Function at 0x18006c290
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
and qword [rbp + 0x50], 0
xorps xmm0, xmm0
and dword [rbp + 0x40], 0
mov rsi, rdx
mov r12, rcx
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rcx, rcx
je 0x18006c68e
test rdx, rdx
je 0x18006c68e
xor edx, edx
mov r8d, 0x250
mov rcx, rsi
call sub.ntdll.dll_memset
mov r14d, 0x25a
mov r9d, 4
mov edx, r14d
mov r8d, 0x1000
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x18006c31c
mov ebx, 0x8007000e
jmp 0x18006c659
mov rcx, r12
call fcn.18006b9ec
and qword [rbp - 0x28], 0
lea rcx, [0x180080740]
mov r15d, eax
mov dword [rbp - 0x30], 0x30
lea rax, [0x180080750]
mov dword [rbp - 0x18], 0x40
xorps xmm0, xmm0
lea r8, [rbp - 0x30]
test r15d, r15d
mov edx, 1
movdqu xmmword [rbp - 0x10], xmm0
cmove rcx, rax
mov qword [rbp - 0x20], rcx
lea rcx, [rbp + 0x50]
call qword [sym.imp.ntdll.dll_NtOpenKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x18006c383
bts ebx, 0x1c
jmp 0x18006c659
mov r8, r14
xor edx, edx
mov rcx, rdi
call sub.ntdll.dll_memset
mov rcx, qword [rbp + 0x50]
lea rax, [0x180080700]
test r15d, r15d
lea rdx, [0x1800806f0]
mov r9, rdi
mov r8d, 2
cmove rdx, rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
test eax, eax
jns 0x18006c3da
mov ebx, 0x80070490
jmp 0x18006c659
cmp dword [rdi + 4], 1
jne 0x18006c3d0
lea r14, [rdi + 0xc]
mov edx, 0x125
lea r13, [rsi + 4]
mov r8, r14
mov rcx, r13
call fcn.18001d240
mov ebx, eax
test eax, eax
jns 0x18006c427
mov r9d, 0x1141
mov dword [rsp + 0x20], eax
lea r8, str.WER_CrashAPI:_u:_ERROR_Stringcchcopy_failed_while_copying_the_debugger_path_0x_x_n
xor edx, edx
mov ecx, 0x96
call qword [sym.imp.ntdll.dll_DbgPrintEx]
nop dword [rax + rax]
jmp 0x18006c659
mov eax, dword [rsi]
mov ebx, 0x25a
or eax, 1
mov dword [rsi], eax
test r15d, r15d
je 0x18006c511
or eax, 0x7c
mov r8d, ebx
xor edx, edx
mov dword [rsi], eax
mov rcx, rdi
call sub.ntdll.dll_memset
mov rcx, qword [rbp + 0x50]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x1800806e0]
mov r15d, 2
mov dword [rsp + 0x20], ebx
mov r9, rdi
mov r8d, r15d
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
test eax, eax
js 0x18006c49d
cmp dword [rdi + 4], 4
jne 0x18006c49d
mov eax, dword [r14]
neg eax
mov eax, dword [rsi]
sbb ecx, ecx
and eax, 0xfffffffb
not ecx
and ecx, 4
or ecx, eax
mov dword [rsi], ecx
test byte [rsi], 4
je 0x18006c517
mov r8, rbx
xor edx, edx
mov rcx, rdi
call sub.ntdll.dll_memset
mov rcx, qword [rbp + 0x50]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x180080730]
mov r9, rdi
mov dword [rsp + 0x20], ebx
mov r8d, r15d
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
test eax, eax
js 0x18006c517
cmp dword [rdi + 4], 4
jne 0x18006c517
mov eax, dword [r14]
mov ecx, dword [rsi]
cmp eax, 7
jbe 0x18006c503
cmp eax, 0x80000000
jne 0x18006c4fe
and ecx, 0xfffffff7
or ecx, 0x70
mov dword [rsi], ecx
jmp 0x18006c517
or ecx, 0x78
jmp 0x18006c4fa
shl eax, 3
xor eax, ecx
and eax, 0x78
xor eax, ecx
mov dword [rsi], eax
jmp 0x18006c517
mov r15d, 2
mov r8, rbx
xor edx, edx
mov rcx, rdi
call sub.ntdll.dll_memset
mov rcx, qword [rbp + 0x50]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x1800806d0]
mov r9, rdi
mov dword [rsp + 0x20], ebx
mov r8d, r15d
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
test eax, eax
js 0x18006c57c
cmp dword [rdi + 4], 1
jne 0x18006c55f
cmp word [r14], 0x31
je 0x18006c56b
cmp dword [rdi + 4], 4
jne 0x18006c57c
cmp dword [r14], 0
je 0x18006c57c
mov rcx, r12
call fcn.18006ca60
test eax, eax
jne 0x18006c57c
mov ecx, r15d
jmp 0x18006c57e
xor ecx, ecx
mov eax, dword [rsi]
lea r8, str.WER_CrashAPI:_u:_TRACE_WERP_DEBUGGER_INFO.Available:__u_n
and eax, 0xfffffffd
mov r14d, 0x96
or eax, ecx
mov r9d, 0x11a6
mov dword [rsi], eax
mov edx, r15d
and eax, 1
mov ecx, r14d
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_DbgPrintEx]
nop dword [rax + rax]
mov eax, dword [rsi]
lea r8, str.WER_CrashAPI:_u:_TRACE_WERP_DEBUGGER_INFO.AutoEnabled:__u_n
shr eax, 1
mov r9d, 0x11a7
and eax, 1
mov edx, r15d
mov ecx, r14d
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_DbgPrintEx]
nop dword [rax + rax]
mov eax, dword [rsi]
lea r8, str.WER_CrashAPI:_u:_TRACE_WERP_DEBUGGER_INFO.Protected:__u_n
shr eax, 2
mov r9d, 0x11a8
and eax, 1
mov edx, r15d
mov ecx, r14d
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_DbgPrintEx]
nop dword [rax + rax]
mov eax, dword [rsi]
lea r8, str.WER_CrashAPI:_u:_TRACE_WERP_DEBUGGER_INFO.ProtectionLevel:__08X_n
shr eax, 3
mov r9d, 0x11a9
and eax, 0xf
mov edx, r15d
mov ecx, r14d
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_DbgPrintEx]
nop dword [rax + rax]
mov r9d, 0x11aa
mov qword [rsp + 0x20], r13
lea r8, str.WER_CrashAPI:_u:_TRACE_WERP_DEBUGGER_INFO.Debugger:__S_n
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.ntdll.dll_DbgPrintEx]
nop dword [rax + rax]
xor ebx, ebx
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x18006c66e
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test rdi, rdi
je 0x18006c68a
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualFree]
nop dword [rax + rax]
mov eax, ebx
jmp 0x18006c693
mov eax, 0x80070057
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret