Function at 0x180005760
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x168]
sub rsp, 0x268
mov rax, qword [0x18030a008]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov qword [rbp - 0x50], r9
mov r12, r8
mov rbx, rdx
mov r13, rcx
mov rax, qword [rbp + 0x1d0]
mov qword [rbp - 0x58], rax
mov rcx, qword [rbp + 0x1d8]
mov qword [rbp - 0x48], rcx
xor edx, edx
mov dword [rsp + 0x68], edx
mov dword [r9], edx
mov dword [rax], edx
mov rax, r8
cmp qword [r8 + 0x18], 0x10
jb 0x1800057c8
mov rax, qword [r8]
mov qword [r8 + 0x10], rdx
mov byte [rax], dl
mov byte [rsp + 0x40], dl
mov rdi, qword [rcx]
mov qword [rbp - 0x70], rdi
mov r14, rdi
mov qword [rbp], rdx
mov qword [rbp + 0x10], rdx
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rdx
mov rsi, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x18000580a
mov rbx, qword [rbx]
cmp rsi, 0x10
jae 0x180005824
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 8], 0xf
jmp 0x1800058a4
mov rdi, rsi
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x180005878
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000684a
mov rcx, rax
call fcn.180044ed8
mov rcx, rax
test rax, rax
je 0x1800068aa
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180005887
test rcx, rcx
je 0x180005884
call fcn.180044ed8
jmp 0x180005887
mov rax, rdx
mov qword [rbp - 0x20], rax
lea r8, [rsi + 1]
mov rdx, rbx
mov rcx, rax
call fcn.180046e50
mov qword [rbp - 8], rdi
mov rdi, qword [rbp - 0x70]
xor edx, edx
mov qword [rbp - 0x10], rsi
mov r15, 0xffffffffffffffff
cmp qword [r13 + 0x10], 0
je 0x1800064ad
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
test rdi, rdi
jne 0x180005933
lea rdx, [rbp - 0x40]
mov rcx, r13
call fcn.180006c10
mov rsi, rax
mov qword [rbp - 0x70], rax
test rax, rax
jne 0x1800059f5
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x180006799
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005929
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006892
call fcn.180044ed0
jmp 0x180006799
mov rdx, r13
lea rcx, [rsp + 0x70]
call fcn.1800068b0
mov rbx, rax
lea rax, [rbp - 0x40]
cmp rax, rbx
je 0x1800059b5
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x180005987
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005982
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006850
call fcn.180044ed0
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], al
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 0xf
mov byte [rbx], al
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x1800059f1
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800059ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006850
call fcn.180044ed0
mov rsi, qword [rbp - 0x70]
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x70]
call fcn.180008e10
mov rbx, rax
lea rax, [rbp]
cmp rax, rbx
je 0x180005a80
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x180005a4a
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005a45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006856
call fcn.180044ed0
xor edi, edi
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], 0xf
mov byte [rbp], dil
movups xmm0, xmmword [rbx]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dil
jmp 0x180005a82
xor edi, edi
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x180005abe
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005ab9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006856
call fcn.180044ed0
cmp qword [rbp - 0x10], 0
jne 0x180005d8c
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
mov dword [rsp + 0x68], 8
cmp qword [rbp - 0x30], 0
je 0x180005bb7
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x40]
call fcn.180047500
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae r8, qword [rbp - 0x40]
mov edx, 0x104
lea rcx, [rbp + 0x40]
call fcn.1800514d4
lea rcx, [rbp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
test eax, eax
je 0x180005bb7
lea rax, [rbp + 0x40]
mov r8, r15
inc r8
cmp byte [rax + r8], 0
jne 0x180005b36
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.1800043d0
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x180005bb7
lea rax, [rbp + 0x20]
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
setae r10b
mov r9, qword [rbp + 0x20]
cmovae rax, r9
movzx r8d, byte [rcx + rax - 1]
cmp r8b, 0x5c
je 0x180005bb7
cmp r8b, 0x2f
je 0x180005bb7
cmp rcx, rdx
jae 0x180005ba0
lea rax, [rcx + 1]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
test r10b, r10b
cmovne rax, r9
mov word [rax + rcx], 0x5c
jmp 0x180005bb7
mov r9b, 0x5c
movzx r8d, byte [rsp + 0x40]
mov edx, 1
lea rcx, [rbp + 0x20]
call fcn.18000c2c0
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x70]
call fcn.180008e10
mov rbx, rax
lea rax, [rbp]
cmp rax, rbx
je 0x180005c40
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x180005c0c
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005c07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000685c
call fcn.180044ed0
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
nop word [rax + rax]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x180005c7c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005c77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000685c
call fcn.180044ed0
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x180005cc8
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005cc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006862
call fcn.180044ed0
mov rdx, r13
lea rcx, [rsp + 0x70]
call fcn.180008cd0
mov rbx, rax
lea rax, [rbp - 0x20]
cmp rax, rbx
je 0x180005d50
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x180005d1c
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005d17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006868
call fcn.180044ed0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
nop word [rax + rax]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x180005d8c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005d87
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006868
call fcn.180044ed0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x20], rdi
mov dword [rbp + 0x28], edi
mov qword [rbp + 0x30], rdi
xor ecx, ecx
call fcn.180069614
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
xor r8d, r8d
lea rdx, [0x1802d85f8]
lea rcx, [rsp + 0x70]
call fcn.1800043d0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x68]
call fcn.1800080e0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x180005e20
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005e1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000686e
call fcn.180044ed0
nop
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov eax, 7
mov qword [rsp + 0x60], rax
mov word [rsp + 0x48], di
mov dword [rsp + 0x68], 1
cmp qword [rbp + 0x10], 0
je 0x180005ef7
lea r8, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae r8, qword [rbp]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
lea rcx, [rbx + 1]
mov eax, 2
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.18004569c
mov rdi, rax
lea r8, [rbx*2 + 2]
xor edx, edx
mov rcx, rax
call fcn.180047500
lea r8, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae r8, qword [rbp]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
mov r9d, r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, r15
nop word [rax + rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x180005ed0
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180003590
mov rcx, rdi
call fcn.180044ed0
mov rax, qword [rsp + 0x60]
xor edi, edi
lea r8, [rsp + 0x48]
cmp rax, 8
cmovae r8, qword [rsp + 0x48]
mov r9d, 0x20019
mov rdx, rsi
lea rcx, [rbp + 0x20]
call fcn.180008440
mov ebx, eax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x180005f5c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005f57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006874
call fcn.180044ed0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x180005f90
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rax
test rax, rax
je 0x180005f90
mov rax, qword [rax]
mov edx, 1
call qword [rax]
mov rsi, qword [rbp + 0x20]
test ebx, ebx
jne 0x180006436
xor ecx, ecx
call fcn.180069614
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], bl
xor r8d, r8d
lea rdx, [0x1802d85f8]
lea rcx, [rsp + 0x70]
call fcn.1800043d0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x68]
call fcn.1800080e0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x18000601d
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006017
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000687a
call fcn.180044ed0
nop
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov eax, 7
mov qword [rsp + 0x60], rax
mov word [rsp + 0x48], di
mov dword [rsp + 0x68], 2
cmp qword [rbp - 0x10], 0
je 0x1800060eb
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae r8, qword [rbp - 0x20]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
lea rcx, [rbx + 1]
mov eax, 2
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.18004569c
mov rdi, rax
lea r8, [rbx*2 + 2]
xor edx, edx
mov rcx, rax
call fcn.180047500
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae r8, qword [rbp - 0x20]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
mov r9d, r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, r15
inc r8
cmp word [rdi + r8*2], 0
jne 0x1800060c4
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180003590
mov rcx, rdi
call fcn.180044ed0
mov rax, qword [rsp + 0x60]
xor edi, edi
lea rdx, [rsp + 0x48]
cmp rax, 8
cmovae rdx, qword [rsp + 0x48]
mov r13, qword [rbp - 0x58]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdi
mov r9, qword [rbp - 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x18000615c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006157
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006880
call fcn.180044ed0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x180006190
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rax
test rax, rax
je 0x180006190
mov rax, qword [rax]
mov edx, 1
call qword [rax]
test ebx, ebx
jne 0x18000643a
mov eax, dword [r13]
test eax, eax
je 0x18000643a
mov ecx, eax
mov rdx, qword [r12 + 0x10]
mov r8, qword [r12 + 0x18]
cmp rax, rdx
ja 0x1800061cd
mov rax, r12
cmp r8, 0x10
jb 0x1800061c2
mov rax, qword [r12]
mov qword [r12 + 0x10], rcx
mov byte [rax + rcx], 0
jmp 0x180006222
mov rdi, rcx
sub rdi, rdx
mov rax, r8
sub rax, rdx
cmp rdi, rax
ja 0x180006207
mov qword [r12 + 0x10], rcx
mov rax, r12
cmp r8, 0x10
jb 0x1800061f0
mov rax, qword [r12]
lea rbx, [rax + rdx]
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.180047500
mov byte [rdi + rbx], 0
jmp 0x180006220
mov byte [rsp + 0x20], 0
mov r9, rdi
movzx r8d, byte [rsp + 0x40]
mov rdx, rdi
mov rcx, r12
call fcn.1800076f0
xor edi, edi
xor edx, edx
mov rcx, r12
call fcn.180007d20
mov r14, rax
xor ecx, ecx
call fcn.180069614
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
xor r8d, r8d
lea rdx, [0x1802d85f8]
lea rcx, [rsp + 0x70]
call fcn.1800043d0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x68]
call fcn.1800080e0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x1800062b1
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800062ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006886
call fcn.180044ed0
nop
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov eax, 7
mov qword [rsp + 0x60], rax
mov word [rsp + 0x48], di
mov dword [rsp + 0x68], 4
cmp qword [rbp - 0x10], 0
je 0x180006387
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae r8, qword [rbp - 0x20]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
lea rcx, [rbx + 1]
mov eax, 2
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.18004569c
mov rdi, rax
lea r8, [rbx*2 + 2]
xor edx, edx
mov rcx, rax
call fcn.180047500
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae r8, qword [rbp - 0x20]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
mov r9d, r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, r15
nop dword [rax + rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x180006360
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180003590
mov rcx, rdi
call fcn.180044ed0
mov rax, qword [rsp + 0x60]
xor edi, edi
lea rdx, [rsp + 0x48]
cmp rax, 8
cmovae rdx, qword [rsp + 0x48]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov r9, qword [rbp - 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1800063f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800063ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000688c
call fcn.180044ed0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x180006427
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rax
test rax, rax
je 0x180006427
mov rax, qword [rax]
mov edx, 1
call qword [rax]
cmp qword [r12 + 0x10], 0
setne bl
mov byte [rsp + 0x40], bl
jmp 0x18000643c
mov r13, qword [rbp - 0x58]
xor bl, bl
test rsi, rsi
je 0x18000644d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, rdi
test rsi, rsi
je 0x18000645c
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x180006497
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006492
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006892
call fcn.180044ed0
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov rcx, qword [rbp - 0x70]
jmp 0x1800064c5
xor bl, bl
mov byte [rsp + 0x40], bl
mov rcx, r14
test r14, r14
je 0x180006799
mov r13, qword [rbp - 0x58]
xor edi, edi
mov rax, qword [rbp - 0x48]
cmp qword [rax], 0
jne 0x1800064d5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x180006799
mov rcx, qword [rbp - 0x50]
mov ecx, dword [rcx]
sub ecx, 1
je 0x1800064f1
cmp ecx, 1
jne 0x180006799
mov eax, dword [r13]
test eax, eax
je 0x180006799
cmp qword [r12 + 0x10], 0
je 0x180006799
lea rcx, [rax + 2]
call fcn.18004569c
mov rsi, rax
mov r8d, dword [r13]
add r8, 2
xor edx, edx
mov rcx, rax
call fcn.180047500
mov rdx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x180006536
mov rdx, qword [r12]
mov r8d, dword [r13]
mov rcx, rsi
call fcn.180046e50
xor ecx, ecx
call fcn.180069614
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
xor r8d, r8d
lea rdx, [0x1802d85f8]
lea rcx, [rsp + 0x48]
call fcn.1800043d0
nop
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x68]
call fcn.1800080e0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1800065c6
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800065c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006898
call fcn.180044ed0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], di
mov r8, r15
inc r8
cmp word [rsi + r8*2], 0
jne 0x1800065f0
mov rdx, rsi
lea rcx, [rbp - 0x40]
call fcn.180003590
nop
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov dword [rsp + 0x68], 0x10
cmp qword [rbp - 0x30], 0
je 0x1800066d4
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae r8, qword [rbp - 0x40]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
lea rcx, [rdi + 1]
call fcn.18004569c
mov r14, rax
lea r8, [rdi + 1]
xor edx, edx
mov rcx, rax
call fcn.180047500
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae r8, qword [rbp - 0x40]
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r14
mov r9d, r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop dword [rax]
inc r15
cmp byte [r14 + r15], 0
jne 0x1800066b0
mov r8, r15
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.1800043d0
mov rcx, r14
call fcn.180044ed0
xor edi, edi
lea rdx, [rsp + 0x70]
mov rcx, r12
call fcn.180003df0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x18000671f
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006719
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000689e
call fcn.180044ed0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x18000675f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000675a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800068a4
call fcn.180044ed0
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], di
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x180006790
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rax
test rax, rax
je 0x180006790
mov rax, qword [rax]
mov edx, 1
call qword [rax]
mov rcx, rsi
call fcn.180044ed0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1800067d4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800067cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800068aa
call fcn.180044ed0
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], al
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x18000681c
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006817
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006844
call fcn.180044ed0
movzx eax, byte [rsp + 0x40]
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.180044eb0
add rsp, 0x268
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18004b52c
nop
call fcn.180004240
nop
call fcn.18004b52c
int3
call fcn.18004b52c
nop
call fcn.18004b52c
nop
call fcn.18004b52c
int3
call fcn.18004b52c
nop
call fcn.18004b52c
nop
call fcn.18004b52c
nop
call fcn.18004b52c
nop
call fcn.18004b52c
nop
call fcn.18004b52c
nop
call fcn.18004b52c
nop
call fcn.18004b52c
int3
call fcn.18004b52c
nop
call fcn.18004b52c
nop
call fcn.18004b52c
nop
call fcn.18004b52c
int3