Function at 0x18000d5c8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
xor ebx, ebx
mov ebp, edx
mov edx, 0x104
mov rsi, rcx
mov qword [rax - 0x80], rcx
mov rcx, qword [0x180059270]
mov r14, r8
mov dword [rsp + 0x44], edx
mov dword [rax - 0x68], edx
mov dword [rax - 0x64], edx
mov r8, rdx
xor edx, edx
mov rdi, r9
mov r13d, ebx
mov r12, rbx
mov qword [rsp + 0x60], rbx
mov r15, rbx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x68], rax
cmp rax, rbx
je 0x18000dbcc
mov rcx, qword [0x180059270]
xor edx, edx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor ecx, ecx
mov rbx, rax
mov qword [rsp + 0x78], rax
cmp rax, rcx
je 0x18000db87
cmp qword [0x1800592b8], rcx
je 0x18000db87
mov rdx, qword [0x1800593e0]
lea r8, [rsp + 0x80]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
xor edi, edi
cmp eax, edi
jne 0x18000d81b
mov r12d, r13d
mov rax, qword [rsp + 0x68]
xor edx, edx
lea rcx, [rsp + 0x74]
lea r9, [rsp + 0x70]
mov r8, rbx
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov r14d, eax
cmp eax, 0xea
jne 0x18000d775
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x180059270]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x180059270]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rsp + 0x44]
mov rcx, qword [0x180059270]
add eax, 0x104
xor edx, edx
mov r8d, eax
mov dword [rsp + 0x44], eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [0x180059270]
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edx, edx
mov rbx, rax
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x68]
cmp rax, rdx
je 0x18000d806
cmp rbx, rdx
jne 0x18000d6a9
jmp 0x18000d777
xor edx, edx
cmp r14d, edx
jne 0x18000d806
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, ebp
ja 0x18000d7bf
mov r9, qword [rsp + 0x68]
lea rax, [rsp + 0x40]
mov r8, rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov edx, ebp
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.18000d26c
mov r15, qword [rsp + 0x50]
mov r12d, dword [rsp + 0x40]
jmp 0x18000d7c4
mov eax, 0x57
xor ecx, ecx
cmp eax, ecx
jne 0x18000d7ff
cmp rsi, qword [rsp + 0xe0]
je 0x18000d7e6
mov rcx, qword [0x180059270]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, r15
mov qword [rsp + 0x58], r15
mov ebp, r12d
mov dword [rsp + 0xe8], r12d
mov r13d, 1
inc edi
jmp 0x18000d6a2
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, qword [rsp + 0x60]
xor edi, edi
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x58]
call fcn.18000d000
mov ebp, dword [rsp + 0xe8]
mov rsi, qword [rsp + 0x58]
or r13d, eax
lea r9, [rsp + 0x50]
lea r8, [0x18005d3b9]
mov edx, ebp
mov rcx, rsi
mov dword [rsp + 0x40], r13d
call fcn.18001a99c
mov r14d, dword [rsp + 0xe0]
mov dword [rsp + 0x44], r14d
jmp 0x18000d9cb
mov edi, dword [rsp + 0x50]
xor r15d, r15d
cmp r12, r15
je 0x18000d894
cmp r14d, edi
jae 0x18000d88f
mov rcx, qword [0x180059270]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, r15
cmp r12, r15
jne 0x18000d8b9
mov rcx, qword [0x180059270]
mov r8, rdi
xor edx, edx
mov r14d, edi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
cmp rax, r15
je 0x18000d9d9
lea eax, [rdi - 6]
lea rdx, [r13 + 5]
mov rcx, r12
mov r8d, eax
mov ebx, eax
call sub.ntdll.dll_memcpy
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov rcx, r12
mov byte [rbx + r12], r15b
call fcn.180004ccc
mov rcx, qword [0x180059270]
cmp eax, r15d
mov eax, dword [rsp + 0x48]
cmovne eax, r15d
xor edx, edx
mov dword [rsp + 0x48], eax
sub eax, edi
add eax, ebp
mov r8d, eax
mov dword [rsp + 0x58], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, r15
je 0x18000d994
mov r15d, r13d
mov rdx, rsi
mov rcx, rax
sub r15d, esi
mov r8d, r15d
call sub.ntdll.dll_memcpy
mov eax, dword [rsp + 0x48]
xor ecx, ecx
cmp eax, ecx
je 0x18000d94c
mov rdx, qword [rsp + 0x60]
mov ecx, r15d
mov r8, rax
add rcx, rbx
call sub.ntdll.dll_memcpy
mov eax, dword [rsp + 0x48]
mov ecx, eax
mov eax, r15d
sub ebp, r15d
add rcx, rax
sub ebp, edi
lea rdx, [r13 + rdi]
add rcx, rbx
mov r8d, ebp
call sub.ntdll.dll_memcpy
cmp rsi, qword [rsp + 0xe0]
je 0x18000d985
mov rcx, qword [0x180059270]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebp, dword [rsp + 0x58]
mov rsi, rbx
mov dword [rsp + 0x40], 1
xor edi, edi
cmp dword [rsp + 0x48], edi
je 0x18000d9b0
mov r8, qword [rsp + 0x60]
mov rcx, qword [0x180059270]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rbx, rdi
je 0x18000d9db
lea r9, [rsp + 0x50]
lea r8, [0x18005d3b9]
mov edx, ebp
mov rcx, rsi
call fcn.18001a99c
mov r13, rax
cmp rax, rdi
jne 0x18000d869
jmp 0x18000d9db
xor edi, edi
lea r9, [rsp + 0x50]
lea r8, [0x18005d3c1]
mov edx, ebp
mov rcx, rsi
call fcn.18001a99c
mov r15, rax
cmp rax, rdi
je 0x18000db4f
mov r13d, dword [rsp + 0x50]
cmp r12, rdi
je 0x18000da26
cmp r14d, r13d
jae 0x18000da21
mov rcx, qword [0x180059270]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, rdi
cmp r12, rdi
jne 0x18000da49
mov rcx, qword [0x180059270]
mov r8, r13
xor edx, edx
mov dword [rsp + 0x44], r13d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
cmp rax, rdi
je 0x18000db6d
lea eax, [r13 - 9]
lea rdx, [r15 + 8]
mov rcx, r12
mov r8d, eax
mov ebx, eax
call sub.ntdll.dll_memcpy
mov edx, 0x3b
mov rcx, r12
mov byte [rbx + r12], dil
call qword [sym.imp.SHLWAPI.dll_StrChrA]
cmp rax, rdi
je 0x18000daa1
lea rcx, [rax + 1]
lea r8, [rsp + 0x58]
xor edx, edx
mov byte [rax], dil
call qword [sym.imp.SHLWAPI.dll_StrToIntExA]
cmp eax, edi
je 0x18000daa1
mov r8d, dword [rsp + 0x58]
lea rcx, [0x180059c00]
mov rdx, r12
call fcn.180007efc
mov rcx, qword [0x180059270]
mov r14d, ebp
xor edx, edx
sub r14d, r13d
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x60], rax
cmp rax, rdi
je 0x18000db4f
mov ebx, r15d
mov rdx, rsi
mov rcx, rax
sub ebx, esi
mov r8d, ebx
mov edi, ebx
call sub.ntdll.dll_memcpy
sub ebp, ebx
mov rbx, qword [rsp + 0x60]
sub ebp, r13d
lea rdx, [r15 + r13]
lea rcx, [rdi + rbx]
mov r8d, ebp
call sub.ntdll.dll_memcpy
cmp rsi, qword [rsp + 0xe0]
je 0x18000db12
mov rcx, qword [0x180059270]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r9, [rsp + 0x50]
lea r8, [0x18005d3c1]
mov r13d, 1
mov edx, r14d
mov rcx, rbx
mov rsi, rbx
mov ebp, r14d
mov dword [rsp + 0x40], r13d
call fcn.18001a99c
mov r14d, dword [rsp + 0x44]
xor edi, edi
mov r15, rax
cmp rax, rdi
jne 0x18000d9fd
jmp 0x18000db54
mov r13d, dword [rsp + 0x40]
cmp r12, rdi
je 0x18000db72
mov rcx, qword [0x180059270]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18000db72
mov r13d, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0xf8]
mov r14, qword [rsp + 0xf0]
mov rax, qword [rsp + 0x68]
xor r12d, r12d
cmp rax, r12
je 0x18000dba6
mov rcx, qword [0x180059270]
mov r8, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rbx, r12
je 0x18000dbbd
mov rcx, qword [0x180059270]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13d, r12d
je 0x18000dbcc
mov qword [r14], rsi
cmp rdi, r12
je 0x18000dbcc
mov dword [rdi], ebp
mov eax, r13d
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret