Function at 0x1800156a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x1800312f8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
imul edi, ecx, 0x549
xor ebp, ebp
mov r15, r8
mov r14, rdx
mov r13d, ecx
mov ebx, ebp
mov esi, ecx
mov dword [rsp + 0x44], edi
cmp ecx, edi
ja 0x1800158ac
movzx r12d, byte [rsp + 0x40]
mov ecx, 0x75
lea eax, [rcx - 2]
cmp esi, 0x1342
ja 0x180015878
je 0x180015817
cmp esi, 0xa
je 0x1800157a2
cmp esi, 0x97
je 0x180015989
cmp esi, 0x4d8
je 0x180015765
cmp esi, 0x9a6
je 0x180015758
cmp esi, 0xe74
jne 0x180015976
mov rcx, qword [r14 + 0x40]
mov edx, 0xffffffff
mov qword [rsp + 0x58], 0xffffffff80000001
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x180015976
mov word [rsp + 0xa2], ax
jmp 0x180015976
mov r8d, 5
lea rdx, str.opert
lea rcx, [rsp + 0x90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x18002b11c]
mov word [rsp + 0xa0], ax
movzx eax, byte [0x18002b11e]
mov byte [rsp + 0xa2], al
jmp 0x180015976
mov eax, dword [str.sedS]
lea rdx, [0x18002b12c]
mov word [rsp + 0x90], cx
mov r8d, 2
mov dword [rsp + 0x91], eax
lea rcx, [rsp + 0x97]
movzx eax, word [0x18002b128]
mov word [rsp + 0x95], ax
movzx eax, byte [0x18002b12a]
mov byte [rsp + 0x97], al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rax, [rsp + 0x90]
dec rax
nop word [rax + rax]
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x180015800
mov ecx, dword [0x18002b130]
mov dword [rax], ecx
jmp 0x180015976
mov rbp, qword [r14 + 0x20]
mov rbx, qword [r14 + 0x18]
cmp rbx, rbp
je 0x180015854
lea rdi, [rbx + 0x28]
cmp rdi, rbp
je 0x180015850
nop dword [rax]
mov r8d, 0x87
mov rdx, rdi
mov rcx, rbx
call fcn.18000ff80
test al, al
cmovne rbx, rdi
add rdi, 0x28
cmp rdi, rbp
jne 0x180015830
mov edi, dword [rsp + 0x44]
movups xmm0, xmmword [str.V16fV16fCV16fUs]
movzx eax, byte [0x18002b110]
xor ebp, ebp
mov byte [rsp + 0xb8], al
movups xmmword [rsp + 0xa8], xmm0
jmp 0x180015976
cmp esi, 0x1810
je 0x180015934
cmp esi, 0x1cde
je 0x18001592e
cmp esi, 0x21ac
je 0x1800158e5
cmp esi, 0x267a
je 0x1800158db
cmp esi, 0x2b48
jne 0x180015976
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800245e0
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov byte [rsp + 0x54], r12b
jmp 0x180015976
mov rcx, qword [r14 + 0x40]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov r9d, dword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x90]
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], ebp
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueA]
jmp 0x180015976
mov dword [rsp + 0x4c], ebp
jmp 0x180015976
xor r12b, r12b
mov dword [rsp + 0x50], 0x10
cmp rbx, qword [r14 + 0x20]
je 0x180015976
mov r12b, 1
cmp r15, rbx
je 0x180015966
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x18001595a
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, r15
call fcn.1800206c0
movzx eax, word [rbx + 0x20]
mov word [r15 + 0x20], ax
mov eax, dword [rbx + 0x24]
mov dword [r15 + 0x24], eax
imul eax, r13d, 0x7b
add esi, eax
cmp esi, edi
ja 0x1800158ac
jmp 0x1800156f0
mov qword [rsp + 0x28], rbp
lea rdx, str.kernel32.dll
xor r9d, r9d
mov dword [rsp + 0x20], 0x70
xor r8d, r8d
lea rcx, str.GetSystemInfo
call fcn.18000a1b0
lea rcx, [rsp + 0x60]
call rax
mov eax, dword [rsp + 0x80]
jmp 0x1800158b0