Function at 0x180068820
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x1800a74e0]
xor rax, rsp
mov qword [rbp + 0x27], rax
lea esi, [rcx + 0xe]
mov r15, rdx
cmp ecx, esi
jae 0x180068aa8
mov ebx, dword [rbp - 0x41]
lea edi, [rcx - 0x4f]
mov r14, qword [rbp - 0x51]
lea r12, [0x180000000]
mov edx, 0x50
lea r8d, [rdx + 0x1f]
lea r13d, [rdx - 9]
lea r9d, [rdx + 0x24]
cmp edi, 0x23
ja case.0x18006889f.7
movzx eax, byte [r12 + rdi + 0x68ca4]
mov ecx, dword [r12 + rax*4 + 0x68c68]
add rcx, r12
jmp rcx
movzx eax, word [0x180099f78]
mov word [rbp - 8], dx
mov word [rbp - 7], r8w
mov word [rbp - 6], ax
movzx eax, byte [0x180099f7a]
mov byte [rbp - 4], al
jmp case.0x18006889f.7
mov dword [r15 + 8], 0
jmp case.0x18006889f.7
xor ebx, ebx
jmp case.0x18006889f.7
mov rcx, qword [rbp - 0x39]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xb7
call fcn.18005ec10
mov qword [rbp - 0x39], 0
mov edx, 0x50
lea r8d, [rdx + 0x1f]
lea r9d, [rdx + 0x24]
jmp case.0x18006889f.7
lea rdx, [rbp - 0x51]
mov ecx, 0x79
call fcn.18006bea0
jmp 0x1800688f4
lea rdx, [rbp - 0x51]
mov ecx, 0xf7
call fcn.180075c60
test eax, eax
je 0x1800688f4
nop dword [rax + rax]
xor edx, edx
lea rcx, [rbp - 0x51]
mov r8d, 0xbd
call fcn.18004c810
lea rdx, [rbp - 0x51]
mov ecx, 0xf7
inc ebx
call fcn.180075c60
test eax, eax
jne 0x180068930
jmp 0x1800688f4
mov r8d, 0x102
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x39]
call fcn.180065200
lea rdx, [rbp - 0x51]
mov ecx, 0x79
call fcn.18006bea0
lea rdx, [rbp - 0x51]
mov ecx, 0xf7
call fcn.180075c60
test eax, eax
je 0x1800688f4
nop
xor edx, edx
lea rcx, [rbp - 0x51]
mov r8d, 0xbd
call fcn.18004c810
inc ebx
test bl, 1
jne 0x1800689c4
lea rdx, [rbp - 0x51]
mov ecx, 0x79
call fcn.18006bea0
lea rdx, [rbp - 0x51]
mov ecx, 0x79
call fcn.18006bea0
lea rdx, [rbp - 0x51]
mov ecx, 0xf7
call fcn.180075c60
test eax, eax
jne 0x180068990
jmp 0x1800688f4
lea rcx, [rbp - 0x11]
mov word [rbp - 0x11], r13w
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1800689f0
mov eax, dword [str.etSys]
mov dword [rcx], eax
movzx eax, word [0x180099f98]
mov word [rcx + 4], ax
mov dword [rbp - 0xb], 0x6d6574
jmp case.0x18006889f.7
mov qword [rbp - 0x39], 0
jmp case.0x18006889f.7
xor ebx, ebx
lea rdx, [rbp - 0x51]
mov r8d, 0x102
lea rcx, [rbp - 0x39]
call fcn.180065200
jmp 0x1800688f4
movzx eax, word [0x180099f9c]
lea r8, [rbp - 0x11]
mov word [rbp], r9w
lea rdx, str.kernel32.dll
mov word [rbp + 1], ax
mov ecx, 0x3d
movzx eax, byte [0x180099f9e]
mov byte [rbp + 3], al
call fcn.18004d9b0
mov r14, rax
jmp 0x1800688f4
lea rcx, [rbp - 0x11]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180068a80
movzx eax, word [0x1800979b0]
mov word [rcx], ax
mov dword [rbp - 3], 0x617453
inc edi
lea eax, [rdi + 0x4f]
cmp eax, esi
jb 0x180068882
movzx eax, byte [rbp - 0x59]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1800864a0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [rbp - 0x21]
call r14
test eax, eax
jne 0x180068c5a
movzx esi, byte [rbp - 0x59]
lea edi, [rax + 0x1f]
mov r14d, dword [rbp - 0x41]
lea r12d, [rax + 0x68]
movabs r15, 0x756c657474696a
xor r13d, r13d
cmp edi, 0x3d27
ja 0x180068bd8
je 0x180068bb6
cmp edi, 0x1f
je 0x180068b91
cmp edi, 0x1477
je 0x180068b41
cmp edi, 0x28cf
jne 0x180068c48
mov qword [rbp + 0x19], r15
mov sil, 1
mov r14d, 0xf003f
jmp 0x180068c48
mov eax, dword [str._symb]
lea rcx, [rbp + 7]
mov dword [rbp + 9], 0x617469
dec rcx
mov dword [rbp + 0xc], eax
movzx eax, word [0x180099f80]
mov word [rbp + 0x10], ax
cmp byte [rcx + 1], r13b
lea rcx, [rcx + 1]
jne 0x180068b63
mov eax, dword [0x180099f84]
lea rdx, str.t__la
mov dword [rcx], eax
mov r8d, 6
lea rcx, [rbp + 0x14]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180068c48
mov r8d, 1
mov byte [rbp + 7], r13b
lea rdx, [0x180099f90]
lea rcx, [rbp + 7]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov word [rbp + 8], r12w
jmp 0x180068c48
lea r9, [rbp - 0x51]
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, [rbp + 7]
mov edx, r14d
call qword [sym.imp.SHLWAPI.dll_SHRegOpenUSKeyA]
test eax, eax
je 0x180068c48
xor sil, sil
jmp 0x180068c48
cmp edi, 0x517f
je 0x180068bef
cmp edi, 0x65d7
jne 0x180068c48
xor al, al
jmp 0x180068aac
test sil, sil
je 0x180068c48
mov ebx, 0xc3
nop dword [rax]
mov eax, ebx
sub eax, 0xc3
je 0x180068c1a
cmp eax, 1
jne 0x180068c3e
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.SHLWAPI.dll_SHRegCloseUSKey]
jmp 0x180068c3e
mov rcx, qword [rbp - 0x51]
lea rax, [rbp - 0x41]
mov dword [rsp + 0x28], r13d
lea r9, [rbp - 0x31]
lea r8, [rbp - 0x2d]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x29]
call qword [sym.imp.SHLWAPI.dll_SHRegQueryInfoUSKeyA]
inc ebx
cmp ebx, 0xc5
jb 0x180068c00
add edi, 0x1458
cmp edi, 0x7a10
jbe 0x180068b04
cmp byte [rbp - 0x21], 1
sete al
jmp 0x180068aac