Function at 0x7ff71efe8e50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov r15, r9
mov rdx, r8
mov rsi, rcx
xor r13d, r13d
mov qword [rbp - 9], r13
mov dword [rbp + 0x6f], r13d
lea rcx, [rbp - 9]
mov qword [rsp + 0x20], rcx
lea r9d, [r13 + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7ff71efe8ede
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x19]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 9]
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x7ff71efe8ef8
mov rcx, qword [rbp - 9]
call qword [sym.imp.advapi32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], 0xf
mov byte [rsi], r13b
jmp 0x7ff71efe9008
cmp dword [rbp - 0x19], 1
jne 0x7ff71efe8ed4
mov ebx, dword [rbp + 0x6f]
xorps xmm0, xmm0
movdqu xmmword [rbp - 1], xmm0
mov rdi, r13
mov qword [rbp + 0xf], r13
cmp rbx, 2
jb 0x7ff71efe8f80
and rbx, 0xfffffffffffffffe
cmp rbx, 0x1000
jb 0x7ff71efe8f4c
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x7ff71efe91fe
call fcn.7ff71f00491c
test rax, rax
je 0x7ff71efe91f1
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x7ff71efe8f61
test rbx, rbx
je 0x7ff71efe8f5e
mov rcx, rbx
call fcn.7ff71f00491c
mov r14, rax
jmp 0x7ff71efe8f61
mov r14, r13
mov qword [rbp - 1], r14
lea rdi, [r14 + rbx]
mov qword [rbp + 0xf], rdi
mov r8, rbx
xor edx, edx
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 7], rdi
jmp 0x7ff71efe8f84
mov r14, qword [rbp - 1]
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 9]
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rbp - 9]
call qword [sym.imp.advapi32.dll_RegCloseKey]
test ebx, ebx
je 0x7ff71efe902c
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
test r14, r14
je 0x7ff71efe9008
sub rdi, r14
sar rdi, 1
add rdi, rdi
mov rax, r14
cmp rdi, 0x1000
jb 0x7ff71efe8ffd
add rdi, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff71efe91f1
mov rdx, rdi
mov rcx, r14
call fcn.7ff71f004544
mov rax, rsi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r15, 0xffffffffffffffff
mov r9d, r15d
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [rbp - 0x15], eax
xorps xmm0, xmm0
test eax, eax
je 0x7ff71efe8fb8
movsxd r12, eax
movdqu xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x27], r13
movabs rax, 0x7fffffffffffffff
cmp r12, rax
ja 0x7ff71efe9204
cmp r12, 0x1000
jb 0x7ff71efe90b7
lea rcx, [r12 + 0x27]
cmp rcx, r12
jbe 0x7ff71efe91f8
call fcn.7ff71f00491c
test rax, rax
je 0x7ff71efe91a3
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x7ff71efe90c2
mov rcx, r12
call fcn.7ff71f00491c
mov rbx, rax
mov qword [rbp + 0x17], rbx
lea r13, [rbx + r12]
mov qword [rbp + 0x27], r13
mov r8, r12
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x1f], r13
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov eax, dword [rbp - 0x15]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, r15d
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_WideCharToMultiByte]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
test eax, eax
jne 0x7ff71efe915e
mov qword [rsi + 0x18], 0xf
mov byte [rsi], r12b
test rbx, rbx
je 0x7ff71efe8fca
sub r13, rbx
mov rax, rbx
cmp r13, 0x1000
jb 0x7ff71efe914e
add r13, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff71efe91a3
mov rdx, r13
mov rcx, rbx
call fcn.7ff71f004544
jmp 0x7ff71efe8fca
mov qword [rsi + 0x18], r12
inc r15
cmp byte [rbx + r15], r12b
jne 0x7ff71efe9162
mov r8, r15
mov rdx, rbx
mov rcx, rsi
call fcn.7ff71efda340
nop
test rbx, rbx
je 0x7ff71efe91b6
sub r13, rbx
mov rax, rbx
cmp r13, 0x1000
jb 0x7ff71efe91aa
add r13, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff71efe91aa
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r13
mov rcx, rbx
call fcn.7ff71f004544
nop
test r14, r14
je 0x7ff71efe9008
sub rdi, r14
sar rdi, 1
add rdi, rdi
mov rax, r14
cmp rdi, 0x1000
jb 0x7ff71efe8ffd
add rdi, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff71efe8ffd
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.7ff71efd2220
nop
call fcn.7ff71efd2220
nop
call fcn.7ff71eff8be0
int3