Function at 0x180020df0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x790]
sub rsp, 0x890
mov rax, qword [0x1804762b8]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov r13, qword [rbp + 0x7f8]
lea r14d, [rcx + 0x11]
mov ebx, ecx
mov qword [rbp - 0x70], rdx
mov r12, r8
mov dword [rsp + 0x68], ecx
mov r8, rdx
mov qword [rsp + 0x70], r9
mov rdx, qword [rbp - 0x68]
xor r11d, r11d
mov qword [rsp + 0x60], rdx
mov esi, ecx
lea rcx, [0x180000000]
mov r10, r9
cmp ebx, r14d
jae 0x180021214
mov r15, qword [rbp - 0x60]
lea edi, [rbx - 0x60]
mov ebx, 0x57
lea r11, [0x180020dc0]
lea r9, [0x180077950]
cmp edi, 0x59
ja case.default.0x180020e9d
movzx eax, byte [rcx + rdi + 0x21a84]
mov ecx, dword [rcx + rax*4 + 0x21a44]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
xor eax, eax
mov word [rbp + 0x210], ax
jmp case.0x180020e9d.15
cmp qword [rdx + 8], 0
je 0x180021270
xor eax, eax
mov qword [rbp - 0x68], rax
jmp case.0x180020e9d.15
mov r8d, 5
mov dword [rbp + 0x202], 0x745341
lea rdx, str.artup
lea rcx, [rbp + 0x200]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x1800211e4
mov eax, 0xdf
cmp eax, 0xdf
je 0x180020f05
cmp eax, 0x96b3
je case.0x18002126d.0
jmp 0x180020f0b
xor ecx, ecx
mov dword [rsp + 0x50], ecx
add eax, 0x95d4
cmp eax, 0x12ba8
jbe 0x180020ef1
mov qword [rsp + 0x50], r15
jmp case.0x180020e9d.15
cmp dword [r8], 1
jne case.0x180020e9d.15
mov ecx, 0xfc
mov eax, ecx
sub eax, 0xfc
je 0x180020f44
cmp eax, 0x71
je case.0x18002126d.0
jmp 0x180020f49
mov byte [rsp + 0x50], 1
add ecx, 0x71
cmp ecx, 0x1de
jb 0x180020f30
jmp case.0x180020e9d.15
mov r8d, 2
lea rdx, [0x18046976c]
lea rcx, [rbp + 0x210]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
movabs rax, 0x7300690067
mov qword [rbp + 0x214], rax
jmp 0x1800211e4
mov eax, dword [r8]
cmp eax, 0xf
je 0x180020fa0
cmp eax, 0x15
je 0x180020ff3
cmp eax, 0x18
je 0x180020fbc
jmp 0x18002102c
mov eax, 0xed
cmp eax, 0xed
je 0x18002128e
add eax, 0x91
cmp eax, 0x17e
jb 0x180020fa5
mov ecx, GetAcceptLanguagesW
mov eax, ecx
sub eax, 0xb
je 0x180020fe2
sub eax, 1
je 0x180020fd8
cmp eax, 1
je case.0x18002126d.0
jmp 0x180020fec
mov dword [rsp + 0x50], 0x21
jmp 0x180020fec
mov rax, qword [0x180476570]
mov qword [r10], rax
inc ecx
cmp ecx, 0xe
jb 0x180020fc1
mov eax, 0x11c
cmp eax, 0x11c
je 0x18002101d
cmp eax, 0x30d0
je 0x180021013
cmp eax, 0x6084
je case.0x18002126d.0
jmp 0x180021020
mov dword [rsp + 0x50], 0x21
jmp 0x180021020
mov qword [r10], r11
add eax, 0x2fb4
cmp eax, 0x8f1c
jbe 0x180020ff8
mov eax, dword [r8]
xor edx, edx
mov dword [rsp + 0x78], eax
lea r8, [rsp + 0x78]
xor eax, eax
mov rcx, r10
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x5a]
call fcn.180030580
mov dword [rsp + 0x50], eax
jmp 0x1800211e4
mov qword [rsp + 0x20], r8
mov r9d, 0xb6
xor r8d, r8d
xor edx, edx
mov rcx, r10
call fcn.18008b130
test al, al
jne 0x180021903
mov r10, qword [rsp + 0x70]
mov rax, qword [r10 + 0x58]
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x60], rdx
jmp 0x1800211ee
mov eax, 0x53
mov word [rbp + 0x200], bx
mov word [rbp + 0x201], ax
jmp case.0x180020e9d.15
cmp dword [r8], 0x14
jne case.0x180020e9d.15
mov ebx, GetAcceptLanguagesW
cmp ebx, 0xc
je 0x1800210c7
cmp ebx, 0x18c
je case.0x18002126d.0
jmp 0x180021127
mov rax, qword [r8 + 0x18]
cmp byte [rax], 0x2f
jne 0x1800210fe
mov ecx, 0x66
mov eax, ecx
sub eax, 0x66
je 0x1800210e7
cmp eax, 0x1f
je case.0x18002126d.0
jmp 0x1800210f3
mov qword [r10 + 0x98], r9
mov byte [rsp + 0x50], 1
add ecx, 0x1f
cmp ecx, 0xa4
jb 0x1800210d5
xor edx, edx
mov qword [rsp + 0x20], r10
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x59]
call fcn.18004f870
mov r10, qword [rsp + 0x70]
lea r9, [0x180077950]
mov r8, qword [rbp - 0x70]
mov byte [rsp + 0x50], al
add ebx, 0x180
cmp ebx, 0x300
jbe 0x1800210b4
mov ebx, 0x57
jmp 0x1800211e9
mov dword [rbp + 0x21a], 0x74
mov dword [rbp + 0x21c], 0x65
jmp case.0x180020e9d.15
movzx eax, byte [r10]
cmp al, 0x7f
ja 0x180021175
mov ecx, eax
mov dword [r8 + 0xc], eax
xor eax, eax
mov dword [rsp + 0x50], eax
jmp case.0x180020e9d.15
lea rcx, [0x180000000]
mov ecx, dword [rcx + rax*4 + 0x10e610]
xor eax, eax
mov dword [rsp + 0x50], eax
mov dword [r8 + 0xc], ecx
jmp case.0x180020e9d.15
mov rdx, qword [r12]
mov r9d, 0xa7
mov rax, qword [r10 + 0x28]
mov rcx, qword [r13]
add rcx, rdx
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x78]
mov qword [rbp - 0x78], rcx
mov rcx, qword [r10 + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x30]
mov qword [rbp - 0x30], rdx
lea rdx, [rbp - 0x38]
call fcn.1800ae400
mov rcx, qword [r12]
xor edx, edx
mov r8, qword [r13]
add rcx, rax
mov r15, rax
call sub.VCRUNTIME140.dll_memset
mov r10, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x60]
lea r11, [0x180020dc0]
lea rcx, [0x180000000]
mov r8, qword [rbp - 0x70]
inc esi
inc edi
cmp esi, r14d
jb 0x180020e74
mov ebx, dword [rsp + 0x68]
xor r11d, r11d
lea esi, [rbx - 0x10]
mov dword [rbp - 0x30], esi
cmp ebx, esi
jbe case.0x18002126d.0
mov r12, qword [rbp - 0x60]
lea edi, [rbx - 0x7f]
mov r13, qword [rbp - 0x60]
lea r9, str.ws2_32.dll
movzx r15d, byte [rsp + 0x48]
mov r14d, 0x30
mov dword [rsp + 0x78], edi
cmp edi, 0x36
ja case.0x18002126d.4
lea rcx, [0x180000000]
movzx eax, byte [rcx + rdi + 0x21b1c]
mov ecx, dword [rcx + rax*4 + 0x21ae0]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
xor edx, edx
mov qword [rsp + 0x20], r10
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x59]
call fcn.18004f870
mov byte [rsp + 0x50], al
jmp case.0x18002126d.0
mov dword [rsp + 0x50], 0x21
jmp case.0x18002126d.0
mov dword [rbp - 0x3c], r11d
jmp case.0x18002126d.4
xor r8d, r8d
mov edx, 0xb5
xor ecx, ecx
call fcn.1800578b0
mov byte [rsp + 0x50], al
mov rdx, qword [rsp + 0x60]
lea r9, str.ws2_32.dll
jmp case.0x18002126d.4
lea rax, [rbp + 0x210]
sub rax, 2
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x1800212d3
movsd xmm0, qword [0x180469778]
movsd xmm1, qword [0x180469780]
movsd qword [rax], xmm0
movzx eax, word [0x180469788]
mov word [rbp + 0x244], ax
movsd qword [rbp + 0x23c], xmm1
jmp case.0x18002126d.4
lea rcx, [rbp + 0x210]
mov dword [rbp - 0x38], r11d
call qword [sym.imp.SHLWAPI.dll_PathIsLFNFileSpecW]
mov rdx, qword [rsp + 0x60]
lea r9, str.ws2_32.dll
jmp case.0x18002126d.4
xorps xmm0, xmm0
xor eax, eax
mov qword [rbp + 0x30], rax
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movsd xmm0, qword [rbp + 0x30]
movsd qword [rbp + 8], xmm0
mov rax, qword [rdx + 8]
mov qword [rbp - 0x78], rax
jmp case.0x18002126d.4
mov qword [rsp + 0x28], r9
xor edx, edx
lea r9, [rbp + 0x200]
mov qword [rbp - 0x60], r11
xor r8d, r8d
mov qword [rsp + 0x20], r11
lea ecx, [rdx + 0x3e]
call fcn.180062e10
mov rdx, qword [rsp + 0x60]
lea r9, str.ws2_32.dll
mov qword [rbp - 0x28], rax
jmp case.0x18002126d.4
mov dword [rbp - 0x7c], r11d
jmp case.0x18002126d.4
mov ecx, 0x202
lea rdx, [rbp + 0x50]
call qword [rbp - 0x28]
test eax, eax
je 0x180021478
mov ebx, 9
cmp ebx, 9
ja case.default.0x1800213cc
lea rdx, [0x180000000]
mov eax, ebx
mov ecx, dword [rdx + rax*4 + 0x21b54]
add rcx, rdx
jmp rcx
xor eax, eax
mov dword [rbp + 0x38], 0xa
mov dword [rbp - 0x58], eax
jmp case.default.0x1800213cc
xor eax, eax
mov ecx, eax
test r12, r12
movzx eax, byte [rsp + 0x40]
cmovne ecx, eax
mov byte [rsp + 0x40], cl
cmp cl, 0
je case.default.0x1800213cc
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteObject]
jmp case.default.0x1800213cc
mov dword [rbp + 0x40], 0x28
jmp case.default.0x1800213cc
xor eax, eax
mov byte [rsp + 0x40], 1
mov qword [rbp - 0x20], rax
jmp case.default.0x1800213cc
xor eax, eax
xorps xmm0, xmm0
mov dword [rbp - 0x54], eax
movups xmmword [rbp + 0x38], xmm0
jmp case.default.0x1800213cc
mov dword [rbp + 0x3c], 0x14
jmp case.default.0x1800213cc
mov dword [rbp + 0x44], 0x32
jmp case.default.0x1800213cc
lea rcx, [rbp + 0x38]
call qword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov r8d, dword [rbp - 0x58]
lea r9, [rbp - 0x50]
mov edx, dword [rbp - 0x54]
mov r12, rax
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.GDI32.dll_GetPaletteEntries]
jmp case.default.0x1800213cc
xor eax, eax
mov dword [rbp - 0x50], eax
dec ebx
lea eax, [rbx + 0xde]
cmp eax, 0xdd
ja 0x1800213b0
mov ebx, dword [rsp + 0x68]
mov r9, qword [rsp + 0x70]
xor eax, eax
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfe
call fcn.180043c40
test al, al
jne 0x1800212b7
mov ebx, 0x127
nop word [rax + rax]
cmp ebx, 0x3502
ja 0x18002169c
je 0x18002167a
cmp ebx, 0x1833
ja 0x1800215b1
je 0x18002155c
cmp ebx, 0x127
je 0x180021545
cmp ebx, 0x6ea
je 0x180021536
cmp ebx, 0xcad
je 0x180021527
cmp ebx, 0x1270
jne 0x1800217ba
mov eax, dword [0x1804697c0]
movsd xmm0, qword [str.QCPLay]
mov dword [rbp + 0x468], eax
movzx eax, word [0x1804697c4]
mov word [rbp + 0x46c], ax
movsd qword [rbp + 0x460], xmm0
jmp 0x1800217ba
mov dword [rbp + 0x1f7], 0x313b31
jmp 0x1800217ba
mov dword [rbp + 0x1f4], 0x263121
jmp 0x1800217ba
mov dword [rbp + 0x1f0], 0x5c3046
mov word [rbp + 0x1f3], r14w
jmp 0x1800217ba
lea rcx, [rbp + 0x460]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180021570
movzx eax, word [0x1804697a8]
movsd xmm0, qword [str.out]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
mov eax, dword [0x1804697ac]
mov dword [rbp + 0x250], eax
movzx eax, word [0x1804697b0]
mov word [rbp + 0x254], ax
jmp 0x1800217ba
cmp ebx, 0x1df6
je 0x180021657
cmp ebx, 0x23b9
je 0x18002162e
cmp ebx, 0x297c
je 0x1800215f5
cmp ebx, 0x2f3f
jne 0x1800217ba
mov r8d, 0xa
lea rdx, [rbp + 0x260]
lea ecx, [r8 - 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltow]
jmp 0x1800217ba
mov r8d, 1
lea rdx, [0x180469790]
lea rcx, [rbp + 0x250]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, dword [0x180469794]
mov dword [rbp + 0x25c], eax
movzx eax, word [0x180469798]
mov word [rbp + 0x260], ax
jmp 0x1800217ba
mov r8d, 2
mov dword [rbp + 0x256], 0x74
lea rdx, [0x18046978c]
lea rcx, [rbp + 0x258]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x1800217ba
lea rcx, [rbp + 0x250]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180021662
mov eax, dword [0x1804697d4]
mov dword [rcx], eax
jmp 0x1800217ba
mov r8d, 5
lea rdx, str..f16
lea rcx, [rbp + 0x262]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r15b, 1
jmp 0x1800217ba
cmp ebx, 0x5794
ja 0x18002174c
je 0x18002172e
cmp ebx, 0x3ac5
je 0x180021722
cmp ebx, 0x464b
je 0x180021716
cmp ebx, 0x4c0e
je 0x180021705
cmp ebx, 0x51d1
jne 0x1800217ba
lea rax, [rbp - 0x80]
mov rcx, r13
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x44]
xor eax, eax
lea r8, [rbp + 0x250]
lea rdx, [rbp + 0x460]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [rbp - 0x40], eax
jmp 0x1800217ba
xor eax, eax
mov dword [rbp - 0x4c], 0x2000000
mov dword [rbp - 0x80], eax
jmp 0x1800217ba
mov dword [rbp - 0x48], 0x104
jmp 0x1800217ba
mov r13, 0xffffffff80000001
jmp 0x1800217ba
mov r9d, dword [rbp - 0x4c]
lea r8, [rbp - 0x48]
lea rdx, [rbp + 0x670]
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.SHLWAPI.dll_UrlUnescapeA]
jmp 0x1800217ba
cmp ebx, 0x5d57
je 0x1800217a9
cmp ebx, 0x631a
je 0x180021779
cmp ebx, 0x68dd
je 0x180021772
cmp ebx, 0x6ea0
je case.0x18002126d.0
jmp 0x1800217ba
mov byte [rsp + 0x50], 0
jmp 0x1800217ba
test r15b, r15b
je 0x1800217ba
mov eax, dword [rbp - 0x80]
lea r8, [rbp + 0x250]
mov r9d, dword [rbp - 0x44]
lea rdx, [rbp + 0x460]
mov dword [rsp + 0x28], eax
mov rcx, r13
xor eax, eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x1800217ba
cmp dword [rbp - 0x40], 0
mov eax, 0
movzx r15d, r15b
cmovne r15d, eax
add ebx, 0x5c3
cmp ebx, 0x733c
jbe 0x1800214b0
mov ebx, dword [rsp + 0x68]
lea r9, str.ws2_32.dll
mov rdx, qword [rsp + 0x60]
jmp case.0x18002126d.4
mov eax, dword [0x1804697d8]
lea rdx, [0x1804697e0]
mov dword [rbp + 0x230], eax
lea rcx, [rbp + 0x210]
movzx eax, word [0x1804697dc]
mov r8d, 1
mov word [rbp + 0x234], ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov rdx, qword [rsp + 0x60]
lea r9, str.ws2_32.dll
jmp case.0x18002126d.4
mov eax, dword [0x1804697e4]
lea rcx, [rbp + 0x210]
mov dword [rbp + 0x222], eax
sub rcx, 2
movzx eax, word [0x1804697e8]
mov word [rbp + 0x226], ax
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180021850
movsd xmm0, qword [str.iceNo]
mov eax, dword [0x1804697f8]
movsd qword [rcx], xmm0
mov dword [rcx + 8], eax
jmp case.0x18002126d.4
mov edx, dword [rbp - 0x38]
lea r8, [rbp - 0x3c]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.GDI32.dll_GetEnhMetaFilePaletteEntries]
mov rdx, qword [rsp + 0x60]
lea r9, str.ws2_32.dll
jmp case.0x18002126d.4
mov dword [rsp + 0x30], 0x3b
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], r8
lea rdx, [rbp - 0x7c]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov r9, r10
lea rcx, [rsp + 0x58]
call fcn.1800b51e0
test al, al
je 0x1800219c7
mov rsi, qword [rbp - 0x68]
mov ebx, 0x1e
mov r14d, dword [rbp - 0x7c]
movzx edi, byte [rsp + 0x58]
nop dword [rax]
mov eax, ebx
sub eax, 0x1e
je 0x18002198f
sub eax, 0x21
je 0x180021966
sub eax, 0x21
je 0x180021958
sub eax, 0x21
je 0x180021937
cmp eax, 0x21
jne 0x1800219a7
mov byte [rsp + 0x50], 1
mov rax, qword [rsp + 0x50]
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.1800e9340
mov rbx, qword [rsp + 0x8d0]
add rsp, 0x890
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rbp - 0x78]
lea rcx, [0x1800778f0]
mov rax, qword [rax + 0x20]
mov dword [rax + 4], r14d
mov rax, qword [rsp + 0x70]
mov qword [rax + 0x98], rcx
jmp 0x1800219a7
mov rax, qword [rbp - 0x78]
mov rax, qword [rax + 0x20]
mov qword [rax + 8], rsi
jmp 0x1800219a7
mov rax, qword [rsp + 0x70]
xor r9d, r9d
mov r8d, 0x83
xor ecx, ecx
mov rdx, qword [rax + 0x58]
call fcn.18003f9f0
mov rcx, qword [rbp - 0x78]
mov qword [rcx + 0x20], rax
mov dword [rax], 0x80
jmp 0x1800219a7
test dil, dil
jne 0x1800219a7
lea r9, [rbp - 0x18]
xor r8d, r8d
xor edx, edx
mov ecx, 0x10e
call fcn.18008b610
add ebx, 0x21
cmp ebx, 0xc3
jb 0x1800218e0
mov edi, dword [rsp + 0x78]
mov r14d, 0x30
mov esi, dword [rbp - 0x30]
mov ebx, dword [rsp + 0x68]
mov rax, qword [rsp + 0x70]
xor edx, edx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea ecx, [rdx + 0x59]
call fcn.18004f870
mov byte [rsp + 0x48], al
lea r8, [rbp - 0x18]
mov edx, 0x9f
lea rcx, [rsp + 0x48]
jmp 0x1800212ae
mov eax, dword [0x1804697fc]
mov dword [rbp + 0x21e], eax
movzx eax, word [0x180469800]
mov word [rbp + 0x222], ax
dec ebx
dec edi
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x78], edi
cmp ebx, esi
jbe case.0x18002126d.0
mov r10, qword [rsp + 0x70]
xor r11d, r11d
mov r8, qword [rbp - 0x70]
jmp 0x180021244
mov byte [rsp + 0x50], 0
jmp case.0x18002126d.0