Function at 0x180080fe0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
movaps xmmword [rsp + 0x110], xmm6
mov rax, qword [0x1804762b8]
xor rax, rsp
mov qword [rbp], rax
lea ebx, [r9 + 0x12]
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x60], r8
mov r15, r8
mov qword [rsp + 0x40], rcx
mov rdx, rcx
mov dword [rsp + 0x38], ebx
mov r13d, r9d
lea r11, [0x180000000]
cmp r9d, ebx
jae 0x1800812ee
mov rdi, qword [rsp + 0x50]
lea r12d, [r9 - 0xe4]
mov r9d, 0x65
lea r10, [0x1800051f0]
mov r8d, 0x525f
cmp r12d, 0x15
ja case.0x180081076.15
mov ecx, dword [r11 + r12*4 + 0x81564]
add rcx, r11
jmp rcx
mov eax, dword [str.Xina]
mov dword [rbp - 5], eax
movzx eax, byte [0x18046b200]
mov byte [rbp - 1], al
jmp case.0x180081076.15
mov eax, dword [0x18046b240]
mov dword [rbp - 0x2a], eax
movzx eax, byte [0x18046b244]
mov byte [rbp - 0x26], al
mov byte [rbp - 0x25], 0
jmp case.0x180081076.15
mov word [rbp - 0x30], r8w
jmp case.0x180081076.15
mov r8d, 4
mov byte [rbp - 0x2e], 0
lea rdx, str.ESP_fastpath__string_
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov rdx, qword [rsp + 0x40]
lea r10, [0x1800051f0]
mov r8d, 0x525f
lea r11, [0x180000000]
mov r9d, 0x65
jmp case.0x180081076.15
mov rax, qword [r15 + 0x58]
mov r9d, 0xb6
mov qword [rsp + 0x20], rdx
xor r8d, r8d
xor edx, edx
mov rcx, r15
mov r14, qword [rax + 0x10]
call fcn.18008b130
test al, al
je 0x1800810d1
mov esi, 0x44
nop
cmp esi, 0x44
je 0x1800811b5
cmp esi, 0x2df4
je 0x18008113f
cmp esi, 0x5ba4
je case.0x180081076.21
jmp 0x1800811b9
test rdi, rdi
je 0x1800811ae
cmp qword [rdi + 0x10], 0
jne 0x1800811ae
cmp qword [rdi + 8], 0
jne 0x1800811ae
cmp qword [rdi], 0
jne 0x1800811ae
mov ebx, 0x101
nop dword [rax]
mov eax, ebx
sub eax, 0x100
je case.0x180081076.21
cmp eax, 1
jne 0x1800811a4
lea r9d, [rax + 0x44]
mov qword [rsp + 0x20], rdi
mov r8, r15
xor edx, edx
xor ecx, ecx
call fcn.180054790
xor edx, edx
mov qword [r14 + 8], rax
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
lea ecx, [rdx + 0x59]
call fcn.18004f870
mov byte [rsp + 0x48], al
dec ebx
cmp ebx, 0xff
ja 0x180081160
mov byte [rsp + 0x48], 1
jmp 0x1800811b9
mov rdi, qword [r14 + 8]
add esi, 0x2db0
cmp esi, 0x8910
jbe 0x180081120
mov ebx, dword [rsp + 0x38]
jmp 0x1800810d1
mov byte [rbp - 0x1b], 0x45
jmp case.0x180081076.15
mov r8d, 1
lea rdx, [0x18046b285]
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 1
lea rdx, [0x18046b2a1]
lea rcx, [rbp - 0x24]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x1800810d1
lea rcx, [rbp - 0x18]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180081220
mov eax, dword [str.Hora]
mov dword [rcx], eax
movzx eax, word [0x18046b2b0]
mov word [rcx + 4], ax
movzx eax, word [0x18046b2b4]
mov word [rbp - 0x13], ax
movzx eax, byte [0x18046b2b6]
mov byte [rbp - 0x11], al
jmp case.0x180081076.15
mov r8d, 7
lea rdx, str.u_de_l
lea rcx, [rbp - 0xd]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
movzx eax, word [0x1800f0ce4]
mov word [rbp - 7], ax
jmp 0x1800810d1
mov byte [rbp - 0x18], 0
jmp case.0x180081076.15
mov eax, dword [0x18046b2cd]
mov dword [rbp - 0x23], eax
movzx eax, byte [0x18046b2d1]
mov byte [rbp - 0x1f], al
jmp case.0x180081076.15
mov word [rbp - 6], 0x20
jmp case.0x180081076.15
mov word [rbp - 0x11], r9w
jmp case.0x180081076.15
mov qword [r15 + 0x98], r10
mov byte [rsp + 0x48], 0
jmp case.0x180081076.15
movzx eax, word [0x18046b2f5]
mov word [rbp - 0x1e], ax
movzx eax, byte [0x18046b2f7]
mov byte [rbp - 0x1c], al
jmp case.0x180081076.15
mov byte [rbp - 0x1e], 0
jmp case.0x180081076.15
mov dword [rbp - 0x10], 0x697473
inc r13d
inc r12d
cmp r13d, ebx
jb 0x180081061
mov r9d, dword [rsp + 0x30]
lea esi, [r9 - 0x13]
cmp r9d, esi
jbe case.0x180081076.21
movsd xmm6, qword [0x18046bdc8]
lea edi, [r9 - 0xd2]
movzx r15d, byte [rsp + 0x34]
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x50]
mov r13, qword [rsp + 0x50]
movzx r14d, byte [rsp + 0x34]
cmp edi, 0x12
ja case.default.0x180081339
mov ecx, dword [r11 + rdi*4 + 0x815bc]
add rcx, r11
jmp rcx
mov qword [rsp + 0x50], 0xffffffff80000001
mov dword [rsp + 0x74], 0x14
jmp case.default.0x180081339
mov byte [rbp - 0x7c], 0
jmp case.default.0x180081339
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x40], rax
mov r15b, 1
movups xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x38], eax
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
jmp case.default.0x180081339
test r12, r12
je 0x1800813d8
xor r9d, r9d
mov qword [rsp + 0x28], r12
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor ecx, ecx
lea edx, [r9 + 0x4b]
call fcn.18003e2c0
cmp eax, 1
jne 0x1800813d3
mov ecx, 0xfa
mov eax, ecx
sub eax, 0xf9
je case.0x180081076.21
cmp eax, 1
jne 0x1800813c9
movsd qword [rsp + 0x48], xmm6
dec ecx
cmp ecx, 0xf8
ja 0x1800813b1
mov r9d, dword [rsp + 0x30]
xor ebx, ebx
jmp case.default.0x180081339
lea rcx, [rsp + 0x70]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov r13, rax
jmp 0x1800814ff
mov byte [rbp - 0x1a], 0
jmp case.default.0x180081339
mov word [rbp - 0x77], 0
jmp case.default.0x180081339
mov dword [rsp + 0x58], 0
mov byte [rbp - 0x79], 1
jmp case.default.0x180081339
mov dword [rsp + 0x70], 0xa
jmp case.default.0x180081339
mov r14b, 1
jmp case.default.0x180081339
mov word [rbp - 0x7b], 0
jmp case.default.0x180081339
mov eax, dword [rdx]
mov r8d, 0x6f
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x38]
add rcx, 0x48
mov dword [rsp + 0x78], 0x1e
mov dword [rsp + 0x38], eax
call fcn.18008e650
mov r12, rax
jmp 0x1800814ff
mov byte [rbp - 0x78], 0
jmp case.default.0x180081339
mov dword [rbp - 0x80], 0x190
jmp case.default.0x180081339
xor ecx, ecx
movzx eax, r15b
test rbx, rbx
cmovne ecx, eax
movzx eax, r14b
movzx r15d, cl
xor ecx, ecx
test r13, r13
cmovne ecx, eax
movzx r14d, cl
jmp case.default.0x180081339
mov eax, 0x43
cmp eax, 0x43
je 0x180081524
add eax, 0x27c8
cmp eax, 0x27c8
jbe 0x1800814a2
mov r9d, dword [rsp + 0x58]
lea r8, [rbp - 0x30]
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp - 0x18]
call qword [sym.imp.SHLWAPI.dll_SHOpenRegStream2A]
mov rbx, rax
mov byte [rbp - 0x75], 2
jmp 0x1800814ff
mov dword [rsp + 0x7c], 0xa
jmp case.default.0x180081339
test r14b, r14b
je 0x1800814f1
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteObject]
mov r9d, dword [rsp + 0x30]
test r15b, r15b
je case.default.0x180081339
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov r9d, dword [rsp + 0x30]
dec r9d
dec edi
mov dword [rsp + 0x30], r9d
cmp r9d, esi
jbe case.0x180081076.21
mov rdx, qword [rsp + 0x40]
lea r11, [0x180000000]
jmp 0x180081325
movsd xmm0, qword [rdx + 8]
movsd qword [rsp + 0x48], xmm0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1800e9340
mov rbx, qword [rsp + 0x168]
movaps xmm6, xmmword [rsp + 0x110]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret