Function at 0x180003080
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x4f]
sub rsp, 0xd8
lea rdx, [rcx + 0x38]
mov rcx, qword [rcx + 0x30]
lea rax, [rbp - 0x11]
mov r9d, 0xf003f
xor r8d, r8d
xor r14d, r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180003314
mov rcx, qword [rbp - 0x11]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
lea rax, [rbp - 0x25]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x29]
xor edx, edx
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x18000311a
xor eax, eax
add rsp, 0xd8
pop r14
pop rbp
ret
mov ecx, dword [rbp + 0x7f]
test ecx, ecx
je 0x180003314
mov eax, dword [rbp - 0x25]
test eax, eax
je 0x180003314
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xb8], r12
mov r12d, dword [rbp - 0x29]
mov qword [rsp + 0xb0], r13
lea r13d, [rax + rax + 2]
add r12d, 0x64
mov dword [rbp - 0x21], ecx
lea eax, [r12 + r13 + 1]
mov qword [rsp + 0xa8], r15
mov dword [rbp + 0x67], r13d
mov dword [rbp + 0x77], r12d
mov dword [rbp - 0x1d], r12d
imul eax, ecx
add eax, 0x16
mov ecx, 0x40
mov edi, eax
mov edx, eax
mov qword [rbp - 1], rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r8d, edi
mov rcx, rax
xor edx, edx
mov rbx, rax
mov qword [rbp + 0xf], rax
call fcn.180008ed0
mov rcx, qword [rbp - 0x21]
mov byte [rbx], 1
mov qword [rbx + 1], rcx
mov dword [rbx + 9], r13d
mov esi, dword [rbp + 0x77]
mov ecx, esi
call fcn.180003e18
mov ecx, dword [rbp + 0x67]
mov r15, rax
call fcn.180003e18
add rbx, 0xd
mov edi, r14d
mov qword [rbp - 0x21], rax
cmp dword [rbp + 0x7f], r14d
jbe 0x1800032ba
nop word [rax + rax]
mov r8d, esi
xor edx, edx
mov rcx, r15
call fcn.180008ed0
mov rsi, qword [rbp - 0x21]
mov r8d, dword [rbp + 0x67]
mov rcx, rsi
xor edx, edx
call fcn.180008ed0
mov eax, dword [rbp - 0x29]
mov r11d, dword [rbp - 0x25]
mov rcx, qword [rbp - 0x11]
add eax, 0x64
inc r11d
mov dword [rbp + 0x77], eax
lea rax, [rbp + 0x67]
lea r9, [rbp + 0x77]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov r8, r15
mov edx, edi
mov qword [rsp + 0x20], r14
mov dword [rbp + 0x67], r11d
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov r11d, dword [rbp + 0x6f]
cmp r11d, 1
jne 0x180003263
mov byte [rbx], r14b
mov r11d, dword [rbp + 0x6f]
cmp r11d, 4
jne 0x180003270
mov byte [rbx], 1
mov r11d, dword [rbp + 0x6f]
cmp r11d, 3
jne 0x18000327d
mov byte [rbx], 2
mov r11d, dword [rbp + 0x6f]
cmp r11d, 2
jne 0x180003286
mov byte [rbx], 3
inc rbx
mov r8, r12
mov rdx, r15
mov rcx, rbx
call fcn.180003540
add rbx, r12
mov r8, r13
mov rcx, rbx
mov rdx, rsi
call fcn.180003540
inc edi
add rbx, r13
cmp edi, dword [rbp + 0x7f]
jae 0x1800032bd
mov esi, dword [rbp + 0x77]
jmp 0x1800031f0
mov rsi, rax
mov rcx, r15
call fcn.180003dd8
mov rcx, rsi
call fcn.180003dd8
mov rdx, qword [rbp - 1]
mov rcx, qword [rbp + 0xf]
mov r8d, 0x42
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov r15, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xd0]
mov r14, rax
mov rax, r14
add rsp, 0xd8
pop r14
pop rbp
ret