Function at 0x180055ee0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd60]
sub rsp, 0xe60
lea r12d, [r9 + 0x11d]
mov ebx, r9d
mov r13, rdx
mov rsi, rcx
cmp r9d, r12d
jae case.0x180055f82.48
mov r14, qword [rbp + 0xdc8]
lea rdx, [0x180000000]
mov r15, qword [rbp + 0xda0]
lea r9, [0x1800961f8]
xor edi, edi
lea r10, [0x1800961fc]
lea r11, [0x180096200]
nop dword [rax]
cmp ebx, 0x131
ja 0x180056298
je 0x1800561c9
lea eax, [rbx - 0x2d]
cmp eax, 0xf1
ja case.0x180055f82.57
movzx eax, byte [rdx + rax + 0x56400]
mov ecx, dword [rdx + rax*4 + 0x563cc]
add rcx, rdx
jmp rcx
movsx eax, word [r14]
mov dword [rbp + 0x6dc], eax
mov dword [rbp + 0x5c8], edi
jmp case.0x180055f82.57
mov dword [rsp + 0x50], 4
jmp case.0x180055f82.57
mov rcx, qword [rbp + 0xdc0]
movzx eax, word [rbp + 0x6da]
mov word [0x1800ce8f8], ax
test rcx, rcx
je case.0x180055f82.57
movzx eax, word [rbp + 0x5c8]
mov word [rcx], ax
jmp case.0x180055f82.57
mov r15, rdi
mov dword [rsp + 0x54], 4
jmp case.0x180055f82.57
mov ecx, 0xffffffe1
lea rdx, [rbp + 0x770]
call qword [0x1800ce8f0]
movzx eax, word [rbp + 0xcca]
mov rdx, rsi
mov word [0x1800ce8f8], ax
mov ecx, 2
lea rax, [rbp + 0x70]
nop
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x180056010
mov ecx, dword [rax]
mov dword [rdx], ecx
jmp 0x18005637f
test r13, r13
je case.0x180055f82.57
movzx eax, word [rbp + 0x5ca]
mov word [r13], ax
jmp case.0x180055f82.57
lea rax, [0x180096204]
mov qword [rsp + 0x70], r9
mov qword [rbp - 0x78], rax
lea rax, [0x180096208]
mov qword [rbp - 0x70], rax
lea rax, [0x18009620c]
mov qword [rbp - 0x68], rax
lea rax, [0x180096210]
mov qword [rbp - 0x60], rax
lea rax, [0x180096214]
mov qword [rbp - 0x58], rax
lea rax, [0x180096218]
mov qword [rbp - 0x50], rax
lea rax, [0x18009621c]
mov qword [rbp - 0x48], rax
lea rax, [0x180096220]
mov qword [rbp - 0x40], rax
lea rax, [0x180096224]
mov qword [rbp - 0x38], rax
lea rax, [0x180096228]
mov qword [rbp - 0x30], rax
lea rax, [0x18009622c]
mov qword [rsp + 0x78], r10
movaps xmm0, xmmword [rsp + 0x70]
movaps xmmword [0x1800dea00], xmm0
movaps xmm0, xmmword [rbp - 0x70]
movaps xmmword [0x1800dea20], xmm0
movaps xmm0, xmmword [rbp - 0x50]
mov qword [rbp - 0x80], r11
movaps xmm1, xmmword [rbp - 0x80]
movaps xmmword [0x1800dea10], xmm1
movaps xmm1, xmmword [rbp - 0x60]
mov qword [rbp - 0x28], rax
movaps xmmword [0x1800dea30], xmm1
movaps xmm1, xmmword [rbp - 0x40]
movaps xmmword [0x1800dea40], xmm0
movaps xmm0, xmmword [rbp - 0x30]
movaps xmmword [0x1800dea60], xmm0
movaps xmmword [0x1800dea50], xmm1
jmp case.0x180055f82.57
mov eax, dword [r14 + 0x10]
movups xmm0, xmmword [r14]
mov dword [rbp + 0xb80], eax
lea rax, [rbp + 0x70]
mov dword [rbp + 0xccc], eax
movaps xmmword [rbp + 0xb70], xmm0
mov byte [rbp + 0x70], 5
mov word [rbp + 0xcca], di
jmp case.0x180055f82.57
mov ecx, 0xffffffcf
mov word [rbp + 0x6da], di
lea rdx, [rbp + 0x180]
call qword [0x1800ce8f0]
jmp 0x18005637f
movsx eax, word [r8]
mov dword [rbp + 0x6e0], eax
movsx eax, word [0x1800ce8fc]
mov dword [rbp + 0x6e8], eax
jmp case.0x180055f82.57
mov eax, dword [0x1800961f0]
lea rdx, [rbp]
movups xmm0, xmmword [str.Bent_u_zeker_dat_u_de_map__s_wenst_te_verplaatsen_]
mov dword [rbp + 0x30], eax
mov r9d, 0x20019
movzx eax, byte [0x1800961f4]
xor r8d, r8d
movups xmm1, xmmword [0x1800961d0]
mov rcx, 0xffffffff80000002
mov byte [rbp + 0x34], al
movaps xmmword [rbp], xmm0
lea rax, [rsp + 0x60]
movups xmm0, xmmword [0x1800961e0]
mov qword [rsp + 0x60], 0xffffffff80000002
movaps xmmword [rbp + 0x10], xmm1
movaps xmmword [rbp + 0x20], xmm0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18005637f
mov rax, qword [r14]
lea r9, [rbp + 0xdb8]
mov qword [rsp + 0x40], rdi
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x38], rdi
xor r8d, r8d
mov qword [rbp + 0xda0], rax
xor edx, edx
lea rax, [rbp + 0xda0]
mov dword [rbp + 0xdb8], edi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x28
call fcn.180036ed0
mov rbx, qword [rsp + 0xea8]
mov rax, rsi
add rsp, 0xe60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, ebx
sub eax, 0x144
je 0x180056344
cmp eax, 0x13
jne case.0x180055f82.57
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov dword [rbp + 0xda0], r15d
mov word [rbp + 0xdb8], ax
lea r8, [rbp + 0xda0]
mov rax, qword [r14]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x68], rax
mov r9d, 0xd9
lea rax, [rbp + 0xdb8]
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.180028370
mov rax, qword [r14]
lea r9, [rbp + 0xdb8]
mov qword [rsp + 0x40], rdi
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x38], rdi
xor r8d, r8d
mov qword [rbp + 0xda0], rax
xor edx, edx
lea rax, [rbp + 0xda0]
mov dword [rbp + 0xdb8], r15d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x28
call fcn.180036ed0
jmp 0x18005637f
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x54]
lea rax, [rsp + 0x58]
xor r8d, r8d
lea rdx, [0x180096230]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180056232
mov r15d, dword [rsp + 0x58]
mov r8, qword [rbp + 0xdb0]
lea rdx, [0x180000000]
lea r9, [0x1800961f8]
lea r10, [0x1800961fc]
lea r11, [0x180096200]
add ebx, 0x13
cmp ebx, r12d
jb 0x180055f50
jmp case.0x180055f82.48
movsxd rax, dword [r14]
cmp eax, 0xe
jge 0x1800563c3
mov rdi, qword [rdx + rax*8 + 0xdea00]
mov qword [rsi], rdi
jmp case.0x180055f82.48