Function at 0x1800635c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2a0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov r15, rcx
mov qword [rsp + 0x70], rcx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
call fcn.180025f00
mov rcx, rax
test rax, rax
je 0x180063a0a
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x50], r13
mov dword [rsp + 0x58], r13d
mov qword [rsp + 0x60], r13
mov r9d, 0x201
lea r8, str.SOFTWARE360Safe
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.180022180
lea rsi, [r13 - 1]
test eax, eax
jne 0x1800636dc
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x80]
call fcn.1800abaa0
mov dword [rsp + 0x38], 0x208
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, [0x1800fe79c]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800636dc
mov eax, dword [rsp + 0x44]
dec eax
cmp eax, 1
ja 0x1800636dc
mov ecx, dword [rsp + 0x38]
test ecx, ecx
je 0x1800637d0
test cl, 1
jne 0x1800636dc
mov eax, ecx
shr rax, 1
cmp word [rsp + rax*2 + 0x7e], r13w
je 0x1800637d5
lea r14, [rbx - 0x10]
cmp dword [r14], 0x2c
jne 0x180063935
mov dword [rsp + 0x3c], r13d
lea rcx, [rbx + 0x54]
lea r8, [rsp + 0x3c]
lea rdx, [0x1800fe7a4]
call fcn.18002d350
call fcn.180025f00
mov rcx, rax
test rax, rax
je 0x180063a15
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.180060840
test al, al
jne 0x180063743
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.180063dd0
nop
mov edx, 0x2a
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call fcn.1800612d0
movzx ecx, al
cmp dword [rsp + 0x3c], ecx
jne 0x180063917
lea rcx, [rbx - 0x18]
call fcn.180025a30
add rax, 0x18
mov qword [r15], rax
mov dword [rsp + 0x40], 1
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180063794
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1800637a9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r13
mov dword [rsp + 0x58], r13d
lock xadd dword [rbx - 8], esi
sub esi, 1
jg 0x1800639cc
mov rcx, qword [rbx - 0x18]
mov r8, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [r8 + 8]
jmp 0x1800639cc
mov word [rbp - 0x80], r13w
shr ecx, 1
cmp ecx, 0x2d
jne 0x1800636dc
lea rax, [rbp - 0x80]
mov rdi, rsi
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1800637f0
test edi, edi
jne 0x180063858
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1800636dc
cmp dword [rdx + 0x10], 0
jge 0x18006382c
cmp dword [rbx - 0xc], 0
jl 0x180063a20
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
jmp 0x1800636dc
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180063841
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
jmp 0x1800636dc
mov r12d, dword [rbx - 0x10]
lea r14, [rbp - 0x80]
sub r14, rbx
sar r14, 1
test edi, edi
js 0x180063a2b
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x180063890
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.180025470
mov rbx, qword [rsp + 0x30]
movsxd rax, edi
cmp r14, r12
ja 0x1800638e7
lea rdx, [rbx + r14*2]
lea r14, [rax + rax]
test r14, r14
je 0x180063901
test rdx, rdx
jne 0x1800638bc
call fcn.1800aeaf8
mov dword [rax], 0x16
call fcn.1800aee10
jmp 0x180063901
movsxd rax, dword [rbx - 0xc]
add rax, rax
cmp rax, r14
jae 0x1800638da
call fcn.1800aeaf8
mov dword [rax], 0x22
call fcn.1800aee10
jmp 0x180063901
mov r8, r14
mov rcx, rbx
call fcn.1800ab630
jmp 0x180063901
lea r14, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r14
lea r8, [rbp - 0x80]
mov rcx, rbx
call fcn.1800213f0
cmp edi, dword [rbx - 0xc]
jg 0x180063a36
mov dword [rbx - 0x10], edi
mov word [r14 + rbx], r13w
jmp 0x1800636dc
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180063930
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x30]
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x180063982
cmp dword [rdx + 0x10], 0
jge 0x18006395b
cmp dword [rbx - 0xc], 0
jl 0x1800639ff
mov dword [r14], r13d
mov word [rbx], r13w
jmp 0x180063982
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180063970
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
lea rcx, [rbx - 0x18]
call fcn.180025a30
add rax, 0x18
mov qword [r15], rax
mov dword [rsp + 0x40], 1
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1800639af
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r13
mov dword [rsp + 0x58], r13d
lock xadd dword [rbx - 8], esi
sub esi, 1
jg 0x1800639cc
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + 8]
mov rax, r15
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.18008f850
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.1800220a0
nop
mov ecx, 0x80004005
call fcn.1800220a0
nop
mov ecx, 0x80004005
call fcn.1800220a0
int3
mov ecx, 0x80070057
call fcn.1800220a0
int3
mov ecx, 0x80070057
call fcn.1800220a0
int3
mov ecx, 0x80070057
call fcn.1800220a0
int3