Function at 0x180009000
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x70
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rsi, r9
mov rbp, r8
and dword [rax - 0x68], 0
lea rax, [rax - 0x60]
mov qword [rsp + 0x58], rax
mov rbx, qword [r9]
cmp dword [rbx - 0xc], 0
jl 0x18000904b
mov qword [rsp + 0x38], rbx
lock add dword [rbx - 0xc], 1
jmp 0x180009078
mov rax, qword [0x18015f768]
mov qword [rsp + 0x38], rax
test rbx, rbx
jne 0x180009060
xor eax, eax
jmp 0x180009069
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x38]
call fcn.180003e28
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov rbx, qword [rbp]
cmp dword [rbx - 0xc], 0
jl 0x180009098
mov qword [rsp + 0x40], rbx
lock add dword [rbx - 0xc], 1
jmp 0x1800090c5
mov rax, qword [0x18015f768]
mov qword [rsp + 0x40], rax
test rbx, rbx
jne 0x1800090ad
xor eax, eax
jmp 0x1800090b6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.180003e28
lea rax, [rsp + 0x40]
mov qword [rsp + 0x58], rax
and dword [rsp + 0x30], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180009165
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff4
lea rdi, [0x18015f758]
or ebx, 0xffffffff
cmp rcx, rdi
je 0x180009130
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180009130
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x180009211
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180009211
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
jmp 0x180009211
mov ecx, 0x800
mov dword [rsp + 0x30], ecx
call fcn.1800d04fc
mov r13, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r12d, r12d
test ebx, ebx
sete r12b
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff4
lea rdi, [0x18015f758]
or ebx, 0xffffffff
cmp rcx, rdi
je 0x1800091e4
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x1800091e4
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18000920c
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x18000920c
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
test r12d, r12d
jne 0x180009263
mov rcx, qword [rbp]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x180009238
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180009238
mov rcx, qword [rbp]
sub rcx, 0xc
call fcn.1800d1434
nop
mov rcx, qword [rsi]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18000925c
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x18000925c
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.1800d1434
xor eax, eax
jmp 0x180009355
test r13, r13
je 0x180009308
cmp dword [rsp + 0x30], 0
je 0x180009308
lea rdx, [rsp + 0x68]
lea rcx, [0x180163340]
call fcn.180008f88
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rcx
mov r9, rax
lea r8, [rsp + 0x30]
mov rdx, r13
lea rcx, [0x18015f720]
call fcn.1800cf2c0
mov r12d, eax
mov rcx, r13
call fcn.1800d1434
nop
mov rdx, qword [rbp]
add rdx, 0xfffffffffffffff4
cmp rdx, rdi
je 0x1800092df
mov ecx, ebx
lock xadd dword [rdx], ecx
add ecx, ebx
test ecx, ecx
jg 0x1800092df
mov rcx, qword [rbp]
sub rcx, 0xc
call fcn.1800d1434
nop
mov rcx, qword [rsi]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x180009303
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180009303
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.1800d1434
mov eax, r12d
jmp 0x180009355
mov rcx, qword [rbp]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18000932f
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x18000932f
mov rcx, qword [rbp]
sub rcx, 0xc
call fcn.1800d1434
nop
mov rcx, qword [rsi]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x180009353
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180009353
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.1800d1434
xor eax, eax
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret