Function at 0x180007150
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x2f]
sub rsp, 0xb8
mov rsi, rcx
lea rdx, [rcx + 0x48]
mov rcx, qword [rcx + 0x40]
lea rax, [rbp - 0x19]
mov r9d, 0xf003f
xor r8d, r8d
xor ebx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800073ec
mov rcx, qword [rbp - 0x19]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
lea rax, [rbp - 0x29]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x25]
xor edx, edx
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x1800071f6
xor eax, eax
add rsp, 0xb8
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, dword [rbp + 0x77]
mov ecx, dword [rbp + 0x67]
lea r12d, [rax + rax + 6]
test ecx, ecx
je 0x1800073ec
cmp r12d, 1
jbe 0x1800073ec
mov eax, r12d
imul eax, ecx
mov ecx, 0x40
add eax, 0xe
mov r13d, eax
mov edx, eax
mov qword [rbp + 7], r13
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1800071e4
mov r8d, r13d
xor edx, edx
mov rcx, rax
mov qword [rsp + 0xb0], r14
call fcn.18000b160
mov byte [rdi], bl
mov eax, dword [rbp + 0x67]
mov dword [rbp - 5], r12d
mov ecx, r12d
mov dword [rbp - 9], eax
mov rax, qword [rbp - 9]
mov qword [rdi + 1], rax
mov eax, dword [rbp - 1]
mov dword [rdi + 9], eax
movzx eax, byte [rbp + 3]
mov byte [rdi + 0xd], al
call fcn.1800082ac
mov r13d, ebx
mov r14, rax
mov qword [rbp - 9], rax
cmp dword [rbp + 0x67], ebx
jbe 0x1800073bc
mov qword [rsp + 0xa8], r15
mov r15d, ebx
nop word [rax + rax]
mov r8d, r12d
xor edx, edx
mov rcx, r14
call fcn.18000b160
mov rcx, qword [rbp - 0x19]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea r9, [rbp + 0x6f]
mov r8, r14
mov edx, r13d
mov qword [rsp + 0x28], rbx
mov dword [rbp + 0x6f], r12d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rdx, qword [rbp - 9]
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 0x11]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rbp - 0x11], rbx
mov r14d, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000730c
mov rax, qword [rbp - 0x11]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsi + 0x38]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x18000735a
lea rcx, [0x1800199e8]
call fcn.180009090
cmp dword [rbp + 0x7f], ebx
je 0x18000736e
mov r14d, 1
lea rcx, [0x1800199f0]
jmp 0x180007375
lea rcx, [0x1800199f4]
call fcn.180009090
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [rbp + 0x6f]
mov r11d, r15d
mov dword [r11 + rdi + 0xd], r14d
mov r14, qword [rbp - 9]
lea rcx, [r11 + rdi + 0x11]
mov rdx, r14
add r8, r8
call fcn.180008300
inc r13d
add r15d, r12d
cmp r13d, dword [rbp + 0x67]
jb 0x1800072a0
mov r15, qword [rsp + 0xa8]
mov rcx, r14
call fcn.180008dd0
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp + 7]
mov r8d, 0x42
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov r14, qword [rsp + 0xb0]
mov rbx, rax
mov rax, rbx
add rsp, 0xb8
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret