Function at 0x1800160c0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x610]
sub rsp, 0x710
mov rax, qword [0x180097ee8]
xor rax, rsp
mov qword [rbp + 0x600], rax
mov rsi, r8
mov qword [rsp + 0x48], rcx
mov r8, rcx
lea r13d, [r9 - 0xe]
xor ecx, ecx
mov ebx, r9d
mov dword [rsp + 0x38], ebx
mov r12d, r9d
cmp r9d, r13d
jbe 0x180016186
mov r14, qword [rbp + 0x670]
lea r15d, [r9 - 0x55]
mov rdi, qword [rsp + 0x60]
lea r9d, [rcx + 0x63]
lea ebx, [rcx + 0x57]
lea edx, [rcx + 0x6f]
lea r10d, [rcx + 0x79]
nop
cmp r15d, 0x26
ja case.default.0x180016157
lea rcx, [0x180000000]
movzx eax, byte [rcx + r15 + 0x16c10]
mov ecx, dword [rcx + rax*4 + 0x16bd4]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov dword [rbp + 0x162], 0x745341
xor ecx, ecx
mov r8, qword [rsp + 0x48]
mov edx, 0x6f
dec r12d
dec r15d
lea r9d, [rdx - 0xc]
lea r10d, [rdx + 0xa]
cmp r12d, r13d
ja 0x180016130
mov ebx, dword [rsp + 0x38]
lea r14d, [rbx + 0x2d0]
mov dword [rbp - 0x80], r14d
cmp ebx, r14d
jae case.0x1800165df.25
mov rdi, qword [rsp + 0x60]
mov edx, 0x6c
movzx r12d, byte [rsp + 0x30]
mov r11d, 0x7261
mov esi, dword [rsp + 0x44]
mov r13, qword [rsp + 0x60]
mov r15, qword [rsp + 0x48]
lea r8d, [rdx + 6]
lea r9d, [rdx - 0x20]
lea r10d, [rdx - 3]
nop word [rax + rax]
cmp ebx, 0x1ad
ja 0x180016503
je 0x1800164f9
cmp ebx, 0xed
ja 0x1800164a1
je 0x18001647c
mov eax, ebx
sub eax, 0x5d
je 0x180016461
sub eax, 0x30
je 0x180016428
cmp eax, 0x30
jne 0x180016b8b
mov word [rbp + 0x1ce], cx
lea r8d, [rax - 0x2d]
lea rcx, [rbp + 0x1ce]
lea rdx, [0x18008d8f0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov edx, 0x6c
mov eax, 0x4e
mov dword [rbp + 0x1d2], edx
mov word [rbp + 0x1e0], ax
jmp 0x180016b75
xor ecx, ecx
lea rdx, [0x18008d7c4]
mov word [rbp + 0x406], cx
lea r8d, [rcx + 1]
lea rcx, [rbp + 0x3f0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, 0x53
mov word [rbp + 0x160], bx
mov word [rbp + 0x161], ax
jmp case.0x180016157.9
mov eax, 0x65
mov word [rbp + 0x404], ax
jmp case.0x180016157.9
mov qword [rsi + 0x10], 1
mov dword [rsi], 0x14
jmp case.0x180016157.9
mov rax, qword [rsi]
cmp qword [r8 + 0x78], rax
jbe case.0x1800165df.25
lea rcx, [rax + rax*8]
mov rax, qword [r8 + 0x70]
lea rdi, [rax + rcx*8]
jmp case.0x180016157.9
mov dword [rbp + 0x400], 0x72006f
jmp case.0x180016157.9
mov ebx, 0x9c
nop dword [rax + rax]
cmp ebx, 0x9c
je 0x1800162f6
cmp ebx, 0x17c4
je case.0x1800165df.25
jmp 0x18001631e
inc qword [r8 + 0xd0]
mov rax, qword [r8 + 0xc0]
test rax, rax
je 0x180016316
mov rdx, rsi
mov rcx, r8
call rax
mov r8, qword [rsp + 0x48]
mov rax, qword [r14]
mov qword [rsp + 0x50], rax
add ebx, 0x1728
cmp ebx, 0x2e50
jbe 0x1800162e0
mov ebx, 0x57
mov rax, qword [rdi]
cmp qword [rax + 0x20], 0
je case.0x180016157.9
nop
mov rax, qword [rdi]
mov rcx, qword [rax + 0x20]
mov qword [rdi], rcx
cmp qword [rcx + 0x20], 0
jne 0x180016340
jmp case.0x180016157.9
mov eax, 0x74
mov dword [rbp + 0x1a0], 0x6f004d
mov word [rbp + 0x1a8], ax
mov dword [rbp + 0x1a4], 0x6f006e
jmp case.0x180016157.9
mov word [rbp + 0x1b0], r9w
mov dword [rbp + 0x1b2], 0x740069
mov word [rbp + 0x1b6], r10w
jmp case.0x180016157.9
xor ecx, ecx
mov dword [rbp + 0x3f0], 0x55
mov word [rbp + 0x1b8], cx
jmp case.default.0x180016157
mov word [rbp + 0x1aa], dx
mov dword [rbp + 0x1ac], 0x69006e
jmp case.0x180016157.9
mov rax, qword [rdi]
lea rdx, [rdi + 8]
xor ecx, ecx
xor r8d, r8d
mov qword [rax + 8], rcx
lea r9d, [rcx + 0x3f]
call fcn.180019fc0
jmp case.0x180016157.9
mov r8d, 4
lea rdx, [0x18008d7f2]
lea rcx, [rbp + 0x3f0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, dword [0x18008d846]
xor ecx, ecx
mov dword [rbp + 0x3fa], eax
movzx eax, word [0x18008d84a]
mov word [rbp + 0x3fe], ax
mov word [rbp + 0x400], cx
jmp case.default.0x180016157
movsd xmm0, qword [str.ws2_32]
mov eax, 0x70
mov word [rbp + 0x169], ax
mov eax, dword [0x18008d8e8]
mov dword [rbp + 0x1c8], eax
mov eax, 0x2e
mov word [rbp + 0x1cc], ax
movsd qword [rbp + 0x1c0], xmm0
jmp 0x180016b8b
mov eax, 0x75
mov dword [rbp + 0x165], 0x747261
mov word [rbp + 0x168], ax
jmp 0x180016b8b
mov eax, 0x46
mov dword [rbp + 0x1e2], 0x740076
mov word [rbp + 0x1ea], ax
mov dword [rbp + 0x1e6], 0x740078
jmp 0x180016b8b
mov eax, ebx
sub eax, 0x11d
je 0x1800164ea
sub eax, 0x30
je 0x1800164d1
cmp eax, 0x30
jne 0x180016b8b
mov dword [rbp + 0x1f8], 0x650064
mov dword [rbp + 0x1fc], 0x72
jmp 0x180016b8b
mov dword [rbp + 0x1f0], 0x4c0065
mov dword [rbp + 0x1f4], 0x61006f
jmp 0x180016b8b
mov dword [rbp + 0x1ec], 0x6c0069
jmp 0x180016b8b
mov byte [rsp + 0x30], 1
jmp 0x180016b8b
cmp ebx, 0x26d
ja 0x180016ae8
je 0x180016ad1
mov eax, ebx
sub eax, 0x1dd
je 0x180016aa5
sub eax, 0x30
je 0x18001659f
cmp eax, 0x30
jne 0x180016b8b
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x1e0]
mov rcx, qword [rbp - 0x70]
lea rdx, [rbp + 0x3f0]
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor r9d, r9d
mov r8, r15
mov edx, 0xda
mov dword [rbp - 0x7c], eax
xor ecx, ecx
call fcn.18004a9e0
test al, al
jne 0x180016b70
mov ecx, 0x9d
nop
mov eax, ecx
sub eax, 0x9a
je 0x180016b9d
sub eax, 1
dec ecx
cmp ecx, 0x99
ja 0x180016580
jmp 0x180016b70
mov dword [rbp - 0x78], ecx
lea rdx, [rbp - 0x60]
mov ecx, 0x202
call qword [rsp + 0x60]
test eax, eax
je 0x180016a95
xor edx, edx
mov r14d, edx
mov dword [rsp + 0x34], edx
cmp r14d, 0x19
ja case.default.0x1800165df
lea r8, [0x180000000]
mov eax, r14d
mov ecx, dword [r8 + rax*4 + 0x16c38]
add rcx, r8
jmp rcx
mov r8d, 1
lea rdx, str.dataReductionProxy.ConfigService.FetchFailedAttemptsBeforeSuccess
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180016a71
movzx eax, r12b
cmp rdi, 0xf
mov ecx, edx
mov dword [rsp + 0x3c], edx
cmovbe ecx, eax
movzx r12d, cl
jmp case.default.0x1800165df
mov eax, dword [0x18008d94f]
mov dword [rbp + 0x179], eax
movzx eax, byte [0x18008d953]
mov byte [rbp + 0x17d], al
mov dword [rbp + 0x17e], 0x6e616472
mov byte [rbp + 0x182], 0
jmp case.default.0x1800165df
mov eax, dword [0x18008d95c]
mov dword [rbp + 0x154], eax
movzx eax, byte [0x18008d960]
mov byte [rbp + 0x158], al
mov byte [rbp + 0x159], 0
jmp case.default.0x1800165df
mov r8d, 5
lea rdx, str.Dv3_f
lea rcx, [rbp + 0x190]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180016a71
mov byte [rbp + 0x179], 0
jmp case.default.0x1800165df
mov byte [rbp + 0x150], 0
jmp case.default.0x1800165df
mov dword [rbp + 0x148], 0x31317066
mov byte [rbp + 0x14c], 0
jmp case.default.0x1800165df
mov r8d, 1
lea rdx, [0x18008d972]
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x18008d9dd]
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov dword [rbp + 0x18a], 0x6c614b20
mov byte [rbp + 0x18e], 0
jmp 0x180016a71
mov r8d, 1
mov byte [rbp + 0x186], 0
lea rdx, [0x18008da03]
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180016a71
mov qword [rsp + 0x58], rdx
lea r9, [rsp + 0x58]
mov edx, esi
lea r8, [rsp + 0x3c]
lea rcx, [rbp + 0x140]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov dword [rsp + 0x70], eax
jmp 0x180016a71
movzx eax, word [0x18008da14]
mov word [rbp + 0x174], ax
movzx eax, byte [0x18008da16]
mov byte [rbp + 0x176], al
mov eax, 0x5c3a
mov word [rbp + 0x177], ax
jmp case.default.0x1800165df
mov eax, dword [str._Z5r:_]
mov dword [rbp + 0x190], eax
movzx eax, word [0x18008da28]
mov word [rbp + 0x194], ax
movzx eax, byte [0x18008da2a]
mov byte [rbp + 0x196], al
mov byte [rbp + 0x15b], 0
jmp case.default.0x1800165df
mov dword [rbp + 0x14c], 0x7272655f
jmp case.default.0x1800165df
mov r8d, 3
lea rdx, [0x18008da2c]
lea rcx, [rbp + 0x196]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, 0x6e
lea rcx, [rbp + 0x190]
mov word [rbp + 0x198], ax
dec rcx
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1800167f0
movzx eax, word [0x18008da34]
mov word [rcx], ax
jmp 0x180016a71
mov dword [rbp + 0x182], 0x74655920
jmp case.default.0x1800165df
mov dword [rbp + 0x150], 0x6d757461
mov byte [rbp + 0x154], 0
jmp case.default.0x1800165df
mov eax, 0x6572
mov byte [rbp + 0x145], 0
mov word [rbp + 0x140], ax
movzx eax, word [0x18008da40]
mov word [rbp + 0x142], ax
movzx eax, byte [0x18008da42]
mov byte [rbp + 0x144], al
jmp case.default.0x1800165df
mov byte [rsp + 0x31], 1
mov r12b, 1
jmp case.default.0x1800165df
mov byte [rsp + 0x50], 0
jmp case.default.0x1800165df
movzx eax, word [str.Bu_filmdeki_bir_komut_dosyas]
lea rdx, [0x18008da80]
mov word [rbp + 0x170], ax
lea rcx, [rbp + 0x173]
movzx eax, byte [0x18008da52]
mov r8d, 1
mov byte [rbp + 0x172], al
mov byte [rbp + 0x173], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x174], 0
jmp 0x180016a71
test r12b, r12b
je 0x180016956
mov r15d, dword [rsp + 0x6c]
mov ebx, 0x10c
mov r14d, dword [rsp + 0x68]
nop dword [rax + rax]
mov eax, ebx
sub eax, 0x108
je 0x180016929
sub eax, 1
je 0x18001690f
sub eax, 1
je 0x18001690a
sub eax, 1
je 0x180016902
cmp eax, 1
jne 0x180016938
mov r13, rdx
jmp 0x180016938
mov rdi, rdx
mov r14d, edx
jmp 0x180016938
mov r15d, edx
jmp 0x180016938
mov r9d, r15d
mov r8d, r14d
mov edx, edi
mov rcx, r13
call qword [sym.imp.WINMM.dll_joySetCapture]
test eax, eax
je 0x180016936
xor r12b, r12b
jmp 0x180016936
test r12b, r12b
je 0x180016938
mov ecx, edi
call qword [sym.imp.WINMM.dll_joyReleaseCapture]
xor edx, edx
dec ebx
cmp ebx, 0x107
ja 0x1800168e0
mov dword [rsp + 0x68], r14d
mov r14d, dword [rsp + 0x34]
mov dword [rsp + 0x6c], r15d
mov r15, qword [rsp + 0x48]
cmp dword [rsp + 0x70], 0
mov ecx, edx
movzx eax, byte [rsp + 0x31]
cmove ecx, eax
mov byte [rsp + 0x31], cl
cmp cl, 0
je 0x1800169ed
mov rcx, qword [rsp + 0x58]
mov ebx, 0xb7
mov r15d, dword [rsp + 0x78]
mov r14d, dword [rsp + 0x74]
cmp ebx, 0xb7
je 0x180016a03
cmp ebx, 0x4d34
jne 0x1800169cb
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x78]
mov r8d, r14d
mov dword [rsp + 0x20], esi
mov edx, r15d
call sub.RPCRT4.dll_MesBufferHandleReset
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800169c9
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rsp + 0x58]
xor edx, edx
add ebx, 0x4c7d
cmp ebx, 0x98fa
jbe 0x180016982
mov dword [rsp + 0x74], r14d
mov r14d, dword [rsp + 0x34]
mov dword [rsp + 0x78], r15d
mov r15, qword [rsp + 0x48]
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x190]
call qword [sym.imp.SHLWAPI.dll_PathIsSameRootA]
jmp 0x180016a71
mov r15d, 1
mov r14d, edx
jmp 0x1800169cb
mov eax, 0x7265
mov word [rbp + 0x159], ax
jmp case.default.0x1800165df
mov r8d, 1
lea rdx, [0x18008dabe]
lea rcx, [rbp + 0x145]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, 0x765f
mov byte [rbp + 0x148], 0
mov word [rbp + 0x146], ax
jmp 0x180016a71
lea rax, [rbp + 0x140]
mov rsi, 0xffffffffffffffff
nop dword [rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x180016a60
call qword [sym.imp.WINMM.dll_joyGetNumDevs]
mov edi, eax
xor edx, edx
inc r14d
mov dword [rsp + 0x34], r14d
lea eax, [r14 + 0x93]
cmp eax, 0xad
jb 0x1800165c0
mov ebx, dword [rsp + 0x38]
mov r14d, dword [rbp - 0x80]
xor ecx, ecx
mov dword [rsp + 0x40], ecx
mov edx, 0x6c
jmp 0x180016b77
lea r9, [rbp + 0x160]
mov qword [rbp - 0x70], 0xffffffff80000001
lea r8, [rbp + 0x1c0]
xor edx, edx
mov ecx, 0xb4
call fcn.180049340
mov qword [rsp + 0x60], rax
jmp 0x180016b70
cmp dword [rbp - 0x7c], 0
movzx eax, byte [rsp + 0x30]
cmove ecx, eax
mov byte [rsp + 0x30], cl
xor ecx, ecx
jmp 0x180016b8b
mov eax, ebx
sub eax, 0x29d
je 0x180016b26
sub eax, 0x30
je 0x180016b04
cmp eax, 0x30
je case.0x1800165df.25
jmp 0x180016b8b
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x20], 0x7c
xor r8d, r8d
xor edx, edx
call fcn.18000d130
mov byte [rsp + 0x50], al
jmp 0x180016b70
mov edx, dword [rbp - 0x78]
lea r8, [rbp - 0x68]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.SHLWAPI.dll_StrToInt64ExW]
xor ecx, ecx
cmp byte [rsp + 0x30], cl
je 0x180016a9b
mov eax, dword [rsp + 0x40]
lea r8, [rbp + 0x1e0]
mov r9d, dword [rsp + 0x44]
lea rdx, [rbp + 0x3f0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov edx, 0x6c
xor ecx, ecx
mov r10d, 0x69
mov r11d, 0x7261
lea r9d, [r10 - 0x1d]
lea r8d, [r10 + 9]
add ebx, 0x30
mov dword [rsp + 0x38], ebx
cmp ebx, r14d
jb 0x1800161d0
jmp case.0x1800165df.25
mov byte [rsp + 0x50], 0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rbp + 0x600]
xor rcx, rsp
call fcn.180067b60
mov rbx, qword [rsp + 0x758]
add rsp, 0x710
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret