Function at 0x180015444
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x1800240b0]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r12d, r12d
mov r15, rcx
mov r14, rdx
lea rcx, [rbp - 0x27]
lea r8d, [r12 + 0x4c]
xor edx, edx
mov word [rbp - 0x29], r12w
call sub.msvcrt.dll_memset
xor eax, eax
mov qword [r14], rax
mov qword [r14 + 8], rax
mov qword [rbp - 0x39], r12
mov qword [r14 + 0x10], rax
mov qword [rbp - 0x41], r12
mov edi, r12d
mov dword [rbp - 0x49], r12d
test r15, r15
je 0x180015629
test r14, r14
je 0x180015629
lea rdx, [rbp - 0x29]
mov rcx, r15
call fcn.18001e7dc
mov ebx, eax
test eax, eax
jne 0x18001565a
lea rax, [rbp - 0x39]
lea esi, [rbx + 1]
lea rdx, [0x180020d30]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov r9d, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x180015511
cmp eax, 2
jne 0x18001562e
mov ebx, 0x490
jmp 0x18001562e
mov rcx, qword [rbp - 0x39]
lea rax, [rbp - 0x41]
lea rdx, [rbp - 0x29]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1800154fe
mov rcx, qword [rbp - 0x41]
lea rax, [rbp - 0x49]
lea r9, [rbp - 0x45]
mov qword [rsp + 0x28], rax
lea rdx, [0x180020dc0]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x180015572
cmp dword [rbp - 0x45], 7
jne 0x180015629
test rdi, rdi
jne 0x1800155a6
lea ebx, [rdi + 0x7a]
cmp ebx, 0x7a
jne 0x18001559e
test rdi, rdi
je 0x180015585
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [rbp - 0x49]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x180015534
lea ebx, [rax + 0xe]
test ebx, ebx
jne 0x18001562e
mov rsi, rdi
cmp word [rdi], r12w
je 0x180015617
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x38], r12
lea rax, [rbp - 0x31]
mov dword [rsp + 0x30], r12d
lea r9, [0x180020b00]
mov r8, rsi
mov edx, 2
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.drvstore.dll_DriverStoreGetObjectPropertyW]
test eax, eax
jne 0x1800155f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x7a
jne 0x180015613
mov ebx, r12d
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r12w
jne 0x1800155fb
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], r12w
jne 0x1800155af
test ebx, ebx
jne 0x18001562e
movups xmm0, xmmword [r15]
mov qword [r14 + 0x10], rdi
mov rdi, r12
movdqu xmmword [r14], xmm0
jmp 0x18001562e
mov ebx, 0xd
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x18001563d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x18001564c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rdi, rdi
je 0x18001565a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.180001ac0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret