Function at 0x18001b3b4
Capabilities:
Get file attributes
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
xor r8d, r8d
mov r12, r9
mov r14d, edx
mov rdi, rcx
mov esi, r8d
test rcx, rcx
jne 0x18001b3f0
xor eax, eax
jmp 0x18001bb82
mov al, byte [rcx + 0x14]
test al, 0xf9
jne 0x18001bb47
cmp al, 6
je 0x18001bb47
cmp qword [rcx + 0x20], r8
je 0x18001b43a
mov r8, qword [rcx + 8]
mov ecx, r14d
sub ecx, 1
je 0x18001b42a
cmp ecx, 3
mov ecx, 1
je 0x18001b423
xor edx, edx
jmp 0x18001b432
mov edx, 0x20
jmp 0x18001b432
mov edx, 0x40
lea ecx, [rdx - 0x3f]
call fcn.18005781c
xor r8d, r8d
mov rax, rdi
mov r15d, dword [0x18008b2a0]
mov r13d, 0x20
cmp qword [rax + 0x28], r8
jne 0x18001b45f
mov rax, qword [rax + 0x48]
test rax, rax
jne 0x18001b43d
mov qword [rbp - 0x30], r8
jmp 0x18001b472
mov esi, 1
mov qword [rbp - 0x30], rsi
cmp qword [rdi + 0x20], r8
jne 0x18001b68c
cmp byte [rdi + 0x14], 2
je 0x18001b68c
mov rax, qword gs:[0x58]
mov r9b, 2
mov rdx, qword [rdi + 8]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r8
mov rcx, qword [rax + r15*8]
mov r8d, dword [rdi + 0x10]
mov rcx, qword [rcx + r13]
call fcn.1800448bc
mov ebx, eax
xor eax, eax
test ebx, ebx
jne 0x18001bb80
test esi, esi
je 0x18001b821
cmp byte [rdi + 0x14], 2
jne 0x18001b821
xor r12d, r12d
mov ecx, r14d
sub ecx, 1
je 0x18001b860
cmp ecx, 3
jne 0x18001b81d
mov rdx, qword [rdi + 8]
lea r9, [rbp - 0x28]
mov r8d, 0x20019
lea ecx, [rax + 4]
mov r14d, eax
call fcn.18005cd24
xor edx, edx
mov ebx, eax
test eax, eax
jne 0x18001b7a0
mov dword [rbp - 0x38], edx
mov qword [rbp - 0x20], r15
mov esi, 0x18
mov edx, 0x208
mov ecx, 0x40
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r14, rax
xor eax, eax
test r14, r14
je 0x18001b764
mov r15d, dword [rbp - 0x38]
lea r9, [rbp + 0x48]
mov rcx, qword [rbp - 0x28]
mov r8, r14
mov qword [rsp + 0x38], rax
mov edx, r15d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x48], 0x104
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
xor edx, edx
mov r12d, eax
test eax, eax
jne 0x18001b6fe
inc r15d
or eax, 0xffffffff
mov dword [rbp - 0x38], r15d
mov r15, qword [rdi + 0x40]
test r15, r15
je 0x18001b5c1
mov rcx, qword [r15]
test rcx, rcx
je 0x18001b5ab
mov rcx, qword [rcx]
mov rdx, r14
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
xor edx, edx
test eax, eax
jns 0x18001b5b4
mov r15, qword [r15 + 8]
test r15, r15
jne 0x18001b58b
test r15, r15
je 0x18001b5c1
test eax, eax
jle 0x18001b740
mov rax, qword [rdi + 8]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], dx
jne 0x18001b5c9
mov eax, dword [rbp + 0x48]
inc eax
add eax, ecx
xor ecx, ecx
mov dword [rbp + 0x48], eax
lea edx, [rax + 1]
add rdx, rdx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x18001b764
mov edx, dword [rbp + 0x48]
lea r8, str._s_s
mov r9, qword [rdi + 8]
inc edx
mov rcx, rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.msvcrt.dll_swprintf_s]
nop dword [rax + rax]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
xor eax, eax
mov r14d, eax
cmp qword [rbp - 0x30], rax
je 0x18001b655
cmp byte [rdi + 0x14], 2
jne 0x18001b655
mov r9d, dword [rdi + 0x18]
lea edx, [rax + 4]
and r9d, 0xc
mov rcx, r15
call fcn.18001a8dc
mov ebx, eax
test ebx, ebx
je 0x18001b66e
mov r9, r15
mov r8d, 0x1c42
mov edx, ebx
mov ecx, 1
call fcn.180038d90
mov rcx, r15
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
xor edx, edx
test ebx, ebx
jne 0x18001b769
jmp 0x18001b740
mov eax, dword [rdi + 0x18]
mov r8d, r14d
mov r9, qword [rdi + 0x28]
mov edx, dword [rdi + 0x10]
mov rcx, qword [rdi + 8]
mov dword [rsp + 0x20], eax
call fcn.18001ae48
mov ebx, eax
cmp eax, 5
je 0x18001bb27
cmp eax, 0x780
je 0x18001bb27
cmp eax, 0x20
je 0x18001bb27
add eax, 0xfffffffe
test eax, 0xfffffffa
jne 0x18001b4a9
cmp ebx, 7
je 0x18001b4a9
mov edx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov esi, 0x18
mov rax, qword [rax + rdx*8]
mov dword [rsi + rax], ebx
xor eax, eax
jmp 0x18001bb7e
cmp r12d, 0x103
je 0x18001b740
mov rax, qword [rbp - 0x20]
mov r9b, 5
mov rcx, qword gs:[0x58]
mov r8d, 1
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdx
mov rdx, qword [rdi + 8]
mov rbx, qword [rcx + rax*8]
mov rcx, qword [r13 + rbx]
call fcn.1800448bc
xor edx, edx
mov dword [rsi + rbx], r12d
mov ebx, edx
test r14, r14
je 0x18001b756
mov rcx, r14
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
xor edx, edx
mov r14, rdx
test r12d, r12d
je 0x18001b50e
jmp 0x18001b769
mov ebx, 8
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test r12d, r12d
je 0x18001b7e7
cmp r12d, 0x103
je 0x18001b7e7
mov r9, qword [rdi + 8]
mov r8d, 0x1c39
mov edx, r12d
mov ecx, 1
call fcn.180038d90
jmp 0x18001b7e7
mov rax, qword gs:[0x58]
mov r9b, 5
mov dword [rsp + 0x28], edx
mov r8d, 1
mov qword [rsp + 0x20], rdx
mov rdx, qword [rdi + 8]
mov r15, qword [rax + r15*8]
mov rcx, qword [r13 + r15]
call fcn.1800448bc
lea eax, [rbx - 2]
test eax, 0xfffffffa
jne 0x18001b7f8
cmp ebx, 7
je 0x18001b7f8
mov esi, 0x18
mov dword [rsi + r15], ebx
xor ebx, ebx
test r14, r14
je 0x18001bb1d
mov rcx, r14
jmp 0x18001bb11
cmp ebx, 5
je 0x18001b80e
cmp ebx, 0x780
je 0x18001b80e
cmp ebx, 0x20
jne 0x18001bb1d
mov esi, 0x18
mov dword [rsi + r15], ebx
xor ebx, ebx
mov r14d, dword [rbp + 0x50]
mov r12, qword [rbp + 0x60]
mov rdi, qword [rdi + 0x40]
test rdi, rdi
je 0x18001bb80
mov rsi, qword [rbp + 0x58]
mov rcx, qword [rdi]
test rcx, rcx
je 0x18001b852
mov r9, r12
mov r8, rsi
mov edx, r14d
call fcn.18001b3b4
mov ebx, eax
test eax, eax
jne 0x18001bb80
mov rdi, qword [rdi + 8]
test rdi, rdi
jne 0x18001b832
jmp 0x18001bb80
mov edx, 0x230
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x18001b885
mov ebx, 8
jmp 0x18001bb80
mov rcx, qword [rdi + 8]
or r13, 0xffffffffffffffff
mov rax, r13
inc rax
cmp word [rcx + rax*2], r12w
jne 0x18001b890
add eax, 4
xor ecx, ecx
mov dword [rbp + 0x48], eax
lea edx, [rax + 1]
add rdx, rdx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x18001b8cd
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
jmp 0x18001b87b
mov r9, qword [rdi + 8]
mov rcx, r9
call fcn.18003dd38
mov edx, dword [rbp + 0x48]
lea r8, [0x18007bdd8]
inc edx
mov dword [rbp - 0x38], eax
mov rcx, r14
test eax, eax
jne 0x18001b8f6
lea r8, str._s.
call qword [sym.imp.msvcrt.dll_swprintf_s]
nop dword [rax + rax]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.msvcrt.dll__wfindfirst64]
nop dword [rax + rax]
mov rcx, r14
mov r12, rax
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
cmp r12, r13
je 0x18001bb09
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
bt eax, 0xa
jb 0x18001bafa
xor r8d, r8d
mov edx, 0x2e
lea r15, [rsi + 0x28]
movzx eax, word [r15]
movzx ecx, dx
sub ecx, eax
jne 0x18001b977
movzx eax, word [r15 + 2]
movzx ecx, dx
sub ecx, eax
jne 0x18001b977
movzx eax, word [r15 + 4]
movzx ecx, r8w
sub ecx, eax
test ecx, ecx
je 0x18001bad7
movzx eax, word [r15]
movzx ecx, dx
sub ecx, eax
jne 0x18001b995
movzx eax, word [r15 + 2]
movzx ecx, r8w
sub ecx, eax
test ecx, ecx
je 0x18001bad7
mov r14, qword [rdi + 0x40]
mov eax, r13d
test r14, r14
je 0x18001b9e0
mov rcx, qword [r14]
test rcx, rcx
je 0x18001b9ca
mov rcx, qword [rcx]
mov rdx, r15
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
xor r8d, r8d
test eax, eax
je 0x18001b9d3
mov r14, qword [r14 + 8]
test r14, r14
jne 0x18001b9a9
test r14, r14
je 0x18001b9e0
test eax, eax
je 0x18001bad7
mov rcx, r13
inc rcx
cmp word [r15 + rcx*2], r8w
jne 0x18001b9e3
mov rdx, qword [rdi + 8]
mov rax, r13
inc rax
cmp word [rdx + rax*2], r8w
jne 0x18001b9f4
inc ecx
add eax, ecx
xor ecx, ecx
mov dword [rbp + 0x48], eax
lea edx, [rax + 1]
add rdx, rdx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r14, rax
xor eax, eax
test r14, r14
je 0x18001baf5
mov edx, dword [rbp + 0x48]
lea r8, [0x18007a7e8]
mov r9, qword [rdi + 8]
inc edx
mov rcx, r14
mov qword [rsp + 0x20], r15
cmp dword [rbp - 0x38], eax
jne 0x18001ba4b
lea r8, str._s_s
call qword [sym.imp.msvcrt.dll_swprintf_s]
nop dword [rax + rax]
mov r15d, dword [rsi]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
xor eax, eax
mov esi, eax
cmp qword [rbp - 0x30], rax
je 0x18001baa9
cmp byte [rdi + 0x14], 2
jne 0x18001baa9
mov eax, dword [rdi + 0x18]
mov rcx, r14
and eax, 0xc
test r15b, 0x10
je 0x18001ba95
mov r9d, eax
lea edx, [rsi + 1]
call fcn.18001a8dc
jmp 0x18001baa7
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
lea r8d, [r9 + 1]
call fcn.18001ae48
mov ebx, eax
mov rcx, r14
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
test ebx, ebx
jne 0x18001bafa
mov edx, 0x230
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x18001baf5
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.msvcrt.dll__wfindnext64]
nop dword [rax + rax]
xor r8d, r8d
test eax, eax
jne 0x18001bafa
jmp 0x18001b94c
mov ebx, 8
mov rcx, r12
call qword [sym.imp.msvcrt.dll__findclose]
nop dword [rax + rax]
test rsi, rsi
je 0x18001bb1d
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
test ebx, ebx
je 0x18001b819
jmp 0x18001bb80
mov edx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov esi, 0x18
mov rax, qword [rax + rdx*8]
mov dword [rsi + rax], ebx
jmp 0x18001b821
mov edx, dword [0x18008b2a0]
mov r9b, 4
mov rax, qword gs:[0x58]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r8
mov r8d, dword [rdi + 0x10]
mov rcx, qword [rax + rdx*8]
mov rdx, qword [rdi + 8]
mov r13d, 0x20
mov rcx, qword [rcx + r13]
call fcn.1800448bc
mov ebx, eax
mov eax, ebx
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret