Function at 0x18002c240
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r12
sub rsp, 0x178
mov dword [rax - 0x100], 4
mov dword [rsp + 0x64], 4
mov dword [rsp + 0x5c], 4
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x74], 4
mov dword [rsp + 0x68], 4
mov dword [rsp + 0x58], 4
mov dword [rsp + 0x78], 4
mov dword [rax + 0x20], 4
mov dword [rax - 0x110], 4
mov dword [rax + 0x10], 0x400
mov ecx, 0x2000
call fcn.18002e088
mov qword [rsp + 0xb0], rax
mov ecx, dword [rsp + 0x1a8]
shl rcx, 3
call fcn.18002e088
mov r12, rax
mov qword [rsp + 0x48], rax
mov ecx, dword [rsp + 0x1a8]
shl rcx, 3
call fcn.18002e088
mov rsi, rax
mov qword [rsp + 0x40], rax
lea rax, str.BSCANCOMMON
mov qword [rsp + 0xd0], rax
lea rax, str.BSCANMODERN
mov qword [rsp + 0xe0], rax
lea rax, str.BSCANRARE
mov qword [rsp + 0xc0], rax
lea rax, str.BSCANRAW
mov qword [rsp + 0xa8], rax
lea rax, str.BSCANAUDIO
mov qword [rsp + 0xb8], rax
lea rax, str.BSCANVIDEO
mov qword [rsp + 0xd8], rax
lea rax, str.BSCANCOMMONAUDIO
mov qword [rsp + 0xc8], rax
lea rax, str.BSCANCOMMONVIDEO
mov qword [rsp + 0xe8], rax
lea rax, str.SMAXSIZEVALMEASURMENT
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARESystweakPhotos_Recovery
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18002c3ec
lea rax, [rsp + 0x1b8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1a0]
xor r8d, r8d
lea rdx, str.BMINSIZE
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x1b0]
mov dword [0x18004c340], edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18002c3f8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARESystweakPhotos_Recovery
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18002c47d
lea rax, [rsp + 0x1b8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1a0]
xor r8d, r8d
lea rdx, str.SMINSIZEVAL
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x1b0]
pxor xmm0, xmm0
cvtsi2sd xmm0, rdx
movsd qword [0x18004d5d8], xmm0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18002c489
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARESystweakPhotos_Recovery
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18002c504
lea rax, [rsp + 0x1b8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x84]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1a0]
xor r8d, r8d
lea rdx, str.SMINSIZEVALMEASURMENT
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x84]
mov qword [0x18004d5d0], rdx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18002c510
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARESystweakPhotos_Recovery
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18002c58a
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1a0]
xor r8d, r8d
lea rdx, str.BMAXSIZE
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x90]
mov dword [0x18004c344], edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18002c596
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARESystweakPhotos_Recovery
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18002c5f3
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SMAXSIZEVAL
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x18002c5ff
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARESystweakPhotos_Recovery
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18002c6d0
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SMAXSIZEVAL
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [0x18003e918]
call fcn.180038fe4
mov qword [0x18004d5c0], rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
call fcn.18002e088
mov r11, rax
mov qword [0x18004d5c0], rax
xor ebx, ebx
mov edx, ebx
mov dword [rsp + 0x38], ebx
movsxd r8, edx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp r8, rcx
jae 0x18002c6bc
movzx eax, byte [r12 + r8*2]
mov byte [r8 + r11], al
inc edx
mov dword [rsp + 0x38], edx
jmp 0x18002c691
movsxd rax, edx
mov byte [rax + r11], bl
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18002c6d2
xor ebx, ebx
jmp 0x18002c6db
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARESystweakPhotos_Recovery
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18002c7ad
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [0x18003e918]
call fcn.180038fe4
mov qword [0x18004d5c8], rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
call fcn.18002e088
mov r11, rax
mov qword [0x18004d5c8], rax
mov dword [rsp + 0x38], ebx
nop word [rax + rax]
movsxd rdx, ebx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rdx, rcx
jae 0x18002c79a
movzx eax, byte [rsi + rdx*2]
mov byte [rdx + r11], al
inc ebx
mov dword [rsp + 0x38], ebx
jmp 0x18002c770
movsxd rax, ebx
mov byte [rax + r11], 0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18002c7af
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARESystweakPhotos_Recovery
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18002c82a
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x94]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1a0]
xor r8d, r8d
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x94]
mov dword [0x18004c314], edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18002c82c
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARESystweakPhotos_Recovery
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18002c89e
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1a0]
xor r8d, r8d
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x7c]
mov dword [0x18004c328], edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18002c8a0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARESystweakPhotos_Recovery
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18002c918
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1a0]
xor r8d, r8d
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x8c]
mov dword [0x18004c320], edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18002c91a
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARESystweakPhotos_Recovery
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18002c98c
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1a0]
xor r8d, r8d
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x50]
mov dword [0x18004c324], edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18002c98e
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARESystweakPhotos_Recovery
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18002ca00
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1a0]
xor r8d, r8d
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x54]
mov dword [0x18004c32c], edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18002ca02
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARESystweakPhotos_Recovery
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18002ca74
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1a0]
xor r8d, r8d
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x60]
mov dword [0x18004c330], edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18002ca76
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARESystweakPhotos_Recovery
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18002cae8
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1a0]
xor r8d, r8d
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x70]
mov dword [0x18004c334], edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18002caea
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARESystweakPhotos_Recovery
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18002cb62
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1a0]
xor r8d, r8d
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x80]
mov dword [0x18004c338], edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18002cb64
cmp dword [0x18004c314], 1
jne 0x18002cbbf
cmp dword [0x18004c320], 1
jne 0x18002cbbf
cmp dword [0x18004c328], 1
jne 0x18002cbbf
cmp dword [0x18004c324], 1
jne 0x18002cbbf
cmp dword [0x18004c32c], 1
jne 0x18002cbbf
cmp dword [0x18004c334], 1
jne 0x18002cbbf
cmp dword [0x18004c330], 1
jne 0x18002cbbf
mov eax, dword [0x18004c33c]
mov edi, 1
cmp dword [0x18004c338], edi
cmove eax, edi
mov dword [0x18004c33c], eax
jmp 0x18002cbc4
mov edi, 1
lea rdx, str.SOFTWARESystweakPhotos_RecoveryBLOB1
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rdx, str.SOFTWARESystweakPhotos_RecoveryBLOB2
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rdx, str.SOFTWARESystweakPhotos_RecoveryBLOB3
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rdx, str.SOFTWARESystweakPhotos_RecoveryBLOB4
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rdx, str.SOFTWARESystweakPhotos_RecoveryBLOB5
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rdx, str.SOFTWARESystweakPhotos_RecoveryBLOB6
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x18002cc43
mov eax, edi
add rsp, 0x178
pop r12
pop rdi
pop rsi
pop rbx
ret