Function at 0x18006a960
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rsp + 0x348], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov r14, r8
mov rsi, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0xe0]
call fcn.180233580
mov qword [rbp + 0xd8], 0xf
xor r15d, r15d
mov qword [rbp + 0xd0], r15
mov byte [rbp + 0xc0], r15b
lea r8d, [r15 + 6]
lea rdx, str.MySoft
lea rcx, [rbp + 0xc0]
call fcn.18005a720
nop
mov qword [rbp + 0x38], 0xf
mov qword [rbp + 0x30], r15
mov byte [rbp + 0x20], r15b
lea r8d, [r15 + 6]
lea rdx, str.SHSoft
lea rcx, [rbp + 0x20]
call fcn.18005a720
nop
lea r8d, [r15 + 6]
lea rdx, str.SHSoft
lea rcx, [rbp + 0x20]
call fcn.18005a720
mov dword [rsp + 0x58], 0x104
mov qword [rbp - 8], 7
mov qword [rbp - 0x10], r15
mov word [rbp - 0x20], r15w
or rbx, 0xffffffffffffffff
cmp word [rdi], r15w
jne 0x18006aa4a
mov r8d, r15d
jmp 0x18006aa5b
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x18006aa50
mov rdx, rdi
lea rcx, [rbp - 0x20]
call fcn.18005c660
nop
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0xa0]
call fcn.18006d140
nop
mov r8, qword [rbp - 8]
cmp r8, 8
jb 0x18006aa93
inc r8
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
call fcn.18005cac0
mov qword [rbp - 8], 7
mov qword [rbp - 0x10], r15
mov word [rbp - 0x20], r15w
lea rcx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rcx, qword [rbp + 0xc0]
lea r9, [rsp + 0x58]
lea r8, [rbp + 0xe0]
mov edx, dword [rbp + 0xd0]
call fcn.1800587b0
mov qword [rbp + 0x18], 0xf
mov qword [rbp + 0x10], r15
mov byte [rbp], 0
cmp byte [rbp + 0xe0], 0
jne 0x18006aaf0
mov r8, r15
jmp 0x18006ab0a
lea rax, [rbp + 0xe0]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18006ab00
lea rdx, [rbp + 0xe0]
lea rcx, [rbp]
call fcn.18005a720
nop
lea rdx, [rbp]
lea rcx, [rbp + 0x80]
call fcn.18006cf70
nop
mov rax, qword [rbp + 0x18]
cmp rax, 0x10
jb 0x18006ab82
inc rax
mov rcx, qword [rbp]
cmp rax, 0x1000
jb 0x18006ab7d
test cl, 0x1f
je 0x18006ab50
call fcn.180234c4c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18006ab5f
call fcn.180234c4c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18006ab6e
call fcn.180234c4c
int3
cmp rcx, 0x27
jbe 0x18006ab7a
call fcn.180234c4c
int3
mov rcx, rax
call fcn.180203788
mov qword [rbp + 0x18], 0xf
mov qword [rbp + 0x10], r15
mov byte [rbp], 0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0xe0]
call fcn.180233580
mov dword [rsp + 0x58], 0x104
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rcx, qword [rbp + 0x20]
lea r9, [rsp + 0x58]
lea r8, [rbp + 0xe0]
mov edx, dword [rbp + 0x30]
call fcn.1800587b0
mov qword [rbp - 8], 0xf
mov qword [rbp - 0x10], r15
mov byte [rbp - 0x20], 0
cmp byte [rbp + 0xe0], 0
jne 0x18006abee
mov r8, r15
jmp 0x18006ac0a
lea rax, [rbp + 0xe0]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18006ac00
lea rdx, [rbp + 0xe0]
lea rcx, [rbp - 0x20]
call fcn.18005a720
nop
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x60]
call fcn.18006cf70
nop
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x18006ac7f
inc rax
mov rcx, qword [rbp - 0x20]
cmp rax, 0x1000
jb 0x18006ac7a
test cl, 0x1f
je 0x18006ac4d
call fcn.180234c4c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18006ac5c
call fcn.180234c4c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18006ac6b
call fcn.180234c4c
int3
cmp rcx, 0x27
jbe 0x18006ac77
call fcn.180234c4c
int3
mov rcx, rax
call fcn.180203788
mov qword [rbp - 8], 0xf
mov qword [rbp - 0x10], r15
mov byte [rbp - 0x20], 0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0xe0]
call fcn.180233580
mov dword [rsp + 0x58], 0x104
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rcx, qword [rbp + 0xa0]
lea r9, [rsp + 0x58]
lea r8, [rbp + 0xe0]
mov edx, dword [rbp + 0xb0]
call fcn.1800587b0
mov qword [rbp + 0x18], 0xf
mov qword [rbp + 0x10], r15
mov byte [rbp], 0
cmp byte [rbp + 0xe0], 0
jne 0x18006acf7
mov rbx, r15
jmp 0x18006ad09
lea rax, [rbp + 0xe0]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x18006ad00
mov r8, rbx
lea rdx, [rbp + 0xe0]
lea rcx, [rbp]
call fcn.18005a720
nop
lea rdx, [rbp]
lea rcx, [rbp + 0x40]
call fcn.18006cf70
nop
mov rax, qword [rbp + 0x18]
cmp rax, 0x10
jb 0x18006ad81
inc rax
mov rcx, qword [rbp]
cmp rax, 0x1000
jb 0x18006ad7c
test cl, 0x1f
je 0x18006ad4f
call fcn.180234c4c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18006ad5e
call fcn.180234c4c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18006ad6d
call fcn.180234c4c
int3
cmp rcx, 0x27
jbe 0x18006ad79
call fcn.180234c4c
int3
mov rcx, rax
call fcn.180203788
mov qword [rbp + 0x18], 0xf
mov qword [rbp + 0x10], r15
mov byte [rbp], 0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x78], 0x104
lea rcx, [rbp - 0x70]
call fcn.1802065c0
nop
lea rcx, [rbp - 0x70]
call fcn.18020663c
xor r8d, r8d
lea rdx, str.SoftWare
mov rcx, 0xffffffff80000002
test eax, eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
je 0x18006aeb1
mov r9d, 0xf013f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006afee
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rdx, qword [rbp + 0x80]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18006afe2
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rdx, qword [rbp + 0x60]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18006afd7
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf013f
jmp 0x18006af76
mov r9d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006afee
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rdx, qword [rbp + 0x80]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18006afe2
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rdx, qword [rbp + 0x60]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18006afd7
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rdx, qword [rbp + 0x40]
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18006afcc
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x70]
call fcn.1802065e0
nop
mov r8, qword [rbp + 0x58]
cmp r8, 8
jb 0x18006b012
inc r8
mov rdx, qword [rbp + 0x40]
lea rcx, [rbp + 0x40]
call fcn.18005cac0
mov qword [rbp + 0x58], 7
mov qword [rbp + 0x50], r15
mov word [rbp + 0x40], r15w
mov r8, qword [rbp + 0x78]
cmp r8, 8
jb 0x18006b03d
inc r8
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x60]
call fcn.18005cac0
mov qword [rbp + 0x78], 7
mov qword [rbp + 0x70], r15
mov word [rbp + 0x60], r15w
mov r8, qword [rbp + 0x98]
cmp r8, 8
jb 0x18006b071
inc r8
mov rdx, qword [rbp + 0x80]
lea rcx, [rbp + 0x80]
call fcn.18005cac0
mov qword [rbp + 0x98], 7
mov qword [rbp + 0x90], r15
mov word [rbp + 0x80], r15w
mov rax, qword [rbp + 0xb8]
cmp rax, 0x10
jb 0x18006b0e7
inc rax
mov rcx, qword [rbp + 0xa0]
cmp rax, 0x1000
jb 0x18006b0e2
test cl, 0x1f
je 0x18006b0b5
call fcn.180234c4c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18006b0c4
call fcn.180234c4c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18006b0d3
call fcn.180234c4c
int3
cmp rcx, 0x27
jbe 0x18006b0df
call fcn.180234c4c
int3
mov rcx, rax
call fcn.180203788
mov qword [rbp + 0xb8], 0xf
mov qword [rbp + 0xb0], r15
mov byte [rbp + 0xa0], 0
mov rax, qword [rbp + 0x38]
cmp rax, 0x10
jb 0x18006b156
inc rax
mov rcx, qword [rbp + 0x20]
cmp rax, 0x1000
jb 0x18006b151
test cl, 0x1f
je 0x18006b124
call fcn.180234c4c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18006b133
call fcn.180234c4c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18006b142
call fcn.180234c4c
int3
cmp rcx, 0x27
jbe 0x18006b14e
call fcn.180234c4c
int3
mov rcx, rax
call fcn.180203788
mov qword [rbp + 0x38], 0xf
mov qword [rbp + 0x30], r15
mov byte [rbp + 0x20], 0
mov rax, qword [rbp + 0xd8]
cmp rax, 0x10
jb 0x18006b1c2
inc rax
mov rcx, qword [rbp + 0xc0]
cmp rax, 0x1000
jb 0x18006b1bd
test cl, 0x1f
je 0x18006b190
call fcn.180234c4c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18006b19f
call fcn.180234c4c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18006b1ae
call fcn.180234c4c
int3
cmp rcx, 0x27
jbe 0x18006b1ba
call fcn.180234c4c
int3
mov rcx, rax
call fcn.180203788
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x348]
add rsp, 0x300
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret