Function at 0x1800055c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1c0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1801b8080]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rsi, rdx
mov r15, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdx
xor r12d, r12d
mov dword [rsp + 0x34], r12d
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r12w
xor r8d, r8d
lea rdx, [0x180160958]
lea rcx, [rsp + 0x78]
call fcn.180004930
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rsp + 0x68], xmm1
mov word [rsp + 0x58], r12w
lea r8d, [r12 + 6]
lea rdx, str.CLSID_
lea rcx, [rsp + 0x58]
call fcn.180004930
nop
mov r9, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005683
mov r9, qword [rsi]
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1800056cb
lea rdi, [rdx + rcx]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp r8, 8
cmovae rbx, qword [rsp + 0x58]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.18010b9f0
mov word [rbx + rdi*2], r12w
jmp 0x1800056da
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x58]
call fcn.18000d4b0
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x48]
call fcn.18000cae0
nop
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov rax, rdx
sub rax, rcx
cmp rax, 0xf
jb 0x18000572f
lea rdi, [rcx + 0xf]
mov qword [rbp - 0x38], rdi
lea rbx, [rbp - 0x48]
cmp rdx, 8
cmovae rbx, qword [rbp - 0x48]
lea rcx, [rbx + rcx*2]
mov r8d, 0x1e
lea rdx, str.InProcServer32
call fcn.18010b9f0
mov word [rbx + rdi*2], r12w
jmp 0x18000574d
mov qword [rsp + 0x20], 0xf
lea r9, str.InProcServer32
mov edx, 0xf
lea rcx, [rbp - 0x48]
call fcn.18000d4b0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x180005798
lea rdi, [rcx + 6]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
mov r8d, 0xc
lea rdx, str.Shell
call fcn.18010b9f0
mov word [rbx + rdi*2], r12w
jmp 0x1800057b7
mov qword [rsp + 0x20], 6
lea r9, str.Shell
mov edx, 6
lea rcx, [rsp + 0x58]
call fcn.18000d4b0
cmp qword [rsi + 0x10], 0
jne 0x1800058dd
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], 7
mov word [r15], r12w
xor r8d, r8d
lea rdx, [0x180160958]
mov rcx, r15
call fcn.180004930
mov dword [rsp + 0x34], 1
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x18000582c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005827
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800060cc
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r12w
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x180005880
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000587b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800060d2
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x180006078
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006073
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800060c6
jmp 0x180006073
mov qword [rsp + 0x38], r12
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov r14, 0xffffffffffffffff
test eax, eax
jne 0x180005bf6
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp - 0x20]
call fcn.18010be50
mov dword [rsp + 0x30], 0xc6
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x180005a26
cmp word [rbp - 0x20], ax
je 0x180005a26
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x18000599e
lea rdi, [rcx + 1]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
lea r8d, [r14 + 3]
lea rdx, [0x180160a38]
call fcn.18010b9f0
mov word [rbx + rdi*2], r12w
jmp 0x1800059bd
mov qword [rsp + 0x20], 1
lea r9, [0x180160a38]
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.18000d4b0
lea rax, [rbp - 0x20]
mov rdx, r14
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1800059c4
mov rcx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x180005a13
lea rdi, [rdx + rcx]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp r8, 8
cmovae rbx, qword [rsp + 0x58]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
lea rdx, [rbp - 0x20]
call fcn.18010b9f0
mov word [rbx + rdi*2], r12w
jmp 0x180005a26
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x20]
lea rcx, [rsp + 0x58]
call fcn.18000d4b0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
lea rax, [rbp - 0x20]
mov r8, r14
inc r8
cmp word [rax + r8*2], 0
jne 0x180005a51
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x68]
call fcn.180004930
nop
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp qword [rbp - 0x58], 0
ja 0x180005ad3
cmp rax, 0xd
jb 0x180005abc
lea rdi, [rcx + 0xd]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
mov r8d, 0x1a
lea rdx, str.opencommand
call fcn.18010b9f0
mov word [rbx + rdi*2], r12w
jmp 0x180005b2d
mov qword [rsp + 0x20], 0xd
lea r9, str.opencommand
mov edx, 0xd
jmp 0x180005b23
cmp rax, 8
jb 0x180005b0e
lea rdi, [rcx + 8]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
mov r8d, 0x10
lea rdx, str.command
call fcn.18010b9f0
mov word [rbx + rdi*2], r12w
jmp 0x180005b2d
mov qword [rsp + 0x20], 8
lea r9, str.command
mov edx, 8
lea rcx, [rsp + 0x58]
call fcn.18000d4b0
mov ecx, 0x802
call fcn.1800ed3d4
mov rbx, rax
mov dword [rsp + 0x30], 0x800
test rax, rax
je 0x180005ba5
xor edx, edx
mov r8d, 0x802
mov rcx, rax
call fcn.18010be50
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
lea r9, [rsp + 0x30]
mov r8, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x180005b9c
mov r8, r14
inc r8
cmp word [rbx + r8*2], 0
jne 0x180005b84
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.180004930
mov rcx, rbx
call fcn.1800ecd20
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x180005be5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005be0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800060d8
call fcn.1800ecd20
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
cmp qword [rbp - 0x78], 0
ja 0x180005c80
mov ecx, 0x802
call fcn.1800ed3d4
mov rbx, rax
mov dword [rsp + 0x30], 0x800
test rax, rax
je 0x180005c75
xor edx, edx
mov r8d, 0x802
mov rcx, rax
call fcn.18010be50
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
lea r9, [rsp + 0x30]
mov r8, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x180005c6d
mov r8, r14
inc r8
cmp word [rbx + r8*2], 0
jne 0x180005c55
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.180004930
mov rcx, rbx
call fcn.1800ecd20
cmp qword [rbp - 0x78], 0
jbe 0x180005e34
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005c8d
mov rcx, qword [rsi]
lea rdx, str.2559A1F0_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005e20
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005cb0
mov rcx, qword [rsi]
lea rdx, str.2559A1F1_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005e20
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005cd3
mov rcx, qword [rsi]
lea rdx, str.2559A1F2_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005e20
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005cf6
mov rcx, qword [rsi]
lea rdx, str.2559A1F3_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005e20
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005d19
mov rcx, qword [rsi]
lea rdx, str.2559A1F5_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005e20
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005d3c
mov rcx, qword [rsi]
lea rdx, str.2559A1F6_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005e20
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005d5f
mov rcx, qword [rsi]
lea rdx, str.2559A1F7_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005e20
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005d82
mov rcx, qword [rsi]
lea rdx, str.871C5380_42A0_1069_A2EA_08002B30309D
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005e20
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str.http:
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005e20
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str.https:
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005e20
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str.www.
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005e20
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str..com
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180005e34
xor r8d, r8d
lea rdx, [0x180160958]
lea rcx, [rsp + 0x78]
call fcn.180004930
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005e41
mov rcx, qword [rsi]
lea rdx, str.2559A1F4_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180005f67
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp - 0x58], xmm1
mov word [rbp - 0x68], r12w
mov ecx, 0x802
call fcn.1800ed3d4
mov rbx, rax
mov dword [rsp + 0x30], 0x800
test rax, rax
je 0x180005ee2
xor edx, edx
mov r8d, 0x802
mov rcx, rax
call fcn.18010be50
lea r9, [rsp + 0x30]
mov r8, rbx
lea rdx, str.SoftwareClientsStartMenuInternet
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x180005eda
nop dword [rax + rax]
inc r14
cmp word [rbx + r14*2], 0
jne 0x180005ec0
mov r8, r14
mov rdx, rbx
lea rcx, [rbp - 0x68]
call fcn.180004930
mov rcx, rbx
call fcn.1800ecd20
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
lea rdx, str.2345Explorer.exe
call fcn.18010e9d0
test eax, eax
jne 0x180005f15
xor r8d, r8d
lea rdx, [0x180160958]
lea rcx, [rsp + 0x78]
call fcn.180004930
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x180005f55
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005f50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800060de
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp - 0x58], xmm0
mov word [rbp - 0x68], r12w
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [r15 + 0x10], xmm1
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r12w
mov dword [rsp + 0x34], 1
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x180005fd3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005fce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800060e4
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r12w
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x180006027
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006022
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800060ea
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x180006078
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006073
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800060c0
call fcn.1800ecd20
mov word [rsp + 0x78], r12w
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r12
mov rcx, rsi
call fcn.1800048a0
mov rax, r15
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.1800eccc0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.18010e7e4
int3
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
int3
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
int3