Function at 0x180054c30
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x378]
sub rsp, 0x460
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rbp + 0x358], rax
xor r15d, r15d
mov ebx, r15d
mov dword [rsp + 0x30], ebx
call fcn.180027a70
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
test eax, eax
jne 0x180054c90
lea eax, [r15 + 1]
jmp 0x18005582a
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x34], r15d
mov dword [rsp + 0x38], 0x800
lea rdx, str.QJjheDPGgIenLVBAppRkYQ7gtgBk56wm2abzh0EPCWkRC3ClLA5unw
lea rcx, [rbp + 0x258]
call fcn.18005e5e0
nop
lea rdx, [rbp + 0x258]
cmp qword [rbp + 0x270], 8
cmovae rdx, qword [rbp + 0x258]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
lea r8, str.IE_Lock_Manual
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov edi, eax
mov r14, 0xffffffffffffffff
test eax, eax
je 0x180054f8d
call fcn.18006eac0
mov r8, qword [rax]
lea edx, [r14 + 2]
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x180054ea8
movdqa xmm0, xmmword [0x180100240]
movdqu xmmword [rbp + 0x2e8], xmm0
mov byte [rbp + 0x2d8], 0
lea r8d, [r14 + 0x5d]
lea rdx, str.d:jenkins.jenkinsworkspacelib_commoncomputerz12hookhomepage_normalmonitor3_6_0wnd.cpp
lea rcx, [rbp + 0x2d8]
call fcn.18000c340
nop
movdqa xmm0, xmmword [0x180100240]
movdqu xmmword [rbp + 0x288], xmm0
mov byte [rbp + 0x278], 0
lea r8d, [r14 + 4]
lea rdx, [0x1800fffb0]
lea rcx, [rbp + 0x278]
call fcn.18000c340
nop
call fcn.18006eac0
mov rsi, rax
mov edx, edi
lea rcx, [rbp - 0x80]
call fcn.18006e9b0
mov rbx, rax
lea r9d, [r14 + 0x57]
lea r8, [rbp + 0x2d8]
lea rdx, [rbp + 0x278]
lea rcx, [rbp - 0x60]
call fcn.180008550
mov rdi, rax
mov rcx, qword [rbx]
lea rdx, [0x1800ffe98]
test rcx, rcx
cmovne rdx, rcx
mov rcx, rax
call fcn.180007240
mov r8, qword [rsi]
mov rdx, rdi
mov rcx, rsi
call qword [r8 + 0x38]
nop
lea rcx, [rbp - 0x60]
call fcn.180009580
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180054e0b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x290]
cmp rdx, 0x10
jb 0x180054e4c
inc rdx
mov rcx, qword [rbp + 0x278]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180054e47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180055862
call fcn.1800965cc
movdqa xmm0, xmmword [0x180100240]
movdqu xmmword [rbp + 0x288], xmm0
mov byte [rbp + 0x278], 0
mov rdx, qword [rbp + 0x2f0]
cmp rdx, 0x10
jb 0x180054ea4
inc rdx
mov rcx, qword [rbp + 0x2d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180054e9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180055868
call fcn.1800965cc
mov ebx, dword [rsp + 0x30]
lea rdx, str.QJjheDPGgIfLdCr7I0tfzqOU6dJLx7D
lea rcx, [rbp + 0x338]
call fcn.18005e5e0
mov rdi, rax
lea rax, [rbp + 0x258]
cmp rax, rdi
je 0x180054efb
lea rcx, [rbp + 0x258]
call fcn.18000bef0
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x258], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x268], xmm1
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
mov rdx, qword [rbp + 0x350]
cmp rdx, 8
jb 0x180054f41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x338]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180054f3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005586e
call fcn.1800965cc
lea rdx, [rbp + 0x258]
cmp qword [rbp + 0x270], 8
cmovae rdx, qword [rbp + 0x258]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
lea r8, str.IE_Lock_Manual
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1800557e5
lea r15, [0x1801016dc]
lea rsi, str.safelock
cmp dword [rsp + 0x34], 1
jne 0x1800550ab
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x180055874
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
cmp r15, 0x10000
jae 0x180054fdf
movzx edx, r15w
lea rcx, [rsp + 0x48]
call fcn.18000b100
jmp 0x180054ffe
mov rax, r14
inc rax
cmp word [r15 + rax*2], 0
jne 0x180054fe2
mov r8d, eax
mov rdx, r15
lea rcx, [rsp + 0x48]
call fcn.18000b4d0
nop
mov dword [rsp + 0x30], 1
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x18005587f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
cmp rsi, 0x10000
jae 0x18005503e
movzx edx, si
lea rcx, [rsp + 0x40]
call fcn.18000b100
jmp 0x18005505c
mov rax, r14
inc rax
cmp word [rsi + rax*2], 0
jne 0x180055041
mov r8d, eax
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.18000b4d0
nop
mov dword [rsp + 0x30], 3
call fcn.180027a70
mov r10, qword [rax]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x78]
mov rcx, rax
call qword [r10 + 0x10]
mov ebx, 7
mov dword [rsp + 0x30], ebx
mov rcx, qword [rax]
movzx eax, word [rcx]
cmp ax, word [0x1801016dc]
jne 0x1800550ab
movzx eax, word [rcx + 2]
cmp ax, word [0x1801016de]
jne 0x1800550ab
mov dil, 1
jmp 0x1800550ae
xor dil, dil
test bl, 4
je 0x1800550dc
and ebx, 0xfffffffb
mov dword [rsp + 0x30], ebx
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800550d8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov ebx, dword [rsp + 0x30]
test bl, 2
je 0x18005510b
and ebx, 0xfffffffd
mov dword [rsp + 0x30], ebx
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180055107
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov ebx, dword [rsp + 0x30]
test bl, 1
je 0x18005513a
and ebx, 0xfffffffe
mov dword [rsp + 0x30], ebx
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180055136
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov ebx, dword [rsp + 0x30]
test dil, dil
je 0x1800553c7
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x18005588a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, [0x180101090]
cmp rdx, 0x10000
jae 0x180055182
movzx edx, dx
lea rcx, [rsp + 0x58]
call fcn.18000b100
jmp 0x18005519d
mov rax, r14
inc rax
cmp word [rdx + rax*2], 0
jne 0x180055185
mov r8d, eax
lea rcx, [rsp + 0x58]
call fcn.18000b4d0
nop
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x180055895
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
cmp rsi, 0x10000
jae 0x1800551d5
movzx edx, si
lea rcx, [rsp + 0x50]
call fcn.18000b100
jmp 0x1800551fb
mov rax, r14
nop dword [rax + rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x1800551e0
mov r8d, eax
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.18000b4d0
nop
call fcn.180027a70
mov r9, qword [rax]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [r9 + 8]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180055235
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x180055253
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
call fcn.18006eac0
mov r9, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r9 + 0x10]
cmp al, 1
jne 0x1800557df
movdqa xmm0, xmmword [0x180100240]
movdqu xmmword [rbp + 0x308], xmm0
mov byte [rbp + 0x2f8], 0
mov r8d, 0x5c
lea rdx, str.d:jenkins.jenkinsworkspacelib_commoncomputerz12hookhomepage_normalmonitor3_6_0wnd.cpp
lea rcx, [rbp + 0x2f8]
call fcn.18000c340
nop
movdqa xmm0, xmmword [0x180100240]
movdqu xmmword [rbp + 0x2a8], xmm0
mov byte [rbp + 0x298], 0
mov r8d, 3
lea rdx, [0x1800fffb0]
lea rcx, [rbp + 0x298]
call fcn.18000c340
nop
call fcn.18006eac0
mov rdi, rax
mov r9d, 0x60
lea r8, [rbp + 0x2f8]
lea rdx, [rbp + 0x298]
lea rcx, [rbp + 0x88]
call fcn.180008550
mov rbx, rax
lea rdx, str.safelock_1
mov rcx, rax
call fcn.180009410
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
nop
lea rcx, [rbp + 0x88]
call fcn.180009580
nop
mov rdx, qword [rbp + 0x2b0]
cmp rdx, 0x10
jb 0x180055367
inc rdx
mov rcx, qword [rbp + 0x298]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180055362
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800558a0
call fcn.1800965cc
movdqa xmm0, xmmword [0x180100240]
movdqu xmmword [rbp + 0x2a8], xmm0
mov byte [rbp + 0x298], 0
mov rdx, qword [rbp + 0x310]
cmp rdx, 0x10
jb 0x1800557df
inc rdx
mov rcx, qword [rbp + 0x2f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800557da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005585c
jmp 0x1800557da
cmp dword [rsp + 0x34], 0
jne 0x1800554d9
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x1800558a6
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
cmp r15, 0x10000
jae 0x18005540b
movzx edx, r15w
lea rcx, [rsp + 0x68]
call fcn.18000b100
jmp 0x18005542c
mov rax, r14
nop
inc rax
cmp word [r15 + rax*2], 0
jne 0x180055410
mov r8d, eax
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.18000b4d0
nop
or ebx, 8
mov dword [rsp + 0x30], ebx
mov edi, ebx
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x1800558b1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
cmp rsi, 0x10000
jae 0x18005546d
movzx edx, si
lea rcx, [rsp + 0x60]
call fcn.18000b100
jmp 0x18005548b
mov rax, r14
inc rax
cmp word [rsi + rax*2], 0
jne 0x180055470
mov r8d, eax
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.18000b4d0
nop
or ebx, 0x10
mov dword [rsp + 0x30], ebx
call fcn.180027a70
mov r10, qword [rax]
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [r10 + 0x10]
mov ebx, edi
or ebx, 0x30
mov dword [rsp + 0x30], ebx
mov rcx, qword [rax]
movzx eax, word [rcx]
cmp ax, word [0x180101090]
jne 0x1800554d9
movzx eax, word [rcx + 2]
cmp ax, word [0x180101092]
jne 0x1800554d9
mov dil, 1
jmp 0x1800554dc
xor dil, dil
test bl, 0x20
je 0x18005550a
and ebx, 0xffffffdf
mov dword [rsp + 0x30], ebx
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180055506
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov ebx, dword [rsp + 0x30]
test bl, 0x10
je 0x180055539
and ebx, 0xffffffef
mov dword [rsp + 0x30], ebx
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180055535
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov ebx, dword [rsp + 0x30]
test bl, 8
je 0x18005555d
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18005555d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test dil, dil
je 0x1800557df
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x1800558bc
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
cmp r15, 0x10000
jae 0x18005559f
movzx edx, r15w
lea rcx, [rsp + 0x78]
call fcn.18000b100
jmp 0x1800555be
mov rax, r14
inc rax
cmp word [r15 + rax*2], 0
jne 0x1800555a2
mov r8d, eax
mov rdx, r15
lea rcx, [rsp + 0x78]
call fcn.18000b4d0
nop
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x1800558c7
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
cmp rsi, 0x10000
jae 0x1800555f6
movzx edx, si
lea rcx, [rsp + 0x70]
call fcn.18000b100
jmp 0x18005561b
mov rax, r14
nop dword [rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x180055600
mov r8d, eax
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.18000b4d0
nop
call fcn.180027a70
mov r9, qword [rax]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [r9 + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180055655
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x180055673
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
call fcn.18006eac0
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x1800557df
movdqa xmm0, xmmword [0x180100240]
movdqu xmmword [rbp + 0x328], xmm0
mov byte [rbp + 0x318], 0
mov r8d, 0x5c
lea rdx, str.d:jenkins.jenkinsworkspacelib_commoncomputerz12hookhomepage_normalmonitor3_6_0wnd.cpp
lea rcx, [rbp + 0x318]
call fcn.18000c340
nop
movdqa xmm0, xmmword [0x180100240]
movdqu xmmword [rbp + 0x2c8], xmm0
mov byte [rbp + 0x2b8], 0
mov r8d, 3
lea rdx, [0x1800fffb0]
lea rcx, [rbp + 0x2b8]
call fcn.18000c340
nop
call fcn.18006eac0
mov rdi, rax
mov r9d, 0x64
lea r8, [rbp + 0x318]
lea rdx, [rbp + 0x2b8]
lea rcx, [rbp + 0x170]
call fcn.180008550
mov rbx, rax
lea rdx, str.safelock_0
mov rcx, rax
call fcn.180009410
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
nop
lea rcx, [rbp + 0x170]
call fcn.180009580
nop
mov rdx, qword [rbp + 0x2d0]
cmp rdx, 0x10
jb 0x180055787
inc rdx
mov rcx, qword [rbp + 0x2b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180055782
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800558d2
call fcn.1800965cc
movdqa xmm0, xmmword [0x180100240]
movdqu xmmword [rbp + 0x2c8], xmm0
mov byte [rbp + 0x2b8], 0
mov rdx, qword [rbp + 0x330]
cmp rdx, 0x10
jb 0x1800557df
inc rdx
mov rcx, qword [rbp + 0x318]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800557da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800558d8
call fcn.1800965cc
mov r15d, 1
mov rdx, qword [rbp + 0x270]
cmp rdx, 8
jb 0x180055827
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x258]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180055822
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180055856
call fcn.1800965cc
mov eax, r15d
mov rcx, qword [rbp + 0x358]
xor rcx, rsp
call fcn.180096b80
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1800c9338
nop
call fcn.1800c9338
nop
call fcn.1800c9338
nop
call fcn.1800c9338
int3
call fcn.1800c9338
int3
mov ecx, 0x80004005
call fcn.180009b50
nop
mov ecx, 0x80004005
call fcn.180009b50
nop
mov ecx, 0x80004005
call fcn.180009b50
nop
mov ecx, 0x80004005
call fcn.180009b50
nop
call fcn.1800c9338
nop
mov ecx, 0x80004005
call fcn.180009b50
nop
mov ecx, 0x80004005
call fcn.180009b50
nop
mov ecx, 0x80004005
call fcn.180009b50
nop
mov ecx, 0x80004005
call fcn.180009b50
nop
call fcn.1800c9338
nop
call fcn.1800c9338
int3