Function at 0x1800078d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
lea rbp, [rsp - 0x4f]
sub rsp, 0xd8
lea rdx, [rcx + 0x50]
mov r9d, 0xf003f
mov rcx, qword [rcx + 0x48]
lea rax, [rbp - 0x19]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor r15d, r15d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180007b4f
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 0x29]
mov qword [rsp + 0x58], r15
xor r9d, r9d
mov qword [rsp + 0x50], r15
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
lea rax, [rbp - 0x25]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x1d]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x18000796a
xor eax, eax
add rsp, 0xd8
pop r15
pop rbp
ret
mov ecx, dword [rbp + 0x7f]
test ecx, ecx
je 0x180007b4f
mov eax, dword [rbp - 0x29]
test eax, eax
je 0x180007b4f
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xb8], r12
mov r12d, dword [rbp - 0x25]
add r12d, 0x64
mov qword [rsp + 0xb0], r13
lea r13d, [rax*2 + 2]
mov dword [rbp - 1], ecx
lea eax, [r13 + 1]
mov qword [rsp + 0xa8], r14
add eax, r12d
mov dword [rbp + 0x67], r13d
imul eax, ecx
mov ecx, 0x40
mov dword [rbp + 0x6f], r12d
mov dword [rbp + 3], r12d
add eax, 0x16
mov edi, eax
mov edx, eax
mov qword [rbp - 0x11], rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r8d, edi
xor edx, edx
mov rcx, rax
mov qword [rbp - 9], rax
mov rbx, rax
call fcn.18000af10
movsd xmm0, qword [rbp - 1]
mov byte [rbx], 1
movsd qword [rbx + 1], xmm0
mov dword [rbx + 9], r13d
mov ecx, dword [rbp + 0x6f]
call fcn.18000dac8
mov ecx, dword [rbp + 0x67]
mov rsi, rax
call fcn.18000dac8
add rbx, 0xd
mov r14, rax
mov edi, r15d
cmp dword [rbp + 0x7f], r15d
jbe 0x180007af8
nop dword [rax + rax]
mov r8d, dword [rbp + 0x6f]
xor edx, edx
mov rcx, rsi
call fcn.18000af10
mov r8d, dword [rbp + 0x67]
xor edx, edx
mov rcx, r14
call fcn.18000af10
mov eax, dword [rbp - 0x29]
lea r9, [rbp + 0x6f]
mov rcx, qword [rbp - 0x19]
inc eax
mov dword [rbp + 0x67], eax
mov r8, rsi
mov eax, dword [rbp - 0x25]
mov edx, edi
add eax, 0x64
mov dword [rbp + 0x6f], eax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov eax, dword [rbp + 0x77]
cmp eax, 1
jne 0x180007aaa
mov byte [rbx], r15b
mov eax, dword [rbp + 0x77]
cmp eax, 4
jne 0x180007ab5
mov byte [rbx], 1
mov eax, dword [rbp + 0x77]
cmp eax, 3
jne 0x180007ac0
mov byte [rbx], 2
mov eax, dword [rbp + 0x77]
cmp eax, 2
jne 0x180007ac8
mov byte [rbx], 3
inc rbx
mov r8, r12
mov rcx, rbx
mov rdx, rsi
call fcn.18000a860
add rbx, r12
mov r8, r13
mov rcx, rbx
mov rdx, r14
call fcn.18000a860
add rbx, r13
inc edi
cmp edi, dword [rbp + 0x7f]
jb 0x180007a40
mov rcx, rsi
call fcn.18000d838
mov rcx, r14
call fcn.18000d838
mov rdx, qword [rbp - 0x11]
mov r8d, 0x42
mov rcx, qword [rbp - 9]
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov r14, qword [rsp + 0xa8]
mov r15, rax
mov r13, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xd0]
mov rax, r15
add rsp, 0xd8
pop r15
pop rbp
ret