Function at 0x18001f2a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x180064138]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov esi, edx
mov rbx, rcx
test rcx, rcx
je 0x18001f53c
test edx, edx
je 0x18001f53c
xor edx, edx
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x64]
call fcn.180027560
lea rax, [rsp + 0x48]
mov r9d, 8
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x18004dc18]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor r14d, r14d
test eax, eax
jne 0x18001f4c8
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x40]
mov qword [rsp + 0x30], r14
xor edx, edx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x398], rdi
mov edi, r14d
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x18001f4b5
nop word [rax + rax]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18001f479
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x54]
lea rax, [rbp + 0x150]
mov dword [rsp + 0x54], 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x18004dc58]
mov dword [rsp + 0x50], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18001f46e
xor edx, edx
lea r8d, [rax + 0x64]
lea rcx, [rbp - 0x30]
call fcn.180027560
mov r8d, 0x64
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x150]
call fcn.18001f570
test eax, eax
je 0x18001f46e
cmp byte [rsp + 0x60], r14b
je 0x18001f425
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x18001f46e
lea r8, [rbp - 0x30]
mov edx, 0x64
lea rcx, [rsp + 0x60]
sub r8, rcx
lea rax, [rsp + 0x60]
nop dword [rax + rax]
lea rcx, [rdx + 0x7fffff9a]
test rcx, rcx
je 0x18001f460
movzx ecx, byte [r8 + rax]
test cl, cl
je 0x18001f460
mov byte [rax], cl
inc rax
sub rdx, 1
jne 0x18001f440
test rdx, rdx
lea rcx, [rax - 1]
cmovne rcx, rax
mov byte [rcx], r14b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x40]
mov qword [rsp + 0x30], r14
inc edi
mov qword [rsp + 0x28], r14
mov edx, edi
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x18001f370
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x398]
cmp byte [rsp + 0x60], r14b
je 0x18001f53c
lea rax, [rsi - 1]
mov r8d, 0x7ffffffe
cmp rax, r8
mov edx, r14d
mov r9d, 0x80070057
mov rcx, rsi
cmova edx, r9d
test edx, edx
js 0x18001f533
test esi, esi
je 0x18001f51c
sub r8, rcx
lea rdx, [rsp + 0x60]
sub rdx, rbx
nop
lea rax, [r8 + rcx]
test rax, rax
je 0x18001f51c
movzx eax, byte [rdx + rbx]
test al, al
je 0x18001f51c
mov byte [rbx], al
inc rbx
sub rcx, 1
jne 0x18001f500
test rcx, rcx
lea rax, [rbx - 1]
mov edx, 0x8007007a
cmovne rax, rbx
cmovne edx, r14d
mov byte [rax], r14b
not edx
shr edx, 0x1f
mov eax, edx
jmp 0x18001f53e
xor eax, eax
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.18001e0c0
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x370
pop r14
pop rsi
pop rbp
ret