Function at 0x18006ddc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, reloc.OLEAUT32.dll_VARIANT_UserUnmarshal
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x18013a210]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov r14, rdx
mov qword [rsp + 0x80], rdx
mov rbx, rcx
mov qword [rsp + 0x88], rdx
mov eax, dword [0x1801430f0]
test al, 1
jne 0x18006df63
or eax, 1
mov dword [0x1801430f0], eax
mov qword [0x180143000], 0xffffffff80000001
mov qword [0x180143028], 7
xor esi, esi
mov qword [0x180143020], rsi
mov word [0x180143010], si
lea r8d, [rsi + 4]
lea rdx, str.HKCU
lea rcx, [0x180143008]
call fcn.180012d90
nop
mov qword [0x180143030], 0xffffffff80000002
mov qword [0x180143058], 7
mov qword [0x180143050], rsi
mov word [0x180143040], si
lea r8d, [rsi + 4]
lea rdx, str.HKLM
lea rcx, [0x180143038]
call fcn.180012d90
nop
mov qword [0x180143060], 0xffffffff80000000
mov qword [0x180143088], 7
mov qword [0x180143080], rsi
mov word [0x180143070], si
lea r8d, [rsi + 4]
lea rdx, str.HKCR
lea rcx, [0x180143068]
call fcn.180012d90
nop
mov qword [0x180143090], 0xffffffff80000003
mov qword [0x1801430b8], 7
mov qword [0x1801430b0], rsi
mov word [0x1801430a0], si
lea r8d, [rsi + 0xa]
lea rdx, str.HKEY_USERS
lea rcx, [0x180143098]
call fcn.180012d90
nop
mov qword [0x1801430c0], 0xffffffff80000005
mov qword [0x1801430e8], 7
mov qword [0x1801430e0], rsi
mov word [0x1801430d0], si
lea r8d, [rsi + 0x13]
lea rdx, str.HKEY_CURRENT_CONFIG
lea rcx, [0x1801430c8]
call fcn.180012d90
nop
lea rcx, [0x1800ef570]
call fcn.1800bfe18
nop
jmp 0x18006df65
xor esi, esi
mov r15d, esi
mov r13, rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0xe0], 7
mov qword [rsp + 0xd8], rsi
mov word [rsp + 0xc8], si
mov qword [rsp + 0x108], 7
mov qword [rsp + 0x100], rsi
mov word [rsp + 0xf0], si
mov rcx, r14
call fcn.18006e940
or r14, 0xffffffffffffffff
mov r9, r14
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0xc0]
call fcn.180003570
cmp qword [rsp + 0xd8], 0
jne 0x18006dfeb
mov dword [rsp + 0x64], r14d
lea rdx, [0x180136c18]
lea rcx, [rsp + 0x64]
call fcn.1800c1ef0
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x90]
call fcn.18006dab0
nop
mov r9, r14
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.180003570
nop
cmp qword [rsp + 0xb0], 8
jb 0x18006e030
mov rcx, qword [rsp + 0x98]
call fcn.1800bd964
lea rcx, [rsp + 0xc0]
call fcn.18006d560
mov ebx, esi
lea rcx, [0x180143000]
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xc8]
nop
cmp ebx, 5
jae 0x18006e1c4
mov eax, ebx
lea rdi, [rax + rax*2]
shl rdi, 4
add rdi, rcx
mov r14, qword [rdi + 0x20]
or r13, 0xffffffffffffffff
cmp r14, r13
cmovb r13, r14
cmp qword [rdi + 0x28], 8
jb 0x18006e092
mov rax, qword [rdi + 0x10]
jmp 0x18006e096
lea rax, [rdi + 0x10]
cmp r12, r14
cmovb r14, r12
lea rdx, [rsp + 0xc8]
cmp r11, 8
cmovae rdx, r10
mov rcx, r13
cmp r14, r13
cmovb rcx, r14
test rcx, rcx
je 0x18006e0ec
movzx r8d, word [rdx]
movzx r9d, word [rax]
cmp r8w, r9w
je 0x18006e0df
mov eax, 1
cmp r8w, r9w
mov rdx, 0xffffffffffffffff
cmovb eax, edx
jmp 0x18006e0f2
add rdx, 2
add rax, 2
dec rcx
jmp 0x18006e0b7
mov eax, esi
or rdx, 0xffffffffffffffff
movsxd rcx, eax
test eax, eax
jne 0x18006e10c
cmp r14, r13
jb 0x18006e1b3
mov eax, esi
cmp r14, r13
setne al
mov ecx, eax
test ecx, ecx
jne 0x18006e1b3
mov rbx, qword [rdi + 0x20]
lea rax, [rbx + 1]
cmp r12, rax
ja 0x18006e136
mov dword [rsp + 0x70], edx
lea rdx, [0x180136c18]
lea rcx, [rsp + 0x70]
call fcn.1800c1ef0
cmp r12, rbx
ja 0x18006e150
call fcn.1800bd8d0
mov r11, qword [rsp + 0xe0]
mov r10, qword [rsp + 0xc8]
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
cmp word [rax + rbx*2], 0x5c
je 0x18006e180
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x74], ecx
lea rdx, [0x180136c18]
lea rcx, [rsp + 0x74]
call fcn.1800c1ef0
mov r8, qword [rdi + 0x20]
inc r8
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.180003200
mov r13, qword [rdi]
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xc8]
jmp 0x18006e1c4
inc ebx
mov r13, rsi
lea rcx, [0x180143000]
jmp 0x18006e060
test r13, r13
jne 0x18006e1e2
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x78], ecx
lea rdx, [0x180136c18]
lea rcx, [rsp + 0x78]
call fcn.1800c1ef0
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
lea rbx, [rax + r12*2]
test rbx, rbx
je 0x18006e229
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
cmp rax, rbx
ja 0x18006e229
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
lea rax, [rax + r12*2]
cmp rbx, rax
jbe 0x18006e246
call fcn.1800bf138
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xc8]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, [rsp + 0xc0]
cmp rax, 0xfffffffffffffffc
je 0x18006e2a3
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
cmp rbx, rax
ja 0x18006e2a3
call fcn.1800bf138
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xc8]
lea rdi, [rbx - 2]
mov rbx, qword [rsp + 0x50]
cmp rbx, 0xfffffffffffffffc
je 0x18006e30f
test rbx, rbx
jne 0x18006e2d4
call fcn.1800bf138
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xc8]
cmp qword [rbx + 0x20], 8
jb 0x18006e2e1
mov rcx, qword [rbx + 8]
jmp 0x18006e2e5
lea rcx, [rbx + 8]
mov rax, qword [rbx + 0x18]
lea rcx, [rcx + rax*2]
cmp rdi, rcx
jb 0x18006e30f
call fcn.1800bf138
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xc8]
cmp word [rdi], 0x5c
jne 0x18006e50f
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
lea rbx, [rax + r12*2]
test rbx, rbx
je 0x18006e360
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
cmp rax, rbx
ja 0x18006e360
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
lea rax, [rax + r12*2]
cmp rbx, rax
jbe 0x18006e37d
call fcn.1800bf138
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xc8]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, [rsp + 0xc0]
cmp rax, 0xfffffffffffffffc
je 0x18006e3f7
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
lea rcx, [rbx - 2]
lea rax, [rax + r12*2]
cmp rcx, rax
ja 0x18006e3da
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
cmp rcx, rax
jae 0x18006e3f7
call fcn.1800bf138
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xc8]
add rbx, 0xfffffffffffffffe
cmp r11, 8
jb 0x18006e40b
mov rdi, r10
test r10, r10
je 0x18006e441
jmp 0x18006e413
lea rdi, [rsp + 0xc8]
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
cmp rax, rdi
ja 0x18006e441
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
lea rax, [rax + r12*2]
cmp rdi, rax
jbe 0x18006e446
call fcn.1800bf138
test rbx, rbx
jne 0x18006e450
mov rbx, rsi
jmp 0x18006e478
mov rax, qword [rsp + 0x50]
cmp rax, 0xfffffffffffffffc
je 0x18006e472
test rax, rax
je 0x18006e46d
lea rcx, [rsp + 0xc0]
cmp rax, rcx
je 0x18006e472
call fcn.1800bf138
sub rbx, rdi
sar rbx, 1
mov r8d, 1
mov rdx, rbx
lea rcx, [rsp + 0xc0]
call fcn.180003200
lea rax, [rsp + 0xc8]
mov r8, qword [rsp + 0xc8]
mov r9, qword [rsp + 0xe0]
cmp r9, 8
cmovae rax, r8
lea rdx, [rax + rbx*2]
test rdx, rdx
je 0x18006e4f1
lea rax, [rsp + 0xc8]
cmp r9, 8
cmovae rax, r8
cmp rax, rdx
ja 0x18006e4f1
lea rcx, [rsp + 0xc8]
cmp r9, 8
cmovae rcx, r8
mov rax, qword [rsp + 0xd8]
lea rcx, [rcx + rax*2]
cmp rdx, rcx
jbe 0x18006e5db
call fcn.1800bf138
mov r9, qword [rsp + 0xe0]
mov r8, qword [rsp + 0xc8]
or r14, 0xffffffffffffffff
jmp 0x18006e5df
mov edx, 0x5c
or r14, 0xffffffffffffffff
mov r8, r14
lea rcx, [rsp + 0xc0]
call fcn.18006e860
mov rbx, rax
cmp rax, r14
jne 0x18006e56a
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xe8]
call fcn.180003570
lea rcx, [rsp + 0xc0]
call fcn.1800649e0
mov r9, qword [rsp + 0xe0]
mov r8, qword [rsp + 0xc8]
jmp 0x18006e5df
lea r8, [rax + 1]
mov r9, r14
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0xc0]
call fcn.180008690
nop
mov r9, r14
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xe8]
call fcn.180003570
nop
cmp qword [rsp + 0xb0], 8
jb 0x18006e5b6
mov rcx, qword [rsp + 0x98]
call fcn.1800bd964
mov r8, r14
mov rdx, rbx
lea rcx, [rsp + 0xc0]
call fcn.180003200
mov r9, qword [rsp + 0xe0]
mov r8, qword [rsp + 0xc8]
jmp 0x18006e5df
or r14, 0xffffffffffffffff
lea rdx, [rsp + 0xc8]
cmp r9, 8
cmovae rdx, r8
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006e77e
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18006e77e
mov dword [rsp + 0x38], esi
lea rdx, [rsp + 0xf0]
cmp qword [rsp + 0x108], 8
cmovae rdx, qword [rsp + 0xf0]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18006e6af
cmp eax, 2
jne 0x18006e699
cmp dword [rsp + 0x38], 0
jne 0x18006e699
cmp qword [rsp + 0x100], 0
jne 0x18006e699
mov byte [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov edx, eax
mov rcx, qword [rsp + 0x80]
call fcn.18006e9f0
mov r15d, 1
jmp 0x18006e77e
mov dword [rsp + 0x6c], r14d
lea rdx, [0x180136c18]
lea rcx, [rsp + 0x6c]
call fcn.1800c1ef0
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x18006e77e
mov dword [rsp + 0x34], esi
mov byte [rsp + 0x30], 0
mov rdx, rax
lea r8, [rsp + 0x30]
mov r14, qword [rsp + 0x80]
mov rcx, r14
call fcn.18006e9f0
mov rax, qword [r14 + 0x20]
cmp rax, qword [r14 + 0x18]
jne 0x18006e6eb
call fcn.1800bf138
mov rax, qword [r14 + 0x18]
lea rdx, [rsp + 0xf0]
cmp qword [rsp + 0x108], 8
cmovae rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18006e748
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x60], ecx
lea rdx, [0x180136c18]
lea rcx, [rsp + 0x60]
call fcn.1800c1ef0
mov r15d, dword [rsp + 0x34]
test r15d, r15d
je 0x18006e764
cmp r15d, 5
jbe 0x18006e77e
cmp r15d, 7
je 0x18006e77e
cmp r15d, 0xb
je 0x18006e77e
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x68], ecx
lea rdx, [0x180136c18]
lea rcx, [rsp + 0x68]
call fcn.1800c1ef0
nop
jmp 0x18006e785
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18006e79a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rsi
cmp qword [rsp + 0x108], 8
jb 0x18006e7b2
mov rcx, qword [rsp + 0xf0]
call fcn.1800bd964
mov qword [rsp + 0x108], 7
mov qword [rsp + 0x100], rsi
mov word [rsp + 0xf0], si
cmp qword [rsp + 0xe0], 8
jb 0x18006e7e6
mov rcx, qword [rsp + 0xc8]
call fcn.1800bd964
mov eax, r15d
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1800bd980
lea r11, [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret