Function at 0x1800048f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x180037318]
xor rax, rsp
mov qword [rsp + 0x450], rax
test rcx, rcx
mov rsi, rcx
je 0x180004aec
cmp word [rcx], 0
je 0x180004aec
mov qword [rsp + 0x478], rbp
lea rbx, str.taskmgr.exe
lea rbp, [0x180035058]
mov rdi, qword [rbx]
test rdi, rdi
je 0x18000495b
mov rdx, rsi
mov rcx, rdi
call fcn.1800124f0
test eax, eax
je 0x180004ab1
add rbx, 8
cmp rbx, rbp
jl 0x180004940
mov rdi, qword [0x180038e58]
test rdi, rdi
mov rbp, qword [rsp + 0x478]
je 0x180004b6a
call qword [sym.imp.KERNEL32.dll_GetVersion]
lea rdx, str.SystemCurrentControlSetServiceswpsscannersvc
xor edi, edi
movzx ecx, al
lea rax, [rsp + 0x38]
mov r9d, 0x20019
mov dword [0x180038e60], ecx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180004a37
mov rbx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rsi, [0x180038c50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rdx, str.DisplayName
mov rcx, rbx
xor r8d, r8d
mov dword [rsp + 0x30], 0x410
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180004a20
mov eax, dword [rsp + 0x34]
cmp eax, 1
je 0x180004a0a
cmp eax, 2
jne 0x180004a20
movzx eax, word [0x180038c50]
cmp dword [rsp + 0x30], edi
cmove ax, di
mov word [0x180038c50], ax
mov rcx, rsi
call qword [sym.imp.USER32.dll_CharLowerW]
test rbx, rbx
je 0x180004a37
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, str.iexplore.exe
cmp qword [0x180038e58], rax
jne 0x180004abd
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x40e
mov word [rsp + 0x40], di
call fcn.180011580
lea rdx, [rsp + 0x40]
lea rcx, [0x180000000]
mov r8d, 0x208
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.Proxy.dll
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x180004b6a
call fcn.180003bb0
jmp 0x180004b6a
mov qword [0x180038e58], rdi
jmp 0x18000496b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
test rax, rax
je 0x180004b6a
lea rdx, [0x180003270]
mov r8d, 1
mov rcx, rax
call qword [sym.imp.USER32.dll_EnumDesktopWindows]
jmp 0x180004b6a
xor bl, bl
xor edi, edi
cmp byte [0x180038e64], bl
je 0x180004b27
mov rcx, qword [0x180038e78]
mov esi, 1
lea r8, [rsp + 0x30]
mov edx, esi
mov dword [rsp + 0x30], edi
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x180004b27
cmp dword [rsp + 0x30], 0x7ffffffe
movzx ebx, bl
cmove ebx, esi
mov rcx, qword [0x180038e78]
test rcx, rcx
je 0x180004b40
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x180038e78], rdi
mov rcx, qword [0x180038e70]
test rcx, rcx
je 0x180004b6a
test bl, bl
je 0x180004b5d
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x180038e70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x180038e70], rdi
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1800111b0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret