Function at 0x140018bdc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor r12d, r12d
mov sil, dl
mov rbx, rcx
test rcx, rcx
je 0x140018e08
test dl, dl
je 0x140018c1a
cmp dword [0x14007e3d8], r12d
mov eax, r12d
sete al
jmp 0x140018c48
test byte [rcx + 0x18], 0x10
jne 0x140018c45
mov eax, dword [0x14007e700]
test eax, eax
je 0x140018c32
cmp eax, 2
sete al
jmp 0x140018c3c
cmp byte [0x14007e760], r12b
setne al
test al, al
mov eax, 1
jne 0x140018c48
mov eax, r12d
test eax, eax
jne 0x140018e08
lea rcx, [0x14007eb38]
mov dword [rbp + 0x30], r12d
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, 1
lock xadd dword [rbp - 0x28], eax
test eax, eax
jne 0x140018c8a
cmp dword [rbp - 0x24], r12d
jne 0x140018e23
call qword [sym.imp.MSVCP140.dll__Thrd_id]
mov dword [rbp - 0x24], eax
mov eax, dword [rbp + 0x30]
mov edi, r12d
cmp edi, 4
jge 0x140018df6
mov eax, dword [rbx + 0x1c]
lea rcx, [rbp - 0x20]
mov rdx, qword [rbx + 0x10]
mov r14b, r12b
movzx r15d, sil
mov r9d, r15d
mov qword [rbp + 0x40], r12
shl r9d, 5
mov dword [rsp + 0x20], eax
call fcn.140017150
mov rcx, rax
mov eax, dword [rax]
mov dword [rbp + 0x30], eax
mov rax, qword [rcx + 8]
mov qword [rcx + 8], r12
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0x40], rax
test rcx, rcx
je 0x140018ce9
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14003f18e.0]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140018d03
mov qword [rbp - 0x18], r12
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14003f18e.0]
mov eax, dword [rbp + 0x30]
test eax, eax
je 0x140018d72
test sil, sil
je 0x140018d6e
mov eax, dword [rbx + 0x1c]
lea r9d, [r15 + r15]
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x20], eax
call fcn.140017150
mov rcx, rax
mov eax, dword [rax]
mov dword [rbp + 0x30], eax
mov rax, qword [rcx + 8]
mov qword [rcx + 8], r12
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0x40], rax
test rcx, rcx
je 0x140018d51
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14003f18e.0]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140018d6b
mov qword [rbp - 8], r12
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14003f18e.0]
mov eax, dword [rbp + 0x30]
test eax, eax
jne 0x140018dce
mov rax, qword [rbp + 0x40]
xor r9d, r9d
mov rdx, qword [rbx]
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov rcx, qword [rax + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 0x30], eax
cmp eax, 0x3f2
je 0x140018da9
cmp eax, 0x3fa
je 0x140018da9
cmp eax, 6
jne 0x140018dce
mov rcx, qword [rbx + 0x10]
lea rdx, [0x14007c190]
movzx eax, word [rcx + 0xa]
and eax, 0x1f
shl rax, 5
mov qword [rax + rdx], r12
call fcn.140015914
mov eax, dword [rbp + 0x30]
mov r14b, 1
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140018deb
mov qword [rbp + 0x40], r12
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14003f18e.0]
mov eax, dword [rbp + 0x30]
inc edi
test r14b, r14b
jne 0x140018c90
test eax, eax
lea rcx, [rbp - 0x30]
sete bl
call fcn.1400105e8
mov al, bl
jmp 0x140018e0a
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor edx, edx
mov ecx, 0x131f4c4
call fcn.140015658
int3