Function at 0x180037348
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1801933d0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r15, rdx
mov r14, rcx
mov qword [rbp - 0x21], rcx
lea rax, vtable.Nvidia::Logging::FileLogManager.0
mov qword [rcx], rax
or qword [rcx + 8], 0xffffffffffffffff
lea rdi, [rcx + 0x10]
mov r12d, 7
mov qword [rdi + 0x18], r12
xor esi, esi
mov qword [rdi + 0x10], rsi
cmp r12, 8
jb 0x1800373b4
mov rax, qword [rdi]
jmp 0x1800373b7
mov rax, rdi
mov word [rax], si
mov qword [rcx + 0x40], rsi
mov qword [rbp - 1], r12
mov qword [rbp - 9], rsi
mov word [rbp - 0x19], si
lea rcx, str.PathPrefix
call fcn.1800d352c
mov r8, rax
lea rdx, str.PathPrefix
lea rcx, [rbp - 0x19]
call fcn.1800543f0
nop
lea r8, [rbp - 0x19]
lea rdx, [rbp + 7]
mov rcx, r15
call fcn.180036ca0
mov rbx, rax
cmp rdi, rax
je 0x18003741b
xor r8d, r8d
mov dl, 1
mov rcx, rdi
call fcn.1800542f4
mov rdx, rbx
mov rcx, rdi
call fcn.180053eb4
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 7]
call fcn.1800542f4
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x19]
call fcn.1800542f4
mov rcx, rdi
call fcn.180036d7c
mov qword [rbp - 1], r12
mov qword [rbp - 9], rsi
mov word [rbp - 0x19], si
lea rcx, str.AppendProcessNameToPathPrefix
call fcn.1800d352c
mov r8, rax
lea rdx, str.AppendProcessNameToPathPrefix
lea rcx, [rbp - 0x19]
call fcn.1800543f0
nop
lea rdx, [rbp - 0x19]
mov rcx, r15
call fcn.180036ee0
mov ebx, eax
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x19]
call fcn.1800542f4
test ebx, ebx
je 0x1800374d6
lea rcx, [0x18014ca24]
call fcn.1800d352c
mov r8, rax
lea rdx, [0x18014ca24]
mov rcx, rdi
call fcn.180043a1c
lea rcx, [rbp - 0x19]
call fcn.180036df8
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x19]
mov rcx, rdi
call fcn.180053784
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x19]
call fcn.1800542f4
mov qword [rbp - 1], r12
mov qword [rbp - 9], rsi
mov word [rbp - 0x19], si
lea rcx, [0x18014ca28]
call fcn.1800d352c
mov r8, rax
lea rdx, [0x18014ca28]
lea rcx, [rbp - 0x19]
call fcn.1800543f0
nop
lea rdx, [rbp - 0x19]
mov rcx, r15
call fcn.180036ee0
mov dword [r14 + 0x30], eax
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x19]
call fcn.1800542f4
mov qword [rbp - 1], r12
mov qword [rbp - 9], rsi
mov word [rbp - 0x19], si
lea rcx, str.MaxFileSize
call fcn.1800d352c
mov r8, rax
lea rdx, str.MaxFileSize
lea rcx, [rbp - 0x19]
call fcn.1800543f0
nop
lea rdx, [rbp - 0x19]
mov rcx, r15
call fcn.180036ee0
mov dword [r14 + 0x34], eax
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x19]
call fcn.1800542f4
mov dword [rbp - 0x39], 1
mov qword [rbp - 1], r12
mov qword [rbp - 9], rsi
mov word [rbp - 0x19], si
lea rcx, str.WriteThrough
call fcn.1800d352c
mov r8, rax
lea rdx, str.WriteThrough
lea rcx, [rbp - 0x19]
call fcn.1800543f0
mov dword [rbp - 0x35], 4
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
lea rax, [rbp - 0x35]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x31]
xor r8d, r8d
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x19]
call fcn.1800542f4
cmp dword [rbp - 0x39], esi
sete sil
mov dword [r14 + 0x38], esi
mov rcx, r14
call fcn.1800371cc
nop
mov rax, r14
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.18009f760
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret