Function at 0x18000d020
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
xor r15d, r15d
mov esi, edx
mov edx, 0x104
mov rdi, rcx
mov rcx, qword [0x1800266d0]
mov dword [rsp + 0x44], edx
mov dword [rax - 0x78], edx
mov dword [rax - 0x74], edx
mov r8, rdx
xor edx, edx
mov rbx, r9
mov r14d, r15d
mov r12, r15
mov qword [rsp + 0x58], r15
mov rbp, r15
mov qword [rsp + 0x48], r15
mov r13d, r15d
mov dword [rsp + 0x40], r15d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r15
mov qword [rsp + 0x68], rax
je 0x18000d564
mov rcx, qword [0x1800266d0]
xor edx, edx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
xor eax, eax
cmp r15, rax
je 0x18000d518
cmp qword [0x1800266f8], rax
je 0x18000d518
mov rdx, qword [0x180026810]
lea r8, [rsp + 0x70]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
xor ecx, ecx
lea ebx, [rbp + 0x57]
cmp eax, ecx
jne 0x18000d253
mov rbx, qword [rsp + 0x68]
lea rax, [rsp + 0x64]
lea r9, [rsp + 0x60]
mov r8, r15
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x70]
mov edx, r12d
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0xea
mov dword [rsp + 0x50], eax
jne 0x18000d1bd
mov rcx, qword [0x1800266d0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x1800266d0]
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rsp + 0x44]
mov rcx, qword [0x1800266d0]
add eax, 0x104
xor edx, edx
mov r8d, eax
mov dword [rsp + 0x44], eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [0x1800266d0]
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [rsp + 0x44]
mov rbx, qword [rsp + 0x68]
mov dword [rsp + 0x64], ecx
mov dword [rsp + 0x60], ecx
xor ecx, ecx
cmp rbx, rcx
mov r15, rax
je 0x18000d23e
cmp rax, rcx
jne 0x18000d0f5
mov eax, dword [rsp + 0x50]
jmp 0x18000d1bf
xor ecx, ecx
cmp eax, ecx
jne 0x18000d23e
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, esi
ja 0x18000d200
lea rax, [rsp + 0x40]
mov r9, rbx
mov r8, r15
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov edx, esi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.18000ccc4
mov rbp, qword [rsp + 0x48]
mov r13d, dword [rsp + 0x40]
jmp 0x18000d205
mov eax, 0x57
xor ecx, ecx
cmp eax, ecx
jne 0x18000d235
cmp rdi, qword [rsp + 0xe0]
je 0x18000d229
mov rcx, qword [0x1800266d0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
mov rdi, rbp
mov esi, r13d
mov r14d, 1
add r12d, 1
jmp 0x18000d0f0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, qword [rsp + 0x58]
mov ebx, 0x57
mov rax, qword [0x1800266f8]
lea rcx, [0x1800293ac]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, esi
ja 0x18000d2a6
mov r9, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
lea r8, [0x1800293ac]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov edx, esi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.18000ccc4
mov rbp, qword [rsp + 0x48]
mov r13d, dword [rsp + 0x40]
jmp 0x18000d2a8
mov eax, ebx
xor ecx, ecx
cmp eax, ecx
jne 0x18000d2d6
cmp rdi, qword [rsp + 0xe0]
je 0x18000d2ca
mov rcx, qword [0x1800266d0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, rbp
mov esi, r13d
mov r14d, 1
mov r8d, dword [0x180025ff0]
lea rdx, [0x180021630]
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [0x1800293b1]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, esi
ja 0x18000d336
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x78]
lea r8, [0x1800293b1]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov edx, esi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.18000ccc4
mov rbp, qword [rsp + 0x48]
mov r13d, dword [rsp + 0x40]
mov ebx, eax
xor eax, eax
cmp ebx, eax
jne 0x18000d364
cmp rdi, qword [rsp + 0xe0]
je 0x18000d358
mov rcx, qword [0x1800266d0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, rbp
mov esi, r13d
mov r14d, 1
lea r9, [rsp + 0x44]
lea r8, [0x1800293b9]
mov edx, esi
mov rcx, rdi
call fcn.180017630
xor ebx, ebx
cmp rax, rbx
mov r13, rax
je 0x18000d510
cmp r12, rbx
mov ebp, dword [rsp + 0x44]
je 0x18000d3b1
cmp dword [rsp + 0x50], ebp
jae 0x18000d3ac
mov rcx, qword [0x1800266d0]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, rbx
cmp r12, rbx
jne 0x18000d3d3
mov rcx, qword [0x1800266d0]
mov r8, rbp
xor edx, edx
mov dword [rsp + 0x50], ebp
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rbx
mov r12, rax
je 0x18000d510
lea eax, [rbp - 6]
lea rdx, [r13 + 5]
mov rcx, r12
mov r8d, eax
mov ebx, eax
call sub.ntdll.dll_memcpy
xor eax, eax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
xor r9d, r9d
mov rcx, r12
mov byte [rbx + r12], al
call fcn.1800044d0
xor ecx, ecx
cmp eax, ecx
mov eax, dword [rsp + 0x40]
cmovne eax, ecx
mov rcx, qword [0x1800266d0]
xor edx, edx
mov dword [rsp + 0x40], eax
sub eax, ebp
add eax, esi
mov r8d, eax
mov dword [rsp + 0x48], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
xor eax, eax
cmp rbx, rax
je 0x18000d4b0
mov r14d, r13d
mov rdx, rdi
mov rcx, rbx
sub r14d, edi
mov r8d, r14d
call sub.ntdll.dll_memcpy
mov eax, dword [rsp + 0x40]
xor ecx, ecx
cmp eax, ecx
je 0x18000d46a
mov rdx, qword [rsp + 0x58]
mov ecx, r14d
mov r8, rax
add rcx, rbx
call sub.ntdll.dll_memcpy
mov eax, dword [rsp + 0x40]
mov ecx, eax
mov eax, r14d
sub esi, r14d
add rcx, rax
sub esi, ebp
lea rdx, [r13 + rbp]
add rcx, rbx
mov r8d, esi
call sub.ntdll.dll_memcpy
cmp rdi, qword [rsp + 0xe0]
je 0x18000d4a3
mov rcx, qword [0x1800266d0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [rsp + 0x48]
mov rdi, rbx
mov r14d, 1
xor ebp, ebp
cmp dword [rsp + 0x40], ebp
je 0x18000d4cc
mov r8, qword [rsp + 0x58]
mov rcx, qword [0x1800266d0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rbx, rbp
je 0x18000d4f7
lea r9, [rsp + 0x44]
lea r8, [0x1800293b9]
mov edx, esi
mov rcx, rdi
call fcn.180017630
xor ebx, ebx
cmp rax, rbx
mov r13, rax
jne 0x18000d388
jmp 0x18000d4f9
xor ebx, ebx
cmp r12, rbx
je 0x18000d510
mov rcx, qword [0x1800266d0]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x68]
xor ebp, ebp
cmp rax, rbp
je 0x18000d536
mov rcx, qword [0x1800266d0]
mov r8, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r15, rbp
je 0x18000d54d
mov rcx, qword [0x1800266d0]
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r14d, ebp
je 0x18000d564
cmp rbx, rbp
mov rax, qword [rsp + 0xf0]
mov qword [rax], rdi
je 0x18000d564
mov dword [rbx], esi
mov eax, r14d
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret