Function at 0x18000f010
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov r12, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rax - 0x70], r15d
mov rdi, r15
mov qword [rax - 0x50], r15
mov dword [rax - 0x48], r15d
mov r13, qword [rax + 0x28]
mov rcx, qword [r13]
sub rcx, 0x18
call fcn.180001380
add rax, 0x18
mov qword [rsi], rax
mov ebp, 1
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x48], r15
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000f1e8
mov rdi, qword [rsp + 0x48]
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x30], r15d
mov ebx, r15d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000f0f8
mov eax, dword [rsp + 0x3c]
cmp eax, ebp
je 0x18000f0f2
cmp eax, 2
jne 0x18000f0f8
mov ebx, dword [rsp + 0x30]
shr ebx, 1
lea edx, [rbx + 1]
mov rax, qword [rsi]
sub ebp, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or eax, ebp
jge 0x18000f112
mov rcx, rsi
call fcn.180001770
mov rbp, qword [rsi]
lea eax, [rbx + rbx]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x18000f186
mov eax, dword [rsp + 0x40]
cmp eax, 1
je 0x18000f15b
cmp eax, 2
je 0x18000f15b
mov ebx, 0xd
jmp 0x18000f186
test rbp, rbp
je 0x18000f183
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x18000f17e
test al, 1
jne 0x18000f177
shr rax, 1
cmp word [rbp + rax*2 - 2], 0
je 0x18000f183
mov ebx, 0xd
jmp 0x18000f186
mov word [rbp], r15w
mov ebx, r15d
mov rcx, qword [rsi]
test rcx, rcx
jne 0x18000f193
mov eax, r15d
jmp 0x18000f1a0
movsxd rdx, dword [rcx - 0xc]
call fcn.180012d2c
test eax, eax
js 0x18000f1dd
mov rcx, qword [rsi]
cmp eax, dword [rcx - 0xc]
jg 0x18000f1dd
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rsi]
mov word [rax + rcx*2], r15w
test ebx, ebx
je 0x18000f1c5
mov rdx, r13
mov rcx, rsi
call fcn.1800028e0
test rdi, rdi
je 0x18000f1e8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r15
mov qword [rsp + 0x58], r15
jmp 0x18000f1e8
mov ecx, 0x80070057
call fcn.180001000
nop
test rdi, rdi
je 0x18000f1f7
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [r14]
sub rdx, 0x18
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000f218
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000f237
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x18000f253
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rsi
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret