Function at 0x1801670a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov r12, r8
mov r14, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rbp + 0x30], r15d
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
mov qword [rbp + 0x48], r15
lea r8, [rsp + 0x30]
mov edx, 0x400
lea rcx, [rbp + 0x38]
call fcn.1800dbc30
mov dword [rbp + 0x30], r15d
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x38]
sub rax, rcx
mov dword [rbp + 0x50], eax
lea rdi, [r14 + 8]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18016711d
mov rdx, qword [rdi]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x30]
xor r8d, r8d
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
jne 0x1801671d0
mov ecx, dword [rbp + 0x50]
mov r9, qword [rbp + 0x40]
mov r8, r9
mov rdx, qword [rbp + 0x38]
sub r8, rdx
cmp rcx, r8
jae 0x180167167
lea rax, [rdx + rcx]
mov qword [rbp + 0x40], rax
jmp 0x1801671a4
jbe 0x1801671a4
mov rax, qword [rbp + 0x48]
sub rax, rdx
cmp rcx, rax
jbe 0x180167188
lea r8, [rsp + 0x30]
mov rdx, rcx
lea rcx, [rbp + 0x38]
call fcn.1800dbc30
jmp 0x1801671a0
sub rcx, r8
lea rbx, [r9 + rcx]
mov r8, rcx
xor edx, edx
mov rcx, r9
call fcn.18020bef0
mov qword [rbp + 0x40], rbx
mov rdx, qword [rbp + 0x38]
cmp qword [rdi + 0x18], 0x10
jb 0x1801671ae
mov rdi, qword [rdi]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180167325
cmp dword [rbp + 0x30], 3
jne 0x1801673b4
mov ecx, dword [rbp + 0x50]
mov rsi, qword [rbp + 0x40]
mov rdx, rsi
mov rbx, qword [rbp + 0x38]
sub rdx, rbx
cmp rcx, rdx
jae 0x180167202
lea rsi, [rcx + rbx]
mov qword [rbp + 0x40], rsi
jmp 0x180167246
jbe 0x180167246
mov rax, qword [rbp + 0x48]
sub rax, rbx
cmp rcx, rax
jbe 0x180167227
lea r8, [rsp + 0x30]
mov rdx, rcx
lea rcx, [rbp + 0x38]
call fcn.1800dbc30
mov rsi, qword [rbp + 0x40]
jmp 0x180167242
sub rcx, rdx
lea rbx, [rsi + rcx]
mov r8, rcx
xor edx, edx
mov rcx, rsi
call fcn.18020bef0
mov rsi, rbx
mov qword [rbp + 0x40], rbx
mov rbx, qword [rbp + 0x38]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
mov r14, r15
mov qword [rsp + 0x48], r15
mov dword [rbp + 0x30], 1
sub rsi, rbx
mov rdi, qword [rsp + 0x40]
cmp rsi, 8
jb 0x1801672ae
shr rsi, 3
cmp rdi, r14
je 0x180167286
mov rax, qword [rbx]
mov qword [rdi], rax
add rdi, 8
mov qword [rsp + 0x40], rdi
jmp 0x1801672a0
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.1800cdf30
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
add rbx, 8
sub rsi, 1
jne 0x180167270
mov rbx, qword [rbp + 0x38]
lea rax, [rsp + 0x38]
cmp r12, rax
je 0x1801672dc
mov rcx, r12
call fcn.1800929a0
mov rax, qword [rsp + 0x38]
mov qword [r12], rax
mov qword [r12 + 8], rdi
mov qword [r12 + 0x10], r14
mov r14, r15
mov rbx, qword [rbp + 0x38]
jmp 0x1801672e1
mov r15, qword [rsp + 0x38]
test r15, r15
je 0x180167357
sub r14, r15
sar r14, 3
lea rdx, [r14*8]
mov rax, r15
cmp rdx, 0x1000
jb 0x18016731a
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801673ec
mov rcx, r15
call fcn.1801e61d0
nop
jmp 0x180167353
mov rbx, qword [rbp + 0x38]
mov qword [rbp + 0x40], rbx
cmp eax, 2
jne 0x180167357
mov rax, qword [r12 + 8]
sub rax, qword [r12]
sar rax, 3
test rax, rax
je 0x180167357
mov rax, qword [rsi]
mov r8, r12
mov rdx, r14
mov rcx, rsi
call qword [rax + 0x28]
mov rbx, qword [rbp + 0x38]
test rbx, rbx
je 0x18016738d
mov rdx, qword [rbp + 0x48]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x180167384
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801673ae
mov rcx, rbx
call fcn.1801e61d0
nop
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x250
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18010fa40
nop
mov edx, 0xd8
lea rcx, [rbp + 0x60]
call fcn.180099460
lea rcx, [rbp + 0x60]
call fcn.1800f8a60
nop
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.1800f8980
lea rdx, [0x18027f1c8]
lea rcx, [rsp + 0x50]
call fcn.18020aad0
nop
call fcn.18010fa40
int3