Function at 0x1800159b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x178]
sub rsp, 0x270
movsd xmm0, qword [0x1800b3848]
mov r14d, 0xe3354
movaps xmmword [rax - 0x58], xmm10
movsd xmm10, qword [0x18009a4d8]
ucomisd xmm0, xmm10
jp 0x1800161fd
jne 0x1800161fd
movaps xmmword [rax - 0x68], xmm11
movsd xmm11, qword [0x1800991d0]
movaps xmmword [rax - 0x78], xmm12
movsd xmm12, qword [0x180099c38]
movaps xmmword [rax - 0x88], xmm13
movsd xmm13, qword [0x180098910]
movaps xmmword [rax - 0x98], xmm14
movsd xmm14, qword [0x180099318]
movaps xmmword [rax - 0xa8], xmm15
movsd xmm15, qword [0x180098b70]
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
cmp r14d, 0xe3355
jge 0x180016196
lea rdx, str.Etuhbesouzoldag
lea rcx, [rsp + 0x30]
call fcn.18000a440
movsd xmm2, qword [0x1800b3878]
mov rcx, rax
movaps xmm1, xmm11
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
lea rdx, str.uroxu
lea rcx, [rsp + 0x50]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
movsd xmm0, qword [0x1800b3878]
xorps xmm9, xmm9
cvtsi2sd xmm9, rax
mulsd xmm9, xmm12
mulsd xmm9, xmm6
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movaps xmm6, xmm0
mulsd xmm6, xmm13
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rsp + 0x70]
xorps xmm8, xmm8
cvtsi2sd xmm8, rax
mulsd xmm8, xmm6
call fcn.18002f2f0
lea rdx, str.oyaxuc
mov rdi, rax
lea rcx, [rbp - 0x70]
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp - 0x50]
mov rbx, rax
call fcn.18002f2f0
mov rcx, rax
movaps xmm3, xmm14
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
cvttsd2si edx, qword [0x1800b3870]
mov r9d, 0x183cd39d
movaps xmm7, xmm0
movaps xmm2, xmm15
movsd xmm0, qword [0x180099cb8]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mulsd xmm1, xmm8
mulsd xmm7, xmm1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mulsd xmm0, qword [0x180098d90]
movsd xmm6, qword [0x180099d28]
subsd xmm6, xmm0
addsd xmm6, xmm7
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movsd xmm0, qword [0x180099028]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, qword [0x180099c48]
addsd xmm7, xmm6
addsd xmm7, xmm9
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsd xmm6, qword [0x180099518]
lea rdx, [0x180097710]
lea rcx, [rbp - 0x30]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call fcn.18000a440
lea rcx, [rbp - 0x10]
mov rsi, rax
cvttsd2si rdx, qword [0x1800b3910]
call fcn.18002f2f0
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp + 0x10]
mov rdi, rax
call fcn.18002f2f0
mov rbx, rax
lea rdx, str.hyogazoyjyev
lea rcx, [rbp + 0x30]
call fcn.1800090b0
mov rdx, rax
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov ecx, 0x30ae09a0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.Husybity
lea rcx, [rbp + 0x50]
divsd xmm6, xmm0
call fcn.18000a440
lea rdx, str.elyyn
mov rsi, rax
lea rcx, [rbp + 0x70]
call fcn.18000a440
lea rcx, [rbp + 0x90]
mov rdi, rax
cvttsd2si rdx, qword [0x1800b3878]
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rbp + 0xb0]
mov rbx, rax
call fcn.18002f2d0
movsd xmm0, qword [0x1800b3848]
mov rcx, rax
mov r9, rsi
movsd qword [rsp + 0x20], xmm0
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
lea rdx, str.Etuhbesouzoldag
lea rcx, [rbp + 0xb0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
addsd xmm6, xmm7
movsd qword [0x1800b3878], xmm6
call fcn.18000a440
movsd xmm2, qword [0x1800b3878]
mov rcx, rax
movaps xmm1, xmm11
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
lea rdx, str.uroxu
lea rcx, [rbp + 0x90]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
movsd xmm0, qword [0x1800b3878]
xorps xmm9, xmm9
cvtsi2sd xmm9, rax
mulsd xmm9, xmm12
mulsd xmm9, xmm6
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movaps xmm6, xmm0
mulsd xmm6, xmm13
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp + 0x70]
xorps xmm8, xmm8
cvtsi2sd xmm8, rax
mulsd xmm8, xmm6
call fcn.18002f2f0
lea rdx, str.oyaxuc
mov rdi, rax
lea rcx, [rbp + 0x50]
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp + 0x30]
mov rbx, rax
call fcn.18002f2f0
mov rcx, rax
movaps xmm3, xmm14
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
cvttsd2si edx, qword [0x1800b3870]
movaps xmm7, xmm0
movsd xmm0, qword [0x180099cb8]
mov r9d, 0x183cd39d
movaps xmm2, xmm15
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mulsd xmm1, xmm8
mulsd xmm7, xmm1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mulsd xmm0, qword [0x180098d90]
movsd xmm6, qword [0x180098f48]
subsd xmm6, xmm0
addsd xmm6, xmm7
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movsd xmm0, qword [0x180099028]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, qword [0x180099c48]
addsd xmm7, xmm6
addsd xmm7, xmm9
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsd xmm6, qword [0x180099518]
lea rdx, [0x180097710]
lea rcx, [rbp + 0x10]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call fcn.18000a440
lea rcx, [rbp - 0x10]
mov rsi, rax
cvttsd2si rdx, qword [0x1800b3910]
call fcn.18002f2f0
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp - 0x30]
mov rdi, rax
call fcn.18002f2f0
lea rdx, str.hyogazoyjyev
mov rbx, rax
lea rcx, [rbp - 0x50]
call fcn.1800090b0
mov rdx, rax
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov ecx, 0x30ae09a0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.Husybity
lea rcx, [rbp - 0x70]
divsd xmm6, xmm0
call fcn.18000a440
lea rdx, str.elyyn
mov rsi, rax
lea rcx, [rsp + 0x70]
call fcn.18000a440
lea rcx, [rsp + 0x50]
mov rdi, rax
cvttsd2si rdx, qword [0x1800b3878]
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.18002f2d0
movsd xmm0, qword [0x1800b3848]
mov rcx, rax
mov r9, rsi
movsd qword [rsp + 0x20], xmm0
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
lea rdx, str.Etuhbesouzoldag
lea rcx, [rbp + 0xb0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
addsd xmm6, xmm7
movsd qword [0x1800b3910], xmm6
call fcn.18000a440
movsd xmm2, qword [0x1800b3878]
mov rcx, rax
movaps xmm1, xmm11
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movd xmm6, eax
lea rdx, str.uroxu
lea rcx, [rbp + 0x90]
cvtdq2pd xmm6, xmm6
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
movsd xmm0, qword [0x1800b3878]
xorps xmm9, xmm9
cvtsi2sd xmm9, rax
mulsd xmm9, xmm12
mulsd xmm9, xmm6
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movaps xmm6, xmm0
mulsd xmm6, xmm13
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp + 0x70]
xorps xmm8, xmm8
cvtsi2sd xmm8, rax
mulsd xmm8, xmm6
call fcn.18002f2f0
lea rdx, str.oyaxuc
mov rdi, rax
lea rcx, [rbp + 0x50]
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp + 0x30]
mov rbx, rax
call fcn.18002f2f0
mov rcx, rax
movaps xmm3, xmm14
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
cvttsd2si edx, qword [0x1800b3870]
mov r9d, 0x183cd39d
movaps xmm7, xmm0
movaps xmm2, xmm15
movsd xmm0, qword [0x180099cb8]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mulsd xmm1, xmm8
mulsd xmm7, xmm1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mulsd xmm0, qword [0x180098d90]
movsd xmm6, qword [0x18009a1b0]
subsd xmm6, xmm0
addsd xmm6, xmm7
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movsd xmm0, qword [0x180099028]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, qword [0x180099c48]
addsd xmm7, xmm6
addsd xmm7, xmm9
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsd xmm6, qword [0x180099518]
lea rdx, [0x180097710]
lea rcx, [rbp + 0x10]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call fcn.18000a440
lea rcx, [rbp - 0x10]
mov rsi, rax
cvttsd2si rdx, qword [0x1800b3910]
call fcn.18002f2f0
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp - 0x30]
mov rdi, rax
call fcn.18002f2f0
lea rdx, str.hyogazoyjyev
mov rbx, rax
lea rcx, [rbp - 0x50]
call fcn.1800090b0
mov rdx, rax
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov ecx, 0x30ae09a0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.Husybity
lea rcx, [rbp - 0x70]
divsd xmm6, xmm0
call fcn.18000a440
lea rdx, str.elyyn
mov rsi, rax
lea rcx, [rsp + 0x70]
call fcn.18000a440
lea rcx, [rsp + 0x50]
mov rdi, rax
cvttsd2si rdx, qword [0x1800b3878]
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.18002f2d0
movsd xmm0, qword [0x1800b3848]
mov rcx, rax
mov r9, rsi
movsd qword [rsp + 0x20], xmm0
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
inc r14d
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
movsd xmm0, qword [0x1800b3848]
ucomisd xmm0, xmm10
addsd xmm6, xmm7
movsd qword [0x1800b3910], xmm6
jp 0x180016196
je 0x180015a60
mov rsi, qword [rsp + 0x288]
mov rdi, qword [rsp + 0x290]
movaps xmm6, xmmword [rsp + 0x260]
movaps xmm7, xmmword [rsp + 0x250]
movaps xmm9, xmmword [rsp + 0x230]
movaps xmm8, xmmword [rsp + 0x240]
mov rbx, qword [rsp + 0x280]
movaps xmm11, xmmword [rsp + 0x210]
movaps xmm12, xmmword [rsp + 0x200]
movaps xmm13, xmmword [rsp + 0x1f0]
movaps xmm14, xmmword [rsp + 0x1e0]
movaps xmm15, xmmword [rsp + 0x1d0]
lea r11, [rsp + 0x270]
mov r14, qword [r11 + 0x28]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop rbp
ret