Function at 0x18000bae0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov r14, r9
mov r15, r8
mov r12, rcx
xor esi, esi
mov dword [rax - 0x80], esi
mov qword [rax - 0x78], rsi
mov dword [rax - 0x70], esi
mov rcx, qword [r9]
sub rcx, 0x18
call fcn.180005340
add rax, 0x18
mov qword [r12], rax
mov r13d, 1
mov dword [rsp + 0x38], r13d
mov rax, qword [r15]
cmp dword [rax - 0x10], esi
je 0x18000bb8f
mov r8, r15
lea rdx, [0x180056c08]
lea rcx, [rsp + 0x58]
call fcn.180001a70
nop
mov rdx, rax
mov rcx, r15
call fcn.18000e720
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000bb92
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x18000bb92
or ebx, 0xffffffff
lea rcx, [rsp + 0x68]
call fcn.18000ae30
nop
mov r8, r15
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1800018f0
mov qword [rsp + 0x50], rsi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x18000bbeb
mov edi, esi
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], esi
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000bc0b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000bc2a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test edi, edi
jne 0x18000bd67
mov rax, qword [r12]
sub r13d, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, 0x3fff
or eax, r13d
jge 0x18000bc54
mov edx, 0x3fff
mov rcx, r12
call fcn.1800059e0
mov r14, qword [r12]
mov dword [rsp + 0x30], 0x7ffe
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, qword [rsp + 0xc8]
mov rdx, qword [rdx]
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r13d, eax
test eax, eax
jne 0x18000bcd9
mov eax, dword [rsp + 0x34]
cmp eax, 1
je 0x18000bcad
cmp eax, 2
je 0x18000bcad
mov r13d, 0xd
jmp 0x18000bcd9
test r14, r14
je 0x18000bcd6
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x18000bcd2
test al, 1
jne 0x18000bcca
shr rax, 1
cmp word [r14 + rax*2 - 2], 0
je 0x18000bcd6
mov r13d, 0xd
jmp 0x18000bcd9
mov word [r14], si
mov r13d, esi
mov rcx, qword [r12]
test rcx, rcx
jne 0x18000bce6
mov eax, esi
jmp 0x18000bcf3
movsxd rdx, dword [rcx - 0xc]
call fcn.180038e3c
test eax, eax
js 0x18000bd22
mov rcx, qword [r12]
cmp eax, dword [rcx - 0xc]
jg 0x18000bd22
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [r12]
mov word [rax + rcx*2], si
test r13d, r13d
je 0x18000bd20
mov rdx, qword [rsp + 0xd8]
mov rcx, r12
call fcn.18000e720
nop
jmp 0x18000bd47
mov ecx, 0x80070057
call fcn.180005a40
nop
xor esi, esi
or ebx, 0xffffffff
mov r15, qword [rsp + 0xd0]
mov r12, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0x40]
test rdi, rdi
je 0x18000bd6e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, rsi
mov qword [rsp + 0x40], rsi
mov r14, qword [rsp + 0xd8]
jmp 0x18000bd76
mov rdi, qword [rsp + 0x40]
jmp 0x18000bd76
mov r14, qword [rsp + 0xd8]
test rdi, rdi
je 0x18000bd85
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rsp + 0xc8]
mov rdx, qword [rax]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000bdab
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r15]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000bdc9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x18000bde4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r12
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret