Function at 0x18002ee30
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x180070310]
xor rax, rsp
mov qword [rbp + 0x350], rax
imul eax, edx, 0x532
mov rsi, rcx
mov dword [rsp + 0x74], edx
mov r12d, edx
mov qword [rbp - 0x58], rcx
mov dword [rsp + 0x54], edx
mov dword [rsp + 0x4c], eax
cmp edx, eax
ja 0x18002f321
movzx edi, byte [rsp + 0x44]
mov ecx, 0x6c
mov r13d, dword [rsp + 0x4c]
xor ebx, ebx
mov r14d, dword [rsp + 0x4c]
movzx r15d, word [rsp + 0x44]
lea edx, [rcx - 0x3d]
mov dword [rsp + 0x48], edi
lea r9d, [rcx + 0xb]
lea r8d, [rcx + 4]
nop word [rax + rax]
cmp r12d, 0xc6a3
ja 0x18002f011
je 0x18002f7ba
cmp r12d, 0x575e
ja 0x18002efb4
je 0x18002ef8d
cmp r12d, 0x6a
je 0x18002ef4e
cmp r12d, 0xf1
je 0x18002ef3d
cmp r12d, 0x1d66
je 0x18002ef19
cmp r12d, 0x3a62
jne 0x18002f79d
mov word [rbp + 0x1b9], 0x70
jmp 0x18002f79d
mov eax, dword [0x180068f94]
mov dword [rbp + 0x1b4], eax
movzx eax, byte [0x180068f98]
mov byte [rbp + 0x1b8], al
mov byte [rbp + 0x1b9], bl
jmp 0x18002f79d
test rsi, rsi
jne 0x18002f79d
mov rax, rbx
jmp 0x18002f326
mov r8d, 1
mov byte [rbp + 0x1b0], bl
lea rdx, [0x180068e07]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 3
lea rdx, [0x180068e25]
lea rcx, [rbp + 0x1b1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18002f78d
mov eax, dword [str.s2_lsr_i_r_nac]
mov dword [rbp + 0x202], eax
movzx eax, word [0x180068fac]
mov word [rbp + 0x206], ax
mov word [rbp + 0x200], r9w
jmp 0x18002f79d
cmp r12d, 0x745a
je 0x18002efee
cmp r12d, 0x9156
je 0x18002efe2
cmp r12d, 0xae52
jne 0x18002f79d
mov dword [rbp + 0x212], 0x6c
jmp 0x18002f79d
mov word [rbp + 0x212], bx
jmp 0x18002f79d
movsd xmm0, qword [0x180068f7e]
movzx eax, word [0x180068f86]
movsd qword [rbp + 0x208], xmm0
mov word [rbp + 0x210], ax
jmp 0x18002f79d
cmp r12d, 0x13f3e
ja 0x18002f555
je 0x18002f115
cmp r12d, 0xcb4e
je 0x18002f0f7
cmp r12d, 0xe84a
je 0x18002f0da
cmp r12d, 0x10546
je 0x18002f068
cmp r12d, 0x12242
jne 0x18002f79d
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
jmp 0x18002f79d
movzx eax, word [0x180068fe0]
lea r8, [rbp + 0x200]
movups xmm0, xmmword [str.tring___Ljava_lang_String_]
xor r9d, r9d
mov word [rbp + 0x230], ax
movsd xmm1, qword [0x180068fd8]
xor ecx, ecx
movzx eax, byte [0x180068fe2]
mov qword [rsp + 0x38], rbx
mov byte [rbp + 0x232], al
lea edx, [r9 + 5]
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
movups xmmword [rbp + 0x218], xmm0
movsd qword [rbp + 0x228], xmm1
call fcn.1800561f0
mov qword [rbp - 0x68], rax
jmp 0x18002f78d
mov dword [rbp + 0x1c6], 0x322f3664
mov byte [rbp + 0x1ca], bl
mov dword [rsp + 0x70], 7
jmp 0x18002f79d
mov word [rbp + 0x1c0], dx
mov word [rbp + 0x1c1], r8w
mov dword [rbp + 0x1c2], 0x65726961
jmp 0x18002f79d
mov ecx, 0x202
lea rdx, [rbp - 0x10]
call qword [rbp - 0x68]
test eax, eax
je 0x18002f549
mov esi, 0xf0
mov dword [rsp + 0x50], esi
cmp esi, 0x5b4
ja 0x18002f272
je 0x18002f261
cmp esi, 0x352
ja 0x18002f214
je 0x18002f1e4
mov eax, esi
sub eax, 0xf0
je 0x18002f1b4
sub eax, 0x7a
je 0x18002f1a8
sub eax, 0x7a
je 0x18002f192
sub eax, 0x7a
je 0x18002f183
cmp eax, 0x7a
jne 0x18002f532
mov word [rbp + 0x1a0], bx
jmp 0x18002f532
mov dword [rbp + 0x19c], 0x5f0072
jmp 0x18002f532
mov dword [rbp + 0x198], 0x650073
mov word [rbp + 0x19c], bx
jmp 0x18002f532
mov word [rbp + 0x198], bx
jmp 0x18002f532
mov r8d, 2
mov dword [rbp + 0x190], 0x720062
lea rdx, [0x180068ed6]
mov word [rbp + 0x194], bx
lea rcx, [rbp + 0x194]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x18002f532
mov r8d, 3
lea rdx, [0x180068e7e]
lea rcx, [rbp + 0x190]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov dword [rbp + 0x1a6], 0x6f0069
mov word [rbp + 0x1aa], bx
jmp 0x18002f532
mov eax, esi
sub eax, 0x3cc
je 0x18002f252
sub eax, 0x7a
je 0x18002f246
sub eax, 0x7a
je 0x18002f23c
cmp eax, 0x7a
jne 0x18002f532
mov dil, 1
mov qword [rbp - 0x60], rbx
jmp 0x18002f52e
mov byte [rsp + 0x40], 1
jmp 0x18002f532
mov word [rbp + 0x1ae], bx
jmp 0x18002f532
mov dword [rbp + 0x1aa], 0x5f006e
jmp 0x18002f532
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x64], 0xf003f
jmp 0x18002f532
cmp esi, 0x816
ja 0x18002f301
je 0x18002f2c7
mov eax, esi
sub eax, 0x62e
je 0x18002f532
sub eax, 0x7a
je 0x18002f2ba
cmp eax, 0x7a
jne 0x18002f532
mov edx, dword [rsp + 0x58]
lea r9, [rsp + 0x5c]
mov rcx, qword [rbp - 0x60]
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Lock]
mov qword [rbp - 0x80], rax
jmp 0x18002f532
mov dword [rsp + 0x5c], ebx
mov dword [rsp + 0x60], ebx
jmp 0x18002f532
mov eax, dword [rsp + 0x60]
lea r9, [rbp - 0x78]
mov edx, dword [rsp + 0x64]
lea rcx, [rbp + 0x190]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHLWAPI.dll_SHRegOpenUSKeyW]
movzx ecx, byte [rsp + 0x40]
mov edx, ebx
cmp qword [rbp - 0x80], rdx
mov r13d, eax
cmovne edx, ecx
mov byte [rsp + 0x40], dl
jmp 0x18002f532
mov eax, esi
sub eax, 0x890
je 0x18002f524
sub eax, 0x7a
je 0x18002f35f
sub eax, 0x7a
je 0x18002f356
cmp eax, 0x7a
jne 0x18002f532
mov rax, qword [rsp + 0x78]
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.1800643d0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov byte [rsp + 0x78], bl
jmp 0x18002f532
cmp byte [rsp + 0x40], bl
je 0x18002f36f
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Unlock]
test dil, dil
je 0x18002f532
mov edi, 0xed
mov r12d, 0x65
cmp edi, 0x32eb
ja 0x18002f470
je 0x18002f44d
cmp edi, 0x19ec
ja 0x18002f405
je 0x18002f3ea
cmp edi, 0xed
je 0x18002f3d9
cmp edi, 0x942
je 0x18002f3ca
cmp edi, 0x1197
jne 0x18002f503
mov dword [rbp + 0x1d6], 0x740073
jmp 0x18002f503
mov dword [rbp + 0x1d2], 0x75006c
jmp 0x18002f503
mov eax, 0x63
mov word [rbp + 0x1d0], ax
jmp 0x18002f503
mov eax, 0x5f
mov dword [rbp + 0x1da], 0x720065
mov word [rbp + 0x1de], ax
jmp 0x18002f503
cmp edi, 0x2241
je 0x18002f432
cmp edi, 0x2a96
jne 0x18002f503
mov dword [rbp + 0x1e6], 0x630065
mov dword [rbp + 0x1ea], 0x64006f
jmp 0x18002f503
mov eax, 0x6d
mov dword [rbp + 0x1e0], 0x690074
mov word [rbp + 0x1e4], ax
jmp 0x18002f503
mov eax, 0x3e
mov word [rbp + 0x1ee], r12w
mov word [rbp + 0x1f4], ax
mov dword [rbp + 0x1f0], 0x20005f
jmp 0x18002f503
cmp edi, 0x3b40
je 0x18002f4ef
cmp edi, 0x4395
je 0x18002f4cd
cmp edi, 0x4bea
je 0x18002f4c8
cmp edi, 0x543f
je 0x18002f4a4
cmp edi, 0x5c94
jne 0x18002f503
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.SHLWAPI.dll_SHRegCloseUSKey]
jmp 0x18002f503
mov rcx, qword [rbp - 0x78]
lea r9, [rsp + 0x68]
movzx edx, r15w
lea r8, [rbp + 0x1d0]
mov dword [rsp + 0x20], r14d
call qword [sym.imp.SHLWAPI.dll_SHRegEnumUSKeyW]
mov r13d, eax
jmp 0x18002f503
mov r14d, ebx
jmp 0x18002f503
mov r15d, ebx
lea rcx, [rbp + 0x1d0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], bx
jne 0x18002f4e0
mov dword [rsp + 0x68], eax
jmp 0x18002f503
mov dword [rbp + 0x1f6], 0x2d0020
mov dword [rbp + 0x1fa], 0x31
add edi, 0x855
cmp edi, 0x63fc
jbe 0x18002f383
mov esi, dword [rsp + 0x50]
mov r12d, dword [rsp + 0x54]
mov edi, dword [rsp + 0x48]
jmp 0x18002f532
test r13d, r13d
movzx edi, dil
cmovne edi, ebx
mov dword [rsp + 0x48], edi
add esi, 0x7a
mov dword [rsp + 0x50], esi
cmp esi, 0xa78
jb 0x18002f132
mov rsi, qword [rbp - 0x58]
mov dword [rbp - 0x48], 0x30
jmp 0x18002f78d
cmp r12d, 0x15c3a
je 0x18002f5b9
cmp r12d, 0x17936
je 0x18002f579
cmp r12d, 0x19632
je 0x18002f321
jmp 0x18002f79d
lea r8, [rbp + 0x240]
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x218]
call qword [sym.imp.dbghelp.dll_SearchTreeForFile]
mov r9d, 1
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call fcn.180044120
mov byte [rsp + 0x78], al
jmp 0x18002f78d
mov r8, rsi
mov edx, 0xaf
xor ecx, ecx
call fcn.180044830
test al, al
jne 0x18002f77f
mov edi, 0x92
nop word [rax + rax]
cmp edi, 0xcde2
ja 0x18002f6ed
je 0x18002f6d4
cmp edi, 0x673a
ja 0x18002f68a
je 0x18002f67b
cmp edi, 0x92
je 0x18002f652
cmp edi, 0x22ca
je 0x18002f643
cmp edi, 0x4502
jne 0x18002f769
mov eax, 0x72
mov dword [rbp + 0x197], 0x507472
mov word [rbp + 0x19a], ax
mov eax, 0x6f
mov word [rbp + 0x19b], ax
jmp 0x18002f769
mov dword [rbp + 0x194], 0x6f506e
jmp 0x18002f769
mov eax, 0x56
mov word [rbp + 0x190], ax
mov eax, 0x73
mov word [rbp + 0x191], ax
mov eax, 0x6170
mov word [rbp + 0x192], ax
jmp 0x18002f769
mov dword [rbp + 0x19c], 0x73696d
jmp 0x18002f769
cmp edi, 0x8972
je 0x18002f6c3
cmp edi, 0xabaa
jne 0x18002f769
mov eax, 0x75
mov dword [rbp + 0x1a1], 0x6e6168
mov word [rbp + 0x1a8], ax
mov dword [rbp + 0x1a4], 0x61466567
jmp 0x18002f769
mov eax, 0x4363
mov word [rbp + 0x19f], ax
jmp 0x18002f769
mov eax, 0x746c
mov byte [rbp + 0x1ab], bl
mov word [rbp + 0x1a9], ax
mov byte [rsp + 0x44], 1
jmp 0x18002f769
cmp edi, 0xf01a
je 0x18002f75e
cmp edi, 0x11252
je 0x18002f754
cmp edi, 0x1348a
je 0x18002f727
cmp edi, 0x156c2
je 0x18002f71b
cmp edi, 0x178fa
je 0x18002f321
jmp 0x18002f769
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov byte [rsp + 0x78], bl
jmp 0x18002f769
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x6c]
lea rcx, [rbp - 0x50]
call sub.RPCRT4.dll_MesEncodeDynBufferHandleCreate
test eax, eax
je 0x18002f743
mov byte [rsp + 0x44], bl
jmp 0x18002f769
cmp byte [rsp + 0x44], bl
je 0x18002f769
mov rcx, qword [rbp - 0x70]
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18002f769
mov dword [rsp + 0x6c], ebx
mov qword [rbp - 0x70], rbx
jmp 0x18002f769
lea rax, [rbp + 0x190]
mov qword [rbp - 0x50], rax
add edi, 0x2238
cmp edi, 0x19aa0
jbe 0x18002f5e0
mov edi, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x70]
lea rdx, [rbp - 0x48]
call qword [sym.imp.SHELL32.dll_SHAppBarMessage]
mov ecx, 0x6c
lea edx, [rcx - 0x3d]
lea r8d, [rcx + 4]
lea r9d, [rcx + 0xb]
imul eax, dword [rsp + 0x74], 0x46
add r12d, eax
mov dword [rsp + 0x54], r12d
cmp r12d, dword [rsp + 0x4c]
jbe 0x18002eec0
jmp 0x18002f321
mov rcx, qword [rsi + 0x2a0]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x5d
xor edx, edx
mov qword [rsp + 0x20], rbx
call fcn.18005fa70
mov rdx, qword [rsi + 0x2c8]
mov ecx, 0xb
mov rbx, rax
call fcn.18001f300
mov rcx, qword [rsi + 0x278]
add rcx, qword [rsi + 0x250]
add rcx, qword [rsi + 0xb0]
add rcx, rax
lea rax, [rbx + 0x2d0]
add rax, rcx
jmp 0x18002f326