Function at 0x140018300
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8e0]
sub rsp, 0x9e0
mov rax, qword [0x1401198e8]
xor rax, rsp
mov qword [rbp + 0x8d0], rax
movzx edi, r9b
mov byte [rsp + 0x34], r9b
mov r15, r8
mov qword [rsp + 0x68], r8
mov r14, rdx
mov qword [rsp + 0x78], rdx
mov r12, rcx
mov qword [rsp + 0x70], rcx
xor esi, esi
mov ebx, esi
mov dword [rsp + 0x30], ebx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], rax
lea r13, [rsi - 1]
test r9b, r9b
je 0x14001837a
mov r8, rdx
jmp 0x140018406
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x140018eba
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.1400062d0
test al, al
jne 0x1400183dc
test r14, r14
jne 0x1400183b4
mov eax, esi
jmp 0x1400183cb
mov rax, r13
nop word [rax + rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x1400183c0
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.1400068f0
nop
mov dword [rsp + 0x30], 1
lea r8, str.AutorunsDisabled
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x60]
call fcn.140006020
nop
mov ebx, 3
mov dword [rsp + 0x30], ebx
mov r8, qword [rax]
mov r9d, 0x20019
mov rdx, r12
lea rcx, [rbp + 0x78]
call fcn.140027410
nop
test bl, 2
je 0x140018447
and ebx, 0xfffffffd
mov dword [rsp + 0x30], ebx
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140018443
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov ebx, dword [rsp + 0x30]
test bl, 1
je 0x140018476
and ebx, 0xfffffffe
mov dword [rsp + 0x30], ebx
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140018472
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov ebx, dword [rsp + 0x30]
test dil, dil
je 0x14001875e
mov ecx, 0x148
call fcn.14009bfa8
mov rsi, rax
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_struct_AutorunsEntry_.0
mov qword [rsi], rax
lea rdi, [rsi + 0x10]
xor edx, edx
mov r8d, 0x138
mov rcx, rdi
call fcn.14009e880
mov rcx, rdi
call fcn.140007090
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
or ebx, 4
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x70], rsi
mov dword [rdi + 0x118], 0x1080
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 7
mov eax, dword [0x1400eff20]
mov word [rbp - 0x40], ax
xor ecx, ecx
mov word [rbp - 0x3e], cx
cmp r12, 0xffffffff80000000
je 0x140018541
cmp r12, 0xffffffff80000001
je 0x140018538
lea r8, [0x1400f582c]
lea rax, str.HKLM
cmp r12, 0xffffffff80000002
cmove r8, rax
jmp 0x140018548
lea r8, str.HKCU
jmp 0x140018548
lea r8, str.HKCR
mov r9, r13
nop dword [rax + rax]
inc r9
cmp word [r8 + r9*2], 0
jne 0x140018550
lea rcx, [rbp - 0x40]
call fcn.140006ee0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xor ecx, ecx
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x68], rcx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 7
mov word [rax], cx
or ebx, 8
mov r8, r13
nop dword [rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x1400185a0
mov rdx, r14
lea rcx, [rbp - 0x80]
call fcn.140006fe0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 7
mov word [rax], cx
or ebx, 0x10
mov dword [rsp + 0x30], ebx
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.140005f80
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14001862b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018625
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018ec5
call fcn.14009bfe4
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14001866b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018666
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018ecb
call fcn.14009bfe4
xor eax, eax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], ax
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x1400186bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400186b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018ed1
call fcn.14009bfe4
mov rbx, qword [rbp + 0x78]
test rbx, rbx
je 0x1400186d5
mov rcx, rbx
call fcn.14002d4a0
mov qword [rdi + 0xa0], rax
mov rdx, qword [r15 + 8]
cmp rdx, qword [r15 + 0x10]
je 0x1400186f6
mov qword [rdx], rdi
mov qword [rdx + 8], rsi
xor esi, esi
mov r9d, esi
mov qword [rbp + 0x70], rsi
add qword [r15 + 8], 0x10
jmp 0x140018708
lea r8, [rbp + 0x68]
mov rcx, r15
call fcn.1400071a0
mov r9, qword [rbp + 0x70]
xor esi, esi
mov r8, qword [r15 + 8]
sub r8, qword [r15]
sar r8, 4
mov edx, 0x68
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov qword [rdx + rcx], r8
test r9, r9
je 0x140018762
mov eax, r13d
lock xadd dword [r9 + 8], eax
cmp eax, 1
jne 0x14001875e
mov rbx, qword [rbp + 0x70]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r13d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14001875e
mov rcx, qword [rbp + 0x70]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rbp + 0x78]
test rbx, rbx
je 0x140018e70
movzx eax, byte [0x1401358f1]
nop
test al, al
jne 0x140018e6c
lea r8, [0x1400f1b38]
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x90]
call fcn.1400262f0
nop
cmp qword [rbp + 0xa0], 0
je 0x140018db3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rax
lea rbx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rbx, qword [rbp + 0x90]
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x140018ed7
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1400062d0
test al, al
jne 0x14001882b
test rbx, rbx
jne 0x140018805
mov eax, esi
jmp 0x14001881a
mov rax, r13
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140018810
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1400068f0
nop
mov qword [rsp + 0x58], rsi
mov rdi, qword [rsp + 0x50]
lea r12, [rdi - 0x18]
mov rcx, qword [r12]
test rcx, rcx
je 0x140018850
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140018861
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140018ee2
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
or dword [rsp + 0x30], 0x80
movsxd r15, dword [r12 + 8]
lea r14d, [r15 + 0x11]
test r14d, r14d
js 0x140018eaf
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x1400188b7
mov edx, r14d
lea rcx, [rsp + 0x58]
call fcn.140006870
mov rbx, qword [rsp + 0x58]
mov eax, esi
test rbx, rbx
setne al
mov dword [rsp + 0x40], eax
test rbx, rbx
jne 0x1400188da
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x1400188fa
movups xmm0, xmmword [str.SoftwareClasses_]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x1400f3a10]
movups xmmword [rbx + 0x10], xmm1
movzx eax, word [0x1400f3a20]
mov word [rbx + 0x20], ax
mov r8, r15
add r8, r8
lea rcx, [rbx + 0x22]
je 0x140018936
test rcx, rcx
je 0x140018926
test rdi, rdi
je 0x14001891a
mov rdx, rdi
call fcn.14009d3c0
jmp 0x140018936
xor edx, edx
call fcn.14009e880
test rdi, rdi
jne 0x140018936
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
cmp r14d, dword [rbx - 0xc]
jg 0x140018eaf
mov dword [rbx - 0x10], r14d
xor ecx, ecx
mov word [rbx + r15*2 + 0x22], cx
mov qword [rsp + 0x60], rcx
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x140018968
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140018979
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140018eed
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x60], rdi
or dword [rsp + 0x30], 0x100
movsxd r14, dword [rbx - 0x10]
mov dword [rsp + 0x48], r14d
lea r15d, [r14 + 0x13]
test r15d, r15d
js 0x140018f0a
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r15d
or eax, ecx
jge 0x1400189d3
mov edx, r15d
lea rcx, [rsp + 0x60]
call fcn.140006870
mov rdi, qword [rsp + 0x60]
add r14, r14
je 0x140018a10
test rdi, rdi
je 0x140018a00
mov r8, r14
mov rcx, rdi
test rbx, rbx
je 0x1400189f2
mov rdx, rbx
call fcn.14009d3c0
jmp 0x140018a10
xor edx, edx
call fcn.14009e880
cmp dword [rsp + 0x40], 0
jne 0x140018a10
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
lea rcx, [r14 + rdi]
test rcx, rcx
jne 0x140018a2b
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x140018a54
movups xmm0, xmmword [str._shellopencommand]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1400f39e8]
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [0x1400f39f8]
mov dword [rcx + 0x20], eax
movzx eax, word [0x1400f39fc]
mov word [rcx + 0x24], ax
cmp r15d, dword [rdi - 0xc]
jg 0x140018f0a
mov dword [rdi - 0x10], r15d
movsxd rax, dword [rsp + 0x48]
xor r14d, r14d
mov word [rdi + rax*2 + 0x26], r14w
lea r9d, [r14 + 1]
mov r8, rdi
mov rdx, qword [rsp + 0x70]
lea rcx, [rbp + 0xb0]
call fcn.140027410
nop
and dword [rsp + 0x30], 0xfffffeff
mov eax, r13d
lock xadd dword [rdi - 8], eax
sub eax, 1
jg 0x140018aac
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + VariantCopy]
and dword [rsp + 0x30], 0xffffff7f
mov eax, r13d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x140018ad0
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + VariantCopy]
nop
mov eax, r13d
lock xadd dword [r12 + 0x10], eax
sub eax, 1
jg 0x140018aec
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + VariantCopy]
mov rsi, qword [rbp + 0xb0]
test rsi, rsi
je 0x140018d96
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r14w
or dword [rsp + 0x30], 0x200
mov dword [rbp + 0x20], 0x800
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x60]
xor r8d, r8d
lea rdx, [0x1400f1b38]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140018b5a
cmp eax, 0xd
jne 0x140018b9b
jmp 0x140018b72
mov eax, dword [rbp + 0x60]
dec eax
cmp eax, 1
ja 0x140018b72
cmp dword [rbp + 0x20], 0
jne 0x140018b72
mov word [rbp + 0xd0], r14w
lea rax, [rbp + 0xd0]
mov r8, r13
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140018b80
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x40]
call fcn.140003510
lea r8, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae r8, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jne 0x140018bdf
lea rcx, str.__1___
test rdx, rdx
je 0x140018d55
sub r8, rcx
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140018bdf
add rcx, 2
sub rdx, 1
jne 0x140018bc6
jmp 0x140018d55
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
lea rcx, [rbp + 0x30]
call fcn.140006bf0
nop
movzx eax, byte [rsp + 0x34]
xor eax, 1
add eax, eax
bts eax, 0x12
mov rbx, qword [rbp + 0x30]
mov dword [rbx + 0x118], eax
lea rax, [rbp + 0x40]
cmp rbx, rax
je 0x140018c2b
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x50]
mov rcx, rbx
call fcn.140003510
lea rcx, [rbx + 0x80]
lea rax, [rbp + 0x40]
cmp rcx, rax
je 0x140018c52
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x50]
call fcn.140003510
lea rdx, [rbp + 0x40]
lea rcx, [rbp]
call fcn.14002c0f0
lea rcx, [rbx + 0x60]
mov rdx, rax
call fcn.140005f80
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x140018cab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018ca6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018ef8
call fcn.14009bfe4
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov rdi, qword [rbp + 0x38]
test rdi, rdi
je 0x140018ccf
lock inc dword [rdi + 8]
mov rsi, qword [rbp + 0xb0]
mov rdi, qword [rbp + 0x38]
mov rbx, qword [rbp + 0x30]
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x50], xmm0
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.1400263f0
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax + 8]
cmp rdx, qword [rax + 0x10]
je 0x140018d0a
mov qword [rdx], rbx
mov qword [rdx + 8], rdi
mov rcx, r14
mov qword [rbp + 0x38], rcx
add qword [rax + 8], 0x10
jmp 0x140018d1a
lea r8, [rbp + 0x30]
mov rcx, rax
call fcn.1400071a0
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140018d55
mov eax, r13d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140018d4e
mov rbx, qword [rbp + 0x38]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], r13d
cmp r13d, 1
jne 0x140018d4e
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rsi, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x140018d96
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018d90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018efe
call fcn.14009bfe4
nop
test rsi, rsi
je 0x140018da4
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, qword [rsp + 0x70]
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
cmp byte [rsp + 0x34], 0
je 0x140018e02
xor r9d, r9d
mov r8, r15
mov rdx, r14
mov rcx, r12
call fcn.140018300
mov rdx, qword [r15 + 8]
mov r8d, 0x68
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov rcx, qword [r8 + rcx]
shl rcx, 4
add rcx, qword [r15]
mov r8, rdx
sub r8, rcx
sar r8, 4
lea r9, [0x140023240]
call fcn.14000a910
mov dil, 1
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x140018e4b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018e46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018f04
call fcn.14009bfe4
xor eax, eax
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], ax
mov rbx, qword [rbp + 0x78]
jmp 0x140018e73
mov rbx, qword [rbp + 0x78]
xor dil, dil
test rbx, rbx
je 0x140018e81
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, dil
mov rcx, qword [rbp + 0x8d0]
xor rcx, rsp
call fcn.14009c570
mov rbx, qword [rsp + 0xa38]
add rsp, 0x9e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
mov ecx, 0x80070057
call fcn.140007f00
int3