Function at 0x180007560
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x4f]
sub rsp, 0xd8
lea rdx, [rcx + 0x48]
mov rcx, qword [rcx + 0x40]
lea rax, [rbp - 0x11]
mov r9d, 0xf003f
xor r8d, r8d
xor r14d, r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800077f4
mov rcx, qword [rbp - 0x11]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
lea rax, [rbp - 0x25]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x29]
xor edx, edx
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x1800075fa
xor eax, eax
add rsp, 0xd8
pop r14
pop rbp
ret
mov ecx, dword [rbp + 0x7f]
test ecx, ecx
je 0x1800077f4
mov eax, dword [rbp - 0x25]
test eax, eax
je 0x1800077f4
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xb8], r12
mov r12d, dword [rbp - 0x29]
mov qword [rsp + 0xb0], r13
lea r13d, [rax + rax + 2]
add r12d, 0x64
mov dword [rbp - 0x21], ecx
lea eax, [r12 + r13 + 1]
mov qword [rsp + 0xa8], r15
mov dword [rbp + 0x67], r13d
mov dword [rbp + 0x77], r12d
mov dword [rbp - 0x1d], r12d
imul eax, ecx
add eax, 0x16
mov ecx, 0x40
mov edi, eax
mov edx, eax
mov qword [rbp - 1], rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r8d, edi
mov rcx, rax
xor edx, edx
mov rbx, rax
mov qword [rbp + 0xf], rax
call fcn.18000b160
mov rcx, qword [rbp - 0x21]
mov byte [rbx], 1
mov qword [rbx + 1], rcx
mov dword [rbx + 9], r13d
mov esi, dword [rbp + 0x77]
mov ecx, esi
call fcn.180008870
mov ecx, dword [rbp + 0x67]
mov r15, rax
call fcn.180008870
add rbx, 0xd
mov edi, r14d
mov qword [rbp - 0x21], rax
cmp dword [rbp + 0x7f], r14d
jbe 0x18000779a
nop word [rax + rax]
mov r8d, esi
xor edx, edx
mov rcx, r15
call fcn.18000b160
mov rsi, qword [rbp - 0x21]
mov r8d, dword [rbp + 0x67]
mov rcx, rsi
xor edx, edx
call fcn.18000b160
mov eax, dword [rbp - 0x29]
mov r11d, dword [rbp - 0x25]
mov rcx, qword [rbp - 0x11]
add eax, 0x64
inc r11d
mov dword [rbp + 0x77], eax
lea rax, [rbp + 0x67]
lea r9, [rbp + 0x77]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov r8, r15
mov edx, edi
mov qword [rsp + 0x20], r14
mov dword [rbp + 0x67], r11d
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov r11d, dword [rbp + 0x6f]
cmp r11d, 1
jne 0x180007743
mov byte [rbx], r14b
mov r11d, dword [rbp + 0x6f]
cmp r11d, 4
jne 0x180007750
mov byte [rbx], 1
mov r11d, dword [rbp + 0x6f]
cmp r11d, 3
jne 0x18000775d
mov byte [rbx], 2
mov r11d, dword [rbp + 0x6f]
cmp r11d, 2
jne 0x180007766
mov byte [rbx], 3
inc rbx
mov r8, r12
mov rdx, r15
mov rcx, rbx
call fcn.180008300
add rbx, r12
mov r8, r13
mov rcx, rbx
mov rdx, rsi
call fcn.180008300
inc edi
add rbx, r13
cmp edi, dword [rbp + 0x7f]
jae 0x18000779d
mov esi, dword [rbp + 0x77]
jmp 0x1800076d0
mov rsi, rax
mov rcx, r15
call fcn.180008830
mov rcx, rsi
call fcn.180008830
mov rdx, qword [rbp - 1]
mov rcx, qword [rbp + 0xf]
mov r8d, 0x42
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov r15, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xd0]
mov r14, rax
mov rax, r14
add rsp, 0xd8
pop r14
pop rbp
ret