Function at 0x1800a2e04
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xc8
mov rax, qword [0x180122658]
xor rax, rsp
mov qword [rbp + 0xf], rax
xor r13d, r13d
lea rax, [rbp - 0x39]
mov qword [rsp + 0x58], r13
mov r15, r9
mov qword [rsp + 0x50], r13
mov rsi, r8
mov qword [rsp + 0x48], r13
mov ebx, edx
mov qword [rsp + 0x40], r13
lea r12d, [r13 + 0x10]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov qword [rsp + 0x28], r13
xor edx, edx
mov qword [rsp + 0x20], r13
mov rdi, rcx
mov dword [rbp - 0x49], r13d
mov r14d, r13d
mov dword [rbp - 0x45], r12d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
test eax, eax
je 0x1800a2e90
mov eax, 0x80040161
jmp 0x1800a3120
mov eax, dword [rbp - 0x39]
test eax, eax
je 0x1800a2e86
cmp eax, 1
jne 0x1800a2ecf
lea rax, [rbp - 0x49]
xor edx, edx
mov qword [rsp + 0x38], rax
lea r9, [rbp - 0x45]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x31]
mov qword [rsp + 0x28], r13
mov rcx, rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
mov r8d, r12d
jmp 0x1800a30b1
mov r9d, ebx
lea r8, [0x180102c68]
mov edx, 0x1e
lea rcx, [rbp - 0x31]
call fcn.18000b8f4
test eax, eax
js 0x1800a3120
lea rax, [rbp - 0x49]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x31]
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x1800a30c5
mov eax, 0x3ff
lea r8, [0x180102c68]
and bx, ax
lea rcx, [rbp - 0x31]
movzx r12d, bx
mov edx, 0x1e
mov ebx, r12d
bts ebx, 0xa
mov r9d, ebx
call fcn.18000b8f4
test eax, eax
js 0x1800a3120
lea rax, [rbp - 0x49]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x31]
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x1800a30c5
lea rax, [rbp - 0x49]
mov ebx, 0x10
mov qword [rsp + 0x38], rax
lea r9, [rbp - 0x45]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x31]
mov qword [rsp + 0x28], r13
mov edx, r14d
mov rcx, rdi
mov qword [rsp + 0x20], r13
mov dword [rbp - 0x45], ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
test eax, eax
jne 0x1800a2fda
mov r8d, ebx
mov qword [rbp - 0x41], r13
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x31]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcstoul]
mov ecx, 0x3ff
mov ebx, eax
and ax, cx
cmp ax, r12w
je 0x1800a30c5
inc r14d
jmp 0x1800a2f74
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetUserDefaultLCID]
mov r14d, 0x1e
lea r8, [0x180102c68]
mov r9d, eax
lea rcx, [rbp - 0x31]
mov edx, r14d
mov ebx, eax
call fcn.18000b8f4
test eax, eax
js 0x1800a3120
lea rax, [rbp - 0x49]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x31]
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x1800a30c5
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetSystemDefaultLCID]
lea r8, [0x180102c68]
mov edx, r14d
mov r9d, eax
lea rcx, [rbp - 0x31]
mov ebx, eax
call fcn.18000b8f4
test eax, eax
js 0x1800a3120
lea rax, [rbp - 0x49]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x31]
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x1800a30c5
lea rax, [rbp - 0x49]
xor edx, edx
mov qword [rsp + 0x38], rax
lea r9, [rbp - 0x45]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x31]
mov qword [rsp + 0x28], r13
mov rcx, rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
test eax, eax
jne 0x1800a2e86
lea r8d, [r14 - 0xe]
lea rdx, [rbp - 0x41]
mov qword [rbp - 0x41], r13
lea rcx, [rbp - 0x31]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcstoul]
mov ebx, eax
mov eax, dword [rbp - 0x49]
lea ecx, [rax + rax]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov qword [rsi], rax
test rax, rax
jne 0x1800a30e0
mov eax, 0x8007000e
jmp 0x1800a3120
lea rcx, [rbp - 0x49]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea rdx, [rbp - 0x31]
mov rcx, rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x1800a3116
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rsi], r13
jmp 0x1800a2e86
test r15, r15
je 0x1800a311e
mov dword [r15], ebx
xor eax, eax
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.180023ec0
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret