Function at 0x180001a88
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor r13d, r13d
mov r12d, edx
mov eax, edx
test edx, edx
je 0x1800020e3
sub eax, 1
je 0x180001b5f
sub eax, 1
je 0x180001b37
cmp eax, 1
je 0x180001afc
mov rbx, qword [section..data]
lea rdi, section..data
cmp rbx, rdi
je 0x180002318
test byte [rbx + 0x1c], 2
je 0x1800022ed
mov rcx, qword [rbx + 0x10]
lea edx, [r13 + 0x15]
mov r9d, r12d
lea r8, [0x180015078]
call fcn.180002598
jmp 0x1800022e6
mov rbx, qword [section..data]
lea rdi, section..data
cmp rbx, rdi
je 0x18000234c
test byte [rbx + 0x1c], 8
je 0x1800022ed
mov edx, 0x14
mov rcx, qword [rbx + 0x10]
lea r8, [0x180015078]
call fcn.18000256c
jmp 0x1800022e6
mov rbx, qword [section..data]
lea rdi, section..data
cmp rbx, rdi
je 0x18000234c
test byte [rbx + 0x1c], 8
je 0x1800022ed
mov edx, 0x13
jmp 0x180001b22
mov qword [rsp + 0xa8], r13
mov dword [rsp + 0x98], r13d
lea rax, [0x180015088]
mov qword [0x1800196b0], r13
lea rbx, [0x1800196a0]
mov qword [0x180019688], rax
mov qword [section..data], rbx
lea rdi, [0x180019688]
mov qword [0x1800196a0], r13
mov qword [0x1800196b8], 1
mov r8, qword [rdi]
lea rax, [rbx + 8]
mov qword [rsp + 0x38], rax
lea rcx, [0x1800025e0]
mov qword [rsp + 0x30], r13
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r8
lea rdi, [rdi + 8]
mov qword [rsp + 0x48], r13
mov r9d, 1
mov qword [rsp + 0x28], r13
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov qword [rbx + 0x20], r8
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
nop dword [rax + rax]
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180001bab
mov rbx, qword [section..data]
lea rdi, section..data
cmp rbx, rdi
je 0x180001c5d
test byte [rbx + 0x1c], 1
je 0x180001c36
mov rcx, qword [rbx + 0x10]
lea r8, [0x180015078]
mov edx, 0xa
call fcn.18000256c
mov rbx, qword [section..data]
cmp rbx, rdi
je 0x180001c5d
test byte [rbx + 0x1c], 8
je 0x180001c5d
mov rcx, qword [rbx + 0x10]
lea r8, [0x180015078]
mov edx, 0xb
call fcn.18000256c
mov rbx, qword [section..data]
cmp qword [0x180019630], r13
jne 0x180001f81
mov edx, 0xb0
lea ebx, [rdx - 0x70]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov qword [0x180019630], rax
test rax, rax
jne 0x180001cc4
mov rcx, qword [section..data]
cmp rcx, rdi
je 0x180001cb1
test byte [rcx + 0x1c], 2
je 0x180001cb1
mov rcx, qword [rcx + 0x10]
lea edx, [rbx - 0x34]
lea r8, [0x180015078]
call fcn.18000256c
call qword [sym.imp.WSOCK32.dll_WSACleanup]
nop dword [rax + rax]
xor eax, eax
jmp 0x180002351
lea rcx, [rax + 0x48]
call fcn.18000c500
mov rcx, qword [0x180019630]
test eax, eax
jns 0x180001ce6
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
jmp 0x180001cbd
add rcx, 0x70
call fcn.18000c500
test eax, eax
jns 0x180001d13
mov rcx, qword [0x180019630]
add rcx, 0x48
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop dword [rax + rax]
mov rcx, qword [0x180019630]
jmp 0x180001cd8
mov r15d, 0x104
mov ecx, ebx
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov edx, r15d
mov ecx, ebx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov edx, r15d
mov ecx, ebx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov edx, r15d
mov ecx, ebx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
lea rcx, [0x180014f80]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop dword [rax + rax]
mov r15, rax
test r14, r14
je 0x180002003
test rbp, rbp
je 0x180002003
test rsi, rsi
je 0x180002003
test rbx, rbx
je 0x180002003
test rax, rax
je 0x180002003
xor edx, edx
mov r8d, 0x104
mov rcx, r14
call sub.msvcrt.dll_memset
xor edx, edx
mov r8d, 0x104
mov rcx, rbp
call sub.msvcrt.dll_memset
xor edx, edx
mov r8d, 0x104
mov rcx, rsi
call sub.msvcrt.dll_memset
xor edx, edx
mov r8d, 0x104
mov rcx, rbx
call sub.msvcrt.dll_memset
mov r9d, 0x82
mov r8, r14
mov edx, 0x138e
mov rcx, r15
call qword [sym.imp.USER32.dll_LoadStringW]
nop dword [rax + rax]
test eax, eax
je 0x180002003
mov r9d, 0x82
mov r8, rbp
mov edx, 0x138f
mov rcx, r15
call qword [sym.imp.USER32.dll_LoadStringW]
nop dword [rax + rax]
test eax, eax
je 0x180002003
mov r9d, 0x82
mov r8, rsi
mov edx, 0x1390
mov rcx, r15
call qword [sym.imp.USER32.dll_LoadStringW]
nop dword [rax + rax]
test eax, eax
je 0x180002003
mov r9d, 0x82
mov r8, rbx
mov edx, 0x1391
mov rcx, r15
call qword [sym.imp.USER32.dll_LoadStringW]
nop dword [rax + rax]
test eax, eax
je 0x180002003
mov rax, qword [0x180019630]
lea rdx, str.SOFTWAREMicrosoftClientForNFSCurrentVersionDefault
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rax + 0x30], rsi
mov qword [rax + 0x38], rbp
mov qword [rax + 0x40], rbx
mov qword [rax + 0x28], r14
mov qword [rax + 0xa8], r13
mov qword [rax + 0x98], r13
mov qword [rax + 0xa0], r13
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
js 0x180001fd7
mov rcx, qword [rsp + 0xa8]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rdx, str.LoggingLevel
lea rax, [0x180019620]
mov dword [rsp + 0x98], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
js 0x180001f3f
cmp dword [0x180019620], 3
jbe 0x180001f66
mov dword [0x180019620], r13d
jmp 0x180001f66
mov rcx, qword [section..data]
cmp rcx, rdi
je 0x180001f66
test byte [rcx + 0x1c], 2
je 0x180001f66
mov rcx, qword [rcx + 0x10]
lea r8, [0x180015078]
mov edx, 0xd
call fcn.18000256c
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rbx, qword [section..data]
cmp qword [0x180019628], r13
jne 0x1800020d8
lea r9, [0x180019628]
xor r8d, r8d
xor edx, edx
lea rcx, [0x180014f60]
call qword [sym.imp.ADVAPI32.dll_EventRegister]
nop dword [rax + rax]
test eax, eax
jne 0x18000209d
mov rbx, qword [section..data]
cmp rbx, rdi
je 0x1800020cb
test byte [rbx + 0x1c], 8
je 0x1800020cb
lea edx, [rax + 0xf]
jmp 0x1800020b4
mov rbx, qword [section..data]
cmp rbx, rdi
je 0x180001f81
test byte [rbx + 0x1c], 2
je 0x180001f81
mov rcx, qword [rbx + 0x10]
lea r8, [0x180015078]
mov edx, 0xe
call fcn.18000256c
jmp 0x180001f7a
mov rcx, qword [0x180019630]
test rcx, rcx
je 0x180002050
add rcx, 0x48
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop dword [rax + rax]
mov rcx, qword [0x180019630]
add rcx, 0x70
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop dword [rax + rax]
mov rcx, qword [0x180019630]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov qword [0x180019630], r13
test r14, r14
je 0x180002064
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
test rbp, rbp
je 0x180002078
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
test rsi, rsi
je 0x18000208c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
test rbx, rbx
je 0x180001cbd
mov rcx, rbx
jmp 0x180001cd8
mov rbx, qword [section..data]
cmp rbx, rdi
je 0x1800020cb
test byte [rbx + 0x1c], 8
je 0x1800020cb
mov edx, 0x10
mov rcx, qword [rbx + 0x10]
lea r8, [0x180015078]
call fcn.18000256c
mov rbx, qword [section..data]
cmp qword [0x180019628], r13
je 0x1800022ed
inc dword [0x180019624]
jmp 0x1800022ed
mov rcx, qword [section..data]
lea rdi, section..data
cmp rcx, rdi
je 0x180002118
test byte [rcx + 0x1c], 8
je 0x180002118
mov rcx, qword [rcx + 0x10]
lea r8, [0x180015078]
mov edx, 0x11
call fcn.18000256c
mov rcx, qword [section..data]
mov rax, qword [0x180019630]
test rax, rax
jne 0x18000214f
cmp rcx, rdi
je 0x180001cbd
test byte [rcx + 0x1c], 2
je 0x180001cbd
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x12]
lea r8, [0x180015078]
call fcn.18000256c
jmp 0x180001cbd
mov rbx, qword [rax + 0x98]
test rbx, rbx
je 0x180002201
mov rax, qword [rbx + 0x68]
mov rsi, qword [rbx + 0x80]
test rax, rax
je 0x1800021df
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x180002184
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov rax, qword [rbx + 0x68]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x18000219d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov rax, qword [rbx + 0x68]
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x1800021b6
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov rax, qword [rbx + 0x68]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1800021cf
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov rbx, rsi
test rsi, rsi
jne 0x18000215f
mov rax, qword [0x180019630]
lea rcx, [rax + 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop dword [rax + rax]
mov rcx, qword [0x180019630]
add rcx, 0x70
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop dword [rax + rax]
mov rcx, qword [0x180019630]
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x18000224e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov rcx, qword [0x180019630]
mov rax, qword [rcx + 0x38]
test rax, rax
je 0x18000226d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov rcx, qword [0x180019630]
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x18000228c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov rcx, qword [0x180019630]
mov rax, qword [rcx + 0x28]
test rax, rax
je 0x1800022ab
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov rcx, qword [0x180019630]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov rcx, qword [0x180019628]
mov qword [0x180019630], r13
test rcx, rcx
je 0x1800022e6
add dword [0x180019624], 0xffffffff
jne 0x1800022e6
call qword [sym.imp.ADVAPI32.dll_EventUnregister]
nop dword [rax + rax]
mov qword [0x180019628], r13
mov rbx, qword [section..data]
cmp rbx, rdi
je 0x180002318
test byte [rbx + 0x1c], 1
je 0x180002318
mov rcx, qword [rbx + 0x10]
lea r8, [0x180015078]
mov edx, 0x16
lea r9d, [rdx - 0x15]
call fcn.180002598
mov rbx, qword [section..data]
test r12d, r12d
jne 0x18000234c
cmp rbx, rdi
je 0x18000234c
jmp 0x180002340
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18000233d
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
nop dword [rax + rax]
mov qword [rbx + 8], r13
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180002324
mov qword [section..data], rdi
mov eax, 1
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret