Function at 0x180005640
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1c0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1801b8080]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rsi, rdx
mov r15, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdx
xor r12d, r12d
mov dword [rsp + 0x34], r12d
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r12w
xor r8d, r8d
lea rdx, [0x180160958]
lea rcx, [rsp + 0x78]
call fcn.1800049a0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rsp + 0x68], xmm1
mov word [rsp + 0x58], r12w
lea r8d, [r12 + 6]
lea rdx, str.CLSID_
lea rcx, [rsp + 0x58]
call fcn.1800049a0
nop
mov r9, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005703
mov r9, qword [rsi]
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x18000574b
lea rdi, [rdx + rcx]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp r8, 8
cmovae rbx, qword [rsp + 0x58]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.18010bb50
mov word [rbx + rdi*2], r12w
jmp 0x18000575a
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x58]
call fcn.18000d530
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x48]
call fcn.18000cb60
nop
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov rax, rdx
sub rax, rcx
cmp rax, 0xf
jb 0x1800057af
lea rdi, [rcx + 0xf]
mov qword [rbp - 0x38], rdi
lea rbx, [rbp - 0x48]
cmp rdx, 8
cmovae rbx, qword [rbp - 0x48]
lea rcx, [rbx + rcx*2]
mov r8d, 0x1e
lea rdx, str.InProcServer32
call fcn.18010bb50
mov word [rbx + rdi*2], r12w
jmp 0x1800057cd
mov qword [rsp + 0x20], 0xf
lea r9, str.InProcServer32
mov edx, 0xf
lea rcx, [rbp - 0x48]
call fcn.18000d530
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x180005818
lea rdi, [rcx + 6]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
mov r8d, 0xc
lea rdx, str.Shell
call fcn.18010bb50
mov word [rbx + rdi*2], r12w
jmp 0x180005837
mov qword [rsp + 0x20], 6
lea r9, str.Shell
mov edx, 6
lea rcx, [rsp + 0x58]
call fcn.18000d530
cmp qword [rsi + 0x10], 0
jne 0x18000595d
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], 7
mov word [r15], r12w
xor r8d, r8d
lea rdx, [0x180160958]
mov rcx, r15
call fcn.1800049a0
mov dword [rsp + 0x34], 1
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x1800058ac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800058a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000614c
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r12w
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x180005900
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800058fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006152
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x1800060f8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800060f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006146
jmp 0x1800060f3
mov qword [rsp + 0x38], r12
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov r14, 0xffffffffffffffff
test eax, eax
jne 0x180005c76
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp - 0x20]
call fcn.18010bfb0
mov dword [rsp + 0x30], 0xc6
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x180005aa6
cmp word [rbp - 0x20], ax
je 0x180005aa6
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180005a1e
lea rdi, [rcx + 1]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
lea r8d, [r14 + 3]
lea rdx, [0x180160a38]
call fcn.18010bb50
mov word [rbx + rdi*2], r12w
jmp 0x180005a3d
mov qword [rsp + 0x20], 1
lea r9, [0x180160a38]
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.18000d530
lea rax, [rbp - 0x20]
mov rdx, r14
inc rdx
cmp word [rax + rdx*2], 0
jne 0x180005a44
mov rcx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x180005a93
lea rdi, [rdx + rcx]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp r8, 8
cmovae rbx, qword [rsp + 0x58]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
lea rdx, [rbp - 0x20]
call fcn.18010bb50
mov word [rbx + rdi*2], r12w
jmp 0x180005aa6
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x20]
lea rcx, [rsp + 0x58]
call fcn.18000d530
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
lea rax, [rbp - 0x20]
mov r8, r14
inc r8
cmp word [rax + r8*2], 0
jne 0x180005ad1
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x68]
call fcn.1800049a0
nop
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp qword [rbp - 0x58], 0
ja 0x180005b53
cmp rax, 0xd
jb 0x180005b3c
lea rdi, [rcx + 0xd]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
mov r8d, 0x1a
lea rdx, str.opencommand
call fcn.18010bb50
mov word [rbx + rdi*2], r12w
jmp 0x180005bad
mov qword [rsp + 0x20], 0xd
lea r9, str.opencommand
mov edx, 0xd
jmp 0x180005ba3
cmp rax, 8
jb 0x180005b8e
lea rdi, [rcx + 8]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
mov r8d, 0x10
lea rdx, str.command
call fcn.18010bb50
mov word [rbx + rdi*2], r12w
jmp 0x180005bad
mov qword [rsp + 0x20], 8
lea r9, str.command
mov edx, 8
lea rcx, [rsp + 0x58]
call fcn.18000d530
mov ecx, 0x802
call fcn.1800ed534
mov rbx, rax
mov dword [rsp + 0x30], 0x800
test rax, rax
je 0x180005c25
xor edx, edx
mov r8d, 0x802
mov rcx, rax
call fcn.18010bfb0
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
lea r9, [rsp + 0x30]
mov r8, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x180005c1c
mov r8, r14
inc r8
cmp word [rbx + r8*2], 0
jne 0x180005c04
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.1800049a0
mov rcx, rbx
call fcn.1800ece80
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x180005c65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005c60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006158
call fcn.1800ece80
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
cmp qword [rbp - 0x78], 0
ja 0x180005d00
mov ecx, 0x802
call fcn.1800ed534
mov rbx, rax
mov dword [rsp + 0x30], 0x800
test rax, rax
je 0x180005cf5
xor edx, edx
mov r8d, 0x802
mov rcx, rax
call fcn.18010bfb0
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
lea r9, [rsp + 0x30]
mov r8, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x180005ced
mov r8, r14
inc r8
cmp word [rbx + r8*2], 0
jne 0x180005cd5
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.1800049a0
mov rcx, rbx
call fcn.1800ece80
cmp qword [rbp - 0x78], 0
jbe 0x180005eb4
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005d0d
mov rcx, qword [rsi]
lea rdx, str.2559A1F0_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005ea0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005d30
mov rcx, qword [rsi]
lea rdx, str.2559A1F1_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005ea0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005d53
mov rcx, qword [rsi]
lea rdx, str.2559A1F2_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005ea0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005d76
mov rcx, qword [rsi]
lea rdx, str.2559A1F3_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005ea0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005d99
mov rcx, qword [rsi]
lea rdx, str.2559A1F5_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005ea0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005dbc
mov rcx, qword [rsi]
lea rdx, str.2559A1F6_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005ea0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005ddf
mov rcx, qword [rsi]
lea rdx, str.2559A1F7_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005ea0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005e02
mov rcx, qword [rsi]
lea rdx, str.871C5380_42A0_1069_A2EA_08002B30309D
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005ea0
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str.http:
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005ea0
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str.https:
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005ea0
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str.www.
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005ea0
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str..com
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180005eb4
xor r8d, r8d
lea rdx, [0x180160958]
lea rcx, [rsp + 0x78]
call fcn.1800049a0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005ec1
mov rcx, qword [rsi]
lea rdx, str.2559A1F4_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180005fe7
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp - 0x58], xmm1
mov word [rbp - 0x68], r12w
mov ecx, 0x802
call fcn.1800ed534
mov rbx, rax
mov dword [rsp + 0x30], 0x800
test rax, rax
je 0x180005f62
xor edx, edx
mov r8d, 0x802
mov rcx, rax
call fcn.18010bfb0
lea r9, [rsp + 0x30]
mov r8, rbx
lea rdx, str.SoftwareClientsStartMenuInternet
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x180005f5a
nop dword [rax + rax]
inc r14
cmp word [rbx + r14*2], 0
jne 0x180005f40
mov r8, r14
mov rdx, rbx
lea rcx, [rbp - 0x68]
call fcn.1800049a0
mov rcx, rbx
call fcn.1800ece80
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
lea rdx, str.2345Explorer.exe
call fcn.18010eb30
test eax, eax
jne 0x180005f95
xor r8d, r8d
lea rdx, [0x180160958]
lea rcx, [rsp + 0x78]
call fcn.1800049a0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x180005fd5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005fd0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000615e
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp - 0x58], xmm0
mov word [rbp - 0x68], r12w
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [r15 + 0x10], xmm1
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r12w
mov dword [rsp + 0x34], 1
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x180006053
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000604e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006164
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r12w
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1800060a7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800060a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000616a
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x1800060f8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800060f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006140
call fcn.1800ece80
mov word [rsp + 0x78], r12w
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r12
mov rcx, rsi
call fcn.180004910
mov rax, r15
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.1800ece20
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.18010e944
int3
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
int3
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
int3