Function at 0x180015690
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test rcx, rcx
je 0x1800157b6
and qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
xor ebx, ebx
and dword [rcx], ebx
lea rdx, [0x180020cb0]
mov r9d, 0x20019
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18001573c
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x30]
lea rdx, [0x180020e60]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180015729
mov eax, dword [rbp + 0x40]
mov ebx, 1
mov dword [rsi], eax
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x10], 0
test ebx, ebx
jne 0x1800157ae
lea rax, [rbp - 0x10]
lea rdx, [0x180020e90]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800157ae
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x30]
lea rdx, [0x180020e60]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800157a4
cmp dword [rbp + 0x40], eax
seta al
xor ebx, ebx
mov dword [rsi], eax
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x1800157b6
mov dword [r14], ebx
test rdi, rdi
je 0x1800158be
and qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
lea rdx, [0x1800158d0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
xor ebx, ebx
mov dword [rdi], 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180015847
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x30]
lea rdx, [0x180020f10]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180015834
mov eax, dword [rbp + 0x40]
mov ebx, 1
mov dword [rdi], eax
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x10], 0
test ebx, ebx
jne 0x1800158b6
lea rax, [rbp - 0x10]
lea rdx, [0x180020f60]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800158b6
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x30]
lea rdx, [0x180020f10]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800158ac
mov eax, dword [rbp + 0x40]
xor ebx, ebx
mov dword [rdi], eax
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15, r15
je 0x1800158be
mov dword [r15], ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret