
call fcn.1800e0130
mov rax, qword [rsp + 0xd0]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsi], xmm0
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x18002249a
mov rcx, qword [rsp + 0x78]
mov r8d, 1
call fcn.18000a8a0
mov rax, rsi
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret