Function at 0x18000c49c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
xor ebx, ebx
mov ebp, edx
mov edx, 0x104
mov rsi, rcx
mov qword [rax - 0x80], rcx
mov rcx, qword [0x18002f7f8]
mov r14, r8
mov dword [rsp + 0x44], edx
mov dword [rax - 0x68], edx
mov dword [rax - 0x64], edx
mov r8, rdx
xor edx, edx
mov rdi, r9
mov r13d, ebx
mov r12, rbx
mov qword [rsp + 0x60], rbx
mov r15, rbx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rbx
mov qword [rsp + 0x68], rax
je 0x18000caa0
mov rcx, qword [0x18002f7f8]
xor edx, edx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor ecx, ecx
cmp rax, rcx
mov rbx, rax
mov qword [rsp + 0x78], rax
je 0x18000ca5b
cmp qword [0x18002faf0], rcx
je 0x18000ca5b
mov rdx, qword [0x18002f930]
lea r8, [rsp + 0x80]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
xor edi, edi
cmp eax, edi
jne 0x18000c6f0
mov r12d, r13d
mov rax, qword [rsp + 0x68]
xor edx, edx
lea rcx, [rsp + 0x74]
lea r9, [rsp + 0x70]
mov r8, rbx
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0xea
mov r14d, eax
jne 0x18000c649
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x18002f7f8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x18002f7f8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rsp + 0x44]
mov rcx, qword [0x18002f7f8]
add eax, 0x104
xor edx, edx
mov r8d, eax
mov dword [rsp + 0x44], eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [0x18002f7f8]
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edx, edx
mov rbx, rax
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x68]
cmp rax, rdx
je 0x18000c6db
cmp rbx, rdx
jne 0x18000c57d
jmp 0x18000c64b
xor edx, edx
cmp r14d, edx
jne 0x18000c6db
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, ebp
ja 0x18000c693
mov r9, qword [rsp + 0x68]
lea rax, [rsp + 0x40]
mov r8, rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov edx, ebp
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.18000c140
mov r15, qword [rsp + 0x50]
mov r12d, dword [rsp + 0x40]
jmp 0x18000c698
mov eax, 0x57
xor ecx, ecx
cmp eax, ecx
jne 0x18000c6d3
cmp rsi, qword [rsp + 0xe0]
je 0x18000c6ba
mov rcx, qword [0x18002f7f8]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, r15
mov qword [rsp + 0x58], r15
mov ebp, r12d
mov dword [rsp + 0xe8], r12d
mov r13d, 1
add edi, 1
jmp 0x18000c576
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, qword [rsp + 0x60]
xor edi, edi
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x58]
call fcn.18000bed4
mov ebp, dword [rsp + 0xe8]
mov rsi, qword [rsp + 0x58]
or r13d, eax
lea r9, [rsp + 0x50]
lea r8, [0x18003243d]
mov edx, ebp
mov rcx, rsi
mov dword [rsp + 0x40], r13d
call fcn.18001799c
mov r14d, dword [rsp + 0xe0]
mov dword [rsp + 0x44], r14d
jmp 0x18000c8a0
mov edi, dword [rsp + 0x50]
xor r15d, r15d
cmp r12, r15
je 0x18000c769
cmp r14d, edi
jae 0x18000c764
mov rcx, qword [0x18002f7f8]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, r15
cmp r12, r15
jne 0x18000c78e
mov rcx, qword [0x18002f7f8]
mov r8, rdi
xor edx, edx
mov r14d, edi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r15
mov r12, rax
je 0x18000c8ae
lea eax, [rdi - 6]
lea rdx, [r13 + 5]
mov rcx, r12
mov r8d, eax
mov ebx, eax
call sub.ntdll.dll_memcpy
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov rcx, r12
mov byte [rbx + r12], r15b
call fcn.1800043fc
mov rcx, qword [0x18002f7f8]
cmp eax, r15d
mov eax, dword [rsp + 0x48]
cmovne eax, r15d
xor edx, edx
mov dword [rsp + 0x48], eax
sub eax, edi
add eax, ebp
mov r8d, eax
mov dword [rsp + 0x58], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r15
mov rbx, rax
je 0x18000c869
mov r15d, r13d
mov rdx, rsi
mov rcx, rax
sub r15d, esi
mov r8d, r15d
call sub.ntdll.dll_memcpy
mov eax, dword [rsp + 0x48]
xor ecx, ecx
cmp eax, ecx
je 0x18000c821
mov rdx, qword [rsp + 0x60]
mov ecx, r15d
mov r8, rax
add rcx, rbx
call sub.ntdll.dll_memcpy
mov eax, dword [rsp + 0x48]
mov ecx, eax
mov eax, r15d
sub ebp, r15d
add rcx, rax
sub ebp, edi
lea rdx, [r13 + rdi]
add rcx, rbx
mov r8d, ebp
call sub.ntdll.dll_memcpy
cmp rsi, qword [rsp + 0xe0]
je 0x18000c85a
mov rcx, qword [0x18002f7f8]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebp, dword [rsp + 0x58]
mov rsi, rbx
mov dword [rsp + 0x40], 1
xor edi, edi
cmp dword [rsp + 0x48], edi
je 0x18000c885
mov r8, qword [rsp + 0x60]
mov rcx, qword [0x18002f7f8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rbx, rdi
je 0x18000c8b0
lea r9, [rsp + 0x50]
lea r8, [0x18003243d]
mov edx, ebp
mov rcx, rsi
call fcn.18001799c
cmp rax, rdi
mov r13, rax
jne 0x18000c73e
jmp 0x18000c8b0
xor edi, edi
lea r9, [rsp + 0x50]
lea r8, [0x180032445]
mov edx, ebp
mov rcx, rsi
call fcn.18001799c
cmp rax, rdi
mov r15, rax
je 0x18000ca23
cmp r12, rdi
mov r13d, dword [rsp + 0x50]
je 0x18000c8fb
cmp r14d, r13d
jae 0x18000c8f6
mov rcx, qword [0x18002f7f8]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, rdi
cmp r12, rdi
jne 0x18000c91e
mov rcx, qword [0x18002f7f8]
mov r8, r13
xor edx, edx
mov dword [rsp + 0x44], r13d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rdi
mov r12, rax
je 0x18000ca41
lea eax, [r13 - 9]
lea rdx, [r15 + 8]
mov rcx, r12
mov r8d, eax
mov ebx, eax
call sub.ntdll.dll_memcpy
mov dx, 0x3b
mov rcx, r12
mov byte [rbx + r12], dil
call qword [sym.imp.SHLWAPI.dll_StrChrA]
cmp rax, rdi
je 0x18000c975
lea rcx, [rax + 1]
lea r8, [rsp + 0x58]
xor edx, edx
mov byte [rax], dil
call qword [sym.imp.SHLWAPI.dll_StrToIntExA]
cmp eax, edi
je 0x18000c975
mov r8d, dword [rsp + 0x58]
lea rcx, [0x18002fba0]
mov rdx, r12
call fcn.180006ea8
mov rcx, qword [0x18002f7f8]
mov r14d, ebp
xor edx, edx
sub r14d, r13d
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rdi
mov qword [rsp + 0x60], rax
je 0x18000ca23
mov ebx, r15d
mov rdx, rsi
mov rcx, rax
sub ebx, esi
mov r8d, ebx
mov edi, ebx
call sub.ntdll.dll_memcpy
sub ebp, ebx
mov rbx, qword [rsp + 0x60]
sub ebp, r13d
lea rdx, [r15 + r13]
lea rcx, [rdi + rbx]
mov r8d, ebp
call sub.ntdll.dll_memcpy
cmp rsi, qword [rsp + 0xe0]
je 0x18000c9e6
mov rcx, qword [0x18002f7f8]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r9, [rsp + 0x50]
lea r8, [0x180032445]
mov r13d, 1
mov edx, r14d
mov rcx, rbx
mov rsi, rbx
mov ebp, r14d
mov dword [rsp + 0x40], r13d
call fcn.18001799c
mov r14d, dword [rsp + 0x44]
xor edi, edi
mov r15, rax
cmp rax, rdi
jne 0x18000c8d2
jmp 0x18000ca28
mov r13d, dword [rsp + 0x40]
cmp r12, rdi
je 0x18000ca46
mov rcx, qword [0x18002f7f8]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18000ca46
mov r13d, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0xf8]
mov r14, qword [rsp + 0xf0]
mov rax, qword [rsp + 0x68]
xor r12d, r12d
cmp rax, r12
je 0x18000ca7a
mov rcx, qword [0x18002f7f8]
mov r8, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rbx, r12
je 0x18000ca91
mov rcx, qword [0x18002f7f8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13d, r12d
je 0x18000caa0
cmp rdi, r12
mov qword [r14], rsi
je 0x18000caa0
mov dword [rdi], ebp
mov eax, r13d
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret