Function at 0x180008d50
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7b8]
sub rsp, 0x8b8
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1800a21e8]
xor rax, rsp
mov qword [rbp + 0x7a0], rax
mov r12, r9
mov r15, r8
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x38], rdx
mov r13, qword [rbp + 0x820]
mov rax, qword [rbp + 0x828]
lea rdx, [0x180078368]
test rax, rax
cmovne rdx, rax
lea rcx, [rsp + 0x60]
call fcn.180008950
nop
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
cmp qword [r14 + 0x18], rax
ja 0x180008e56
lea rcx, [rbp - 0x80]
call fcn.180008490
mov rdi, rax
lea rsi, [r14 + 8]
cmp rsi, rax
je 0x180008e16
mov rcx, rsi
call fcn.180003f60
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x10], xmm1
xor eax, eax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], 7
mov word [rdi], ax
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x180008e56
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008e51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800092b0
call fcn.180029f54
lea rdx, [r14 + 8]
cmp qword [rdx + 0x18], 8
jb 0x180008e64
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180008eec
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.180008950
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180009266
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009261
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009292
jmp 0x180009261
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SoftWare
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180008f84
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.180008950
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180009266
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009261
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009298
jmp 0x180009261
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180009023
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.180008950
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180009266
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009261
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000929e
jmp 0x180009261
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1800090d1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.180008950
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180009266
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009261
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800092a4
jmp 0x180009261
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x60]
call fcn.180048230
mov dword [rsp + 0x50], 0x400
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp - 0x60]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x180009150
test eax, eax
jne 0x1800091c2
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.180008950
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180009266
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009261
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800092aa
jmp 0x180009261
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.180008950
nop
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov rcx, rbx
call fcn.180008950
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x180009228
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009222
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800092b6
call fcn.180029f54
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180009266
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009261
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000928c
call fcn.180029f54
mov rax, rbx
mov rcx, qword [rbp + 0x7a0]
xor rcx, rsp
call fcn.18002a070
add rsp, 0x8b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18004bb24
int3
call fcn.18004bb24
int3
call fcn.18004bb24
int3
call fcn.18004bb24
int3
call fcn.18004bb24
int3
call fcn.18004bb24
nop
call fcn.18004bb24
nop
call fcn.18004bb24
int3