Function at 0x1400184fc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1420]
mov eax, 0x1520
call fcn.14002ea40
sub rsp, rax
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x1570], rbx
mov rax, qword [0x140051ad0]
xor rax, rsp
mov qword [rbp + 0x1410], rax
mov rsi, rdx
mov r14, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x200]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rsp + 0x74], 0x104
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov rcx, rsi
call fcn.140016bac
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x140018593
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov qword [rsp + 0x60], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x1400185f6
lea rdx, str.Failed_to_open_registry_key__s
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
mov r8, r14
cmovle ebx, eax
mov ecx, ebx
call fcn.14000a164
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400185ef
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
jmp 0x1400188aa
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x74]
lea rdx, [rbp + 0x200]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14001864d
lea rdx, str.Failed_to_examine_registry_key__s
jmp 0x1400185c6
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x140018898
mov r14d, r12d
mov edi, 0x80070000
movabs r13, 0x333333333333332
mov dword [rsp + 0x78], 0xff
mov word [rbp], r12w
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x78]
lea r8, [rbp]
mov edx, r14d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
test eax, eax
jne 0x1400188d4
cmp dword [rsp + 0x6c], 1
jne 0x140018771
mov word [rbp + 0x410], r12w
mov dword [rsp + 0x68], 0x1000
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x410]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, 2
lea r8, [rbp]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x140018859
lea rax, [rbp]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x410]
mov qword [rbp - 0x78], rax
mov rax, qword [rsi + 8]
mov rbx, qword [rax]
mov r15, qword [rbx + 8]
lea r9, [rbp - 0x80]
mov r8, r15
mov rdx, rbx
call fcn.14001990c
mov rdx, qword [rsi + 0x10]
mov rcx, r13
sub rcx, rdx
cmp rcx, 1
jb 0x1400188fe
lea rcx, [rdx + 1]
mov qword [rsi + 0x10], rcx
mov qword [rbx + 8], rax
mov qword [r15], rax
mov r9, qword [rsi + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.140016d48
jmp 0x14001888a
cmp dword [rsp + 0x6c], 4
jne 0x14001888a
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x7c], 4
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140018859
mov edx, dword [rsp + 0x68]
lea rcx, [rbp - 0x20]
call fcn.1400181b0
nop
lea rcx, [rbp]
mov qword [rbp - 0x48], rcx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rax, qword [rsi + 8]
mov rbx, qword [rax]
mov r15, qword [rbx + 8]
lea r9, [rbp - 0x48]
mov r8, r15
mov rdx, rbx
call fcn.140019974
mov rdx, qword [rsi + 0x10]
mov rcx, r13
sub rcx, rdx
cmp rcx, 1
jb 0x1400188f1
lea rcx, [rdx + 1]
mov qword [rsi + 0x10], rcx
mov qword [rbx + 8], rax
mov qword [r15], rax
mov r9, qword [rsi + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
lea rdx, [rbp - 0x58]
mov rcx, rsi
call fcn.140016d48
nop
lea rcx, [rbp - 0x40]
call fcn.14000ab60
nop
lea rcx, [rbp - 0x20]
call fcn.14000ab60
jmp 0x14001888a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx r8d, bx
or r8d, edi
test ebx, ebx
cmovle r8d, ebx
movzx ecx, ax
or ecx, edi
test eax, eax
lea rdx, str.Failed_to_read_registry_value_hr0x_08x
cmovle ecx, eax
call fcn.14000a164
inc r14d
cmp r14d, dword [rsp + 0x70]
jb 0x14001866b
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400188a8
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rbp + 0x1410]
xor rcx, rsp
call fcn.14002d710
mov rbx, qword [rsp + 0x1570]
add rsp, 0x1520
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
lea rdx, str.Failed_to_enumerate_registry_key
mov ecx, ebx
call fcn.14000a164
jmp 0x1400185df
lea rcx, str.list_T__too_long
call fcn.1400129e0
nop
lea rcx, str.list_T__too_long
call fcn.1400129e0
int3