Function at 0x18000a070
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xd0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rsi, r8
mov r13d, edx
mov r12, rcx
cmp dword [rcx + 8], 1
jne 0x18000a0e2
cmp qword [r8 + 0x20], 8
jb 0x18000a0c1
mov r8, qword [r8 + 8]
jmp 0x18000a0c5
add r8, 8
lea rdx, str.allow_file_on_allow_mode:__s
lea rcx, str.banSendFileDbg
call fcn.18005c640
mov eax, 1
jmp 0x18000a5e2
mov qword [rsp + 0x98], 7
xor r14d, r14d
mov qword [rsp + 0x90], r14
mov word [rsp + 0x80], r14w
cmp qword [r8 + 0x20], 8
jb 0x18000a112
lea rbx, [r8 + 8]
mov rcx, qword [rbx]
jmp 0x18000a119
lea rbx, [r8 + 8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test rax, rax
je 0x18000a182
cmp word [rax], 0x2e
jne 0x18000a182
lea rdx, [rax + 2]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x78]
call fcn.18000f510
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x40]
call fcn.180012880
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.18000db80
nop
cmp qword [rsp + 0x60], 8
jb 0x18000a182
mov rcx, qword [rsp + 0x48]
call fcn.18009a864
mov eax, dword [r12 + 8]
cmp eax, 2
jne 0x18000a1e7
lea rcx, [r12 + 0x10]
lea rdx, [rsp + 0x78]
call fcn.18000d380
test rax, rax
jne 0x18000a243
cmp qword [rsi + 0x20], 8
jb 0x18000a1ae
mov rbx, qword [rbx]
mov r8, rbx
lea rdx, str.allow_file_on_balck_not_hitted:__s
lea rcx, str.banSendFileDbg
call fcn.18005c640
nop
cmp qword [rsp + 0x98], 8
jb 0x18000a1dd
mov rcx, qword [rsp + 0x80]
call fcn.18009a864
mov eax, 1
jmp 0x18000a5e2
cmp eax, 3
jne 0x18000a243
lea rcx, [r12 + 0x10]
lea rdx, [rsp + 0x78]
call fcn.18000d380
test rax, rax
je 0x18000a243
cmp qword [rsi + 0x20], 8
jb 0x18000a20a
mov rbx, qword [rbx]
mov r8, rbx
lea rdx, str.allow_file_on_white_hitted:__s
lea rcx, str.banSendFileDbg
call fcn.18005c640
nop
cmp qword [rsp + 0x98], 8
jb 0x18000a239
mov rcx, qword [rsp + 0x80]
call fcn.18009a864
mov eax, 1
jmp 0x18000a5e2
mov dword [rsp + 0x38], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
lea r8, [0x1800cde58]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18000a398
cmp dword [rsp + 0x30], 4
jne 0x18000a398
cmp dword [rsp + 0x34], eax
je 0x18000a398
cmp qword [rsi + 0x20], 8
jb 0x18000a2a8
mov rdi, qword [rbx]
jmp 0x18000a2ab
mov rdi, rbx
mov r8d, dword [0x18010bc58]
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.18007c858
nop
mov dword [rsp + 0x34], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.180088934
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18000a335
mov rbp, qword [rsp + 0x60]
cmp rcx, rbp
je 0x18000a330
lea rdi, [rcx + 0x20]
nop dword [rax]
cmp qword [rdi], 0x10
jb 0x18000a30f
mov rcx, qword [rdi - 0x18]
call fcn.18009a864
mov qword [rdi], sendto
mov qword [rdi - 8], r14
mov byte [rdi - 0x18], 0
add rdi, 0x30
lea rax, [rdi - 0x20]
cmp rax, rbp
jne 0x18000a300
mov rcx, qword [rsp + 0x58]
call fcn.18009a864
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov rcx, qword [rsp + 0x40]
call fcn.18009a864
cmp dword [rsp + 0x30], 0
je 0x18000a398
cmp qword [rsi + 0x20], 8
jb 0x18000a35f
mov rbx, qword [rbx]
mov r8, rbx
lea rdx, str.allow_file_on_allow_encrypted_file:__s
lea rcx, str.banSendFileDbg
call fcn.18005c640
nop
cmp qword [rsp + 0x98], 8
jb 0x18000a38e
mov rcx, qword [rsp + 0x80]
call fcn.18009a864
mov eax, 1
jmp 0x18000a5e2
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
lea r8, [0x1800cdea0]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18000a437
cmp dword [rsp + 0x30], 4
jne 0x18000a437
cmp dword [rsp + 0x38], eax
je 0x18000a437
mov rdx, rsi
mov rcx, r12
call fcn.180009930
test eax, eax
je 0x18000a437
cmp qword [rsi + 0x20], 8
jb 0x18000a3fe
mov rbx, qword [rbx]
mov r8, rbx
lea rdx, str.allow_file_on_allow_docwm_file:__s
lea rcx, str.banSendFileDbg
call fcn.18005c640
nop
cmp qword [rsp + 0x98], 8
jb 0x18000a42d
mov rcx, qword [rsp + 0x80]
call fcn.18009a864
mov eax, 1
jmp 0x18000a5e2
mov edi, r14d
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], r14
mov word [rsp + 0xa8], r14w
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
lea r8, [0x1800cdee0]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18000a544
cmp dword [rsp + 0x30], 4
jne 0x18000a544
cmp dword [rsp + 0x38], eax
je 0x18000a544
lea r8, [rsp + 0xa0]
mov rdx, rsi
mov rcx, r12
call fcn.180009b80
test eax, eax
jne 0x18000a53f
cmp qword [rsi + 0x20], 8
jb 0x18000a4d1
mov rbx, qword [rbx]
mov r8, rbx
lea rdx, str.allow_file_on_not_sens_file:__s
lea rcx, str.banSendFileDbg
call fcn.18005c640
nop
cmp qword [rsp + 0xc0], 8
jb 0x18000a500
mov rcx, qword [rsp + 0xa8]
call fcn.18009a864
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], r14
mov word [rsp + 0xa8], r14w
cmp qword [rsp + 0x98], 8
jb 0x18000a535
mov rcx, qword [rsp + 0x80]
call fcn.18009a864
mov eax, 1
jmp 0x18000a5e2
mov edi, 1
cmp qword [rsi + 0x20], 8
jb 0x18000a550
mov r8, qword [rbx]
jmp 0x18000a553
mov r8, rbx
lea rdx, str.ban_send_file:__s
lea rcx, str.banSendFileDbg
call fcn.18005c640
cmp qword [rsi + 0x20], 8
jb 0x18000a570
mov rbx, qword [rbx]
mov rcx, rbx
call fcn.180004ed0
test eax, eax
jne 0x18000a593
lea r9, [rsp + 0xa0]
mov r8d, edi
mov rdx, rbx
mov ecx, r13d
call fcn.1800084d0
nop
cmp qword [rsp + 0xc0], 8
jb 0x18000a5ab
mov rcx, qword [rsp + 0xa8]
call fcn.18009a864
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], r14
mov word [rsp + 0xa8], r14w
cmp qword [rsp + 0x98], 8
jb 0x18000a5e0
mov rcx, qword [rsp + 0x80]
call fcn.18009a864
xor eax, eax
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.180099fe0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret