Function at 0x164faf7f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov rax, qword [0x16514b200]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, qword [rbp + 0x67]
mov qword [rbp + 0xf], r15
mov rsi, qword [rbp + 0x6f]
mov qword [rbp - 0x11], rsi
mov r14, qword [rbp + 0x77]
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov qword [rbp - 9], r12
mov qword [rbp - 1], r12
mov qword [rbp + 7], r12
mov ecx, 0x1000
call fcn.164e581f0
mov qword [rbp - 9], rax
lea rbx, [rax + 0x1000]
mov qword [rbp + 7], rbx
xor edx, edx
mov r8d, 0x1000
mov rcx, rax
call fcn.165040130
mov qword [rbp - 1], rbx
mov rcx, qword [rbp - 9]
nop
sub rbx, rcx
mov eax, ebx
cmp rax, rbx
jne 0x164fafa07
mov dword [rbp + 0xf], ebx
mov rdx, qword [r14]
mov r8, qword [r14 + 8]
sub r8, rdx
sar r8, 5
mov eax, r8d
cmp rax, r8
jne 0x164faf9e0
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
mov r9, rcx
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryMultipleValuesW]
cmp eax, 0xea
jne 0x164faf928
mov r8d, dword [rbp + 0xf]
mov rbx, qword [rbp - 1]
mov rdx, rbx
mov rcx, qword [rbp - 9]
sub rdx, rcx
cmp r8, rdx
jae 0x164faf8e8
lea rbx, [r8 + rcx]
mov qword [rbp - 1], rbx
jmp 0x164faf880
jbe 0x164faf880
mov rax, qword [rbp + 7]
sub rax, rcx
cmp r8, rax
jbe 0x164faf90b
mov rdx, r8
lea rcx, [rbp - 9]
call fcn.164e723b0
mov rbx, qword [rbp - 1]
jmp 0x164faf87a
sub r8, rdx
lea rdi, [rbx + r8]
xor edx, edx
mov rcx, rbx
call fcn.165040130
mov rbx, rdi
mov qword [rbp - 1], rbx
jmp 0x164faf87a
lea rcx, str.Cannot_query_multiple_values
mov qword [rbp - 0x39], rcx
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], r12
lea rdx, [rbp - 0x39]
mov ecx, eax
call fcn.164fad870
mov rdx, qword [r14 + 0x10]
mov qword [r14 + 0x10], r12
mov rcx, qword [r14 + 8]
mov qword [r14 + 8], r12
mov rax, qword [r14]
mov qword [r14], r12
mov qword [r15], rax
mov qword [r15 + 8], rcx
mov qword [r15 + 0x10], rdx
mov rdx, qword [rbp + 7]
mov qword [rbp + 7], r12
mov rcx, qword [rbp - 1]
mov qword [rbp - 1], r12
mov rax, qword [rbp - 9]
mov qword [rbp - 9], r12
mov qword [r15 + 0x18], rax
mov qword [r15 + 0x20], rcx
mov qword [r15 + 0x28], rdx
lea rcx, [rbp - 9]
call fcn.164e70120
nop
cmp byte [rsi + 8], 0
jne 0x164faf9a2
mov qword [rsi], r12
mov rcx, qword [rsi]
test rcx, rcx
je 0x164faf9bc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x164faf9bc
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsi], r12
mov rax, r15
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.165001080
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x39]
call fcn.164e588b0
lea rdx, [0x165146ee8]
lea rcx, [rbp - 0x39]
call fcn.165003be0
int3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x39]
call fcn.164e588b0
lea rdx, [0x165146ee8]
lea rcx, [rbp - 0x39]
call fcn.165003be0
int3