Function at 0x1400186c4
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1430]
mov eax, 0x1530
call fcn.140031470
sub rsp, rax
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x1580], rbx
mov rax, qword [0x140056920]
xor rax, rsp
mov qword [rbp + 0x1420], rax
mov rbx, rdx
mov qword [rsp + 0x78], rdx
mov r14, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x210]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rbp - 0x78], 0x104
and qword [rsp + 0x60], 0
lea r12, [rbx + 8]
mov rcx, qword [r12]
mov rax, qword [rcx + 8]
and qword [rax], 0
mov rsi, qword [rcx]
test rsi, rsi
je 0x140018779
mov rdi, qword [rsi]
lea rcx, [rsi + 0x30]
call fcn.14000be20
lea rcx, [rsi + 0x10]
call fcn.14000be20
mov edx, 0x50
mov rcx, rsi
call fcn.1400301e8
mov rsi, rdi
test rdi, rdi
jne 0x14001874a
mov rbx, qword [rsp + 0x78]
mov rax, qword [r12]
mov qword [rax], rax
mov rax, qword [r12]
mov qword [rax + 8], rax
xor esi, esi
mov qword [r12 + 8], rsi
mov rax, qword [r12]
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
call fcn.14001720c
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x1400187e2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x78]
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140018851
lea rdx, str.Failed_to_open_registry_key__s
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
mov r8, r14
cmovle ebx, eax
mov ecx, ebx
call fcn.14000b5ac
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001884a
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
jmp 0x140018b08
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0x210]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
test eax, eax
je 0x1400188ad
lea rdx, str.Failed_to_examine_registry_key__s
jmp 0x14001881b
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x140018af0
mov r13d, esi
mov r15d, 0x80070000
mov dword [rbp - 0x74], 0xff
mov word [rbp + 0x10], si
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x74]
lea r8, [rbp + 0x10]
mov edx, r13d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
nop dword [rax + rax]
test eax, eax
jne 0x140018b33
cmp dword [rsp + 0x6c], 1
jne 0x1400189fd
mov word [rbp + 0x420], si
mov dword [rsp + 0x68], 0x1000
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x420]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov r9d, 2
lea r8, [rbp + 0x10]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x140018a9f
mov rbx, qword [r12]
mov rbx, qword [rbx]
movabs rax, 0x333333333333333
cmp qword [r12 + 8], rax
je 0x140018b51
mov r14, qword [rbx + 8]
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], rsi
mov ecx, 0x50
call fcn.1400304e4
mov rsi, rax
mov qword [rbp - 0x68], rax
lea rdi, [rax + 0x10]
mov qword [rbp - 0x80], rdi
lea rdx, [rbp + 0x10]
mov rcx, rdi
call fcn.14000be90
nop
lea rcx, [rdi + 0x20]
lea rdx, [rbp + 0x420]
call fcn.14000be90
nop
mov qword [rsi], rbx
mov qword [rsi + 8], r14
inc qword [r12 + 8]
mov qword [rbx + 8], rsi
mov qword [r14], rsi
xor esi, esi
mov qword [rbp - 0x68], rsi
mov rax, qword [r12]
mov r9, qword [rax]
lea r8, [r9 + 0x10]
lea rdx, [rbp - 0x58]
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.140016b9c
jmp 0x140018ae2
cmp dword [rsp + 0x6c], 4
jne 0x140018ae2
mov dword [rsp + 0x68], esi
mov dword [rbp - 0x80], 4
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x10]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140018a9f
mov edx, dword [rsp + 0x68]
lea rcx, [rbp - 0x10]
call fcn.140013304
nop
lea rcx, [rbp + 0x10]
mov qword [rbp - 0x38], rcx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x48]
mov rcx, rbx
call fcn.140019988
nop
lea rcx, [rbp - 0x30]
call fcn.14000be20
nop
lea rcx, [rbp - 0x10]
call fcn.14000be20
jmp 0x140018ae2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx r8d, bx
or r8d, r15d
test ebx, ebx
cmovle r8d, ebx
movzx ecx, ax
or ecx, r15d
test eax, eax
lea rdx, str.Failed_to_read_registry_value_hr0x_08x
cmovle ecx, eax
call fcn.14000b5ac
mov rbx, qword [rsp + 0x78]
inc r13d
cmp r13d, dword [rsp + 0x70]
jb 0x1400188c2
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140018b06
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
xor eax, eax
mov rcx, qword [rbp + 0x1420]
xor rcx, rsp
call fcn.1400301c0
mov rbx, qword [rsp + 0x1580]
add rsp, 0x1530
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
lea rdx, str.Failed_to_enumerate_registry_key
mov ecx, ebx
call fcn.14000b5ac
jmp 0x140018834
lea rcx, str.list_T__too_long
call fcn.14000fec0
int3