Function at 0x18008eb00
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2000]
mov eax, 0x2100
call fcn.1800ec860
sub rsp, rax
mov rax, qword [0x1801b0058]
xor rax, rsp
mov qword [rbp + 0x1ff0], rax
mov r12, r8
mov qword [rsp + 0x68], r8
mov r13, rdx
mov qword [rsp + 0x70], rdx
mov rbx, rcx
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x60], r8
xor r14d, r14d
mov esi, r14d
mov dword [rsp + 0x5c], r14d
mov dword [rsp + 0x44], 0x1000
mov ecx, 0x1000
call fcn.1800ec23c
mov rdi, rax
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 3]
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18008ebcb
mov rcx, rdi
call fcn.1800ebddc
nop
mov rcx, r13
call fcn.180009ad0
nop
mov rcx, r12
call fcn.18000b4a0
mov eax, 1
jmp 0x18008f1ca
mov rbx, qword [rsp + 0x48]
xor edx, edx
lea rax, [rsp + 0x44]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x58], 0x1000
lea r9, [rsp + 0x58]
lea r8, [rbp - 0x10]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x18008f1a3
cmp eax, 0xea
jne 0x18008ec45
mov eax, dword [rsp + 0x44]
add eax, eax
mov dword [rsp + 0x44], eax
mov rcx, rbx
call fcn.1800ebddc
mov ecx, dword [rsp + 0x44]
call fcn.1800ec23c
mov rbx, rax
mov qword [rsp + 0x48], rax
mov edx, esi
jmp 0x18008ebd2
test eax, eax
jne 0x18008f18b
cmp dword [rsp + 0x60], 3
jne 0x18008efc0
cmp qword [r12 + 0x10], 0
je 0x18008ee70
mov r8d, dword [rsp + 0x44]
shr r8, 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r14
mov rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.18000e1a0
nop
mov r11, qword [r12 + 0x10]
mov rbx, r12
cmp qword [r12 + 0x18], 8
jb 0x18008ec9c
mov rbx, qword [r12]
lea r15, [rbp - 0x58]
mov r14, qword [rbp - 0x40]
cmp r14, 8
setae dl
mov byte [rsp + 0x40], dl
mov rsi, qword [rbp - 0x58]
cmovae r15, rsi
mov rdi, qword [rbp - 0x48]
cmp r11, rdi
ja 0x18008ee2d
test r11, r11
jne 0x18008ecd4
xor r14d, r14d
mov eax, r14d
jmp 0x18008ed75
mov rax, rdi
sub rax, r11
inc rax
lea r12, [r15 + rax*2]
mov rax, r15
movzx r10d, word [rbx]
nop dword [rax + rax]
mov rcx, r12
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x18008ed1c
cmp word [rax], r10w
je 0x18008ed19
cmp rcx, 1
je 0x18008ed1c
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x18008ed06
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x18008ee2d
mov r8, r11
mov rdx, rbx
test r11, r11
je 0x18008ed58
mov r9, rax
sub r9, rbx
nop dword [rax]
movzx ecx, word [rdx + r9]
cmp cx, word [rdx]
jne 0x18008edd2
add rdx, 2
sub r8, 1
jne 0x18008ed40
sub rax, r15
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x18008ee2d
mov r12, qword [rsp + 0x68]
movzx edx, byte [rsp + 0x40]
xor r14d, r14d
cmp rdi, rax
jb 0x18008f1fa
mov rcx, rdi
sub rcx, rax
cmp rcx, r11
cmovb r11, rcx
lea rcx, [rbp - 0x58]
test dl, dl
cmovne rcx, rsi
lea rcx, [rcx + rax*2]
sub rdi, r11
lea rdx, [rcx + r11*2]
mov r8, rdi
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.1800eddf0
mov qword [rbp - 0x48], rdi
inc dword [0x1801b6318]
lea rax, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
jb 0x18008eddb
mov rdx, qword [rbp - 0x58]
lea r8, [rdx + rdi*2]
jmp 0x18008ede3
add rax, 2
jmp 0x18008ecf0
lea r8, [rax + rdi*2]
lea rdx, [rbp - 0x58]
sub r8, rdx
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.1800eddf0
lea eax, [rdi + rdi]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18008f088
mov r14, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x58]
jmp 0x18008ee32
mov rbx, qword [rsp + 0x48]
cmp r14, 8
jb 0x18008ee6d
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x18008ee65
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f200
mov rcx, rsi
call fcn.1800ebddc
xor r14d, r14d
cmp qword [r13 + 0x10], 0
je 0x18008ef87
mov r8d, dword [rsp + 0x44]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], r14
mov rdx, rbx
lea rcx, [rbp - 0x38]
call fcn.1800055b0
nop
mov rsi, qword [r13 + 0x10]
mov r12, r13
cmp qword [r13 + 0x18], 0x10
jb 0x18008eeae
mov r12, qword [r13]
lea r13, [rbp - 0x38]
mov r15, qword [rbp - 0x20]
cmp r15, 0x10
setae cl
mov byte [rsp + 0x40], cl
mov r14, qword [rbp - 0x38]
cmovae r13, r14
mov rdi, qword [rbp - 0x28]
cmp rsi, rdi
ja 0x18008ef4b
test rsi, rsi
jne 0x18008eee2
xor r15d, r15d
mov ebx, r15d
jmp 0x18008efe2
mov rax, rdi
sub rax, rsi
inc rax
add rax, r13
mov qword [rsp + 0x78], rax
movsx edx, byte [r12]
mov r8, rax
sub r8, r13
mov rcx, r13
call fcn.1800eeaf0
mov rbx, rax
test rax, rax
je 0x18008ef46
nop
mov r8, rsi
mov rdx, r12
mov rcx, rbx
call fcn.1800eeb90
test eax, eax
je 0x18008efcd
inc rbx
mov r8, qword [rsp + 0x78]
sub r8, rbx
movsx edx, byte [r12]
mov rcx, rbx
call fcn.1800eeaf0
mov rbx, rax
test rax, rax
jne 0x18008ef10
mov rbx, qword [rsp + 0x48]
cmp r15, 0x10
jb 0x18008ef82
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x18008ef7a
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f1f4
mov rcx, r14
call fcn.1800ebddc
mov r13, qword [rsp + 0x70]
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18008f16d
mov r12, qword [rsp + 0x68]
mov esi, dword [rsp + 0x5c]
xor r14d, r14d
inc esi
mov dword [rsp + 0x5c], esi
mov edx, esi
jmp 0x18008ebd2
sub rbx, r13
cmp rbx, 0xffffffffffffffff
je 0x18008ef46
movzx ecx, byte [rsp + 0x40]
xor r15d, r15d
cmp rdi, rbx
jb 0x18008f206
mov rax, rdi
sub rax, rbx
cmp rax, rsi
cmovb rsi, rax
lea rax, [rbp - 0x38]
test cl, cl
cmovne rax, r14
lea rcx, [rax + rbx]
sub rdi, rsi
mov r8, rdi
sub r8, rbx
inc r8
lea rdx, [rcx + rsi]
call fcn.1800eddf0
mov qword [rbp - 0x28], rdi
inc dword [0x1801b6318]
lea rax, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
jb 0x18008f03a
mov rdx, qword [rbp - 0x38]
lea r8, [rdx + rdi]
jmp 0x18008f042
lea r8, [rax + rdi]
lea rdx, [rbp - 0x38]
sub r8, rdx
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.1800eddf0
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18008f0f2
mov r15, qword [rbp - 0x20]
mov r14, qword [rbp - 0x38]
jmp 0x18008ef4b
mov rcx, rbx
call fcn.1800ebddc
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x18008f0dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008f0d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f200
call fcn.1800ebddc
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], r14w
jmp 0x18008ebb0
mov rcx, rbx
call fcn.1800ebddc
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x18008f141
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008f13c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f1f4
call fcn.1800ebddc
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
mov rcx, qword [rsp + 0x70]
call fcn.180009ad0
nop
mov rcx, qword [rsp + 0x68]
call fcn.18000b4a0
mov eax, 1
jmp 0x18008f1ca
mov rcx, rbx
call fcn.1800ebddc
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov r12, qword [rsp + 0x68]
jmp 0x18008ebb0
mov rcx, rbx
call fcn.1800ebddc
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18008ebb0
mov rcx, rbx
call fcn.1800ebddc
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, r13
call fcn.180009ad0
nop
mov rcx, r12
call fcn.18000b4a0
xor eax, eax
mov rcx, qword [rbp + 0x1ff0]
xor rcx, rsp
call fcn.1800eb930
mov rbx, qword [rsp + 0x2158]
add rsp, 0x2100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800fddb0
nop
call fcn.18000c2a0
nop
call fcn.1800fddb0
nop
call fcn.18000c2a0
int3