Function at 0x180008170
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1550]
mov eax, 0x1650
call fcn.18003f030
sub rsp, rax
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x1688], rbx
mov qword [rsp + 0x1690], rsi
mov qword [rsp + 0x1698], rdi
mov rax, qword [0x18009e080]
xor rax, rsp
mov qword [rbp + 0x1540], rax
mov r14, rcx
xor edi, edi
mov r15d, edi
mov dword [rsp + 0x40], edi
mov eax, dword [rcx + 4]
mov dword [rsp + 0x44], eax
mov eax, dword [rcx + 8]
mov dword [rsp + 0x48], eax
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x540]
call fcn.1800408d0
mov r12d, edi
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], rdi
mov byte [rbp + 0x28], dil
mov byte [rbp + 0x38], dil
mov byte [rbp + 0x58], dil
lea rax, [rbp + 0x78]
mov qword [rbp + 0x78], rax
lea rax, [rbp + 0x78]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rdi
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0x98], rdi
mov qword [rbp + 0xa0], rdi
call fcn.18000f7e0
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa8], rdi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xb0], xmm0
mov rdx, qword [r14 + 0x130]
mov rcx, qword [r14 + 0x128]
call fcn.1800115c0
mov rax, qword [r14 + 0x128]
mov qword [r14 + 0x130], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareNanoCraftDebugWin
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180008881
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Width
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Height
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Stat
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x30], 0x3c
lea rax, [r14 + 0x4c]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.LogFont
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x30], 4
lea rax, [r14 + 0x88]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.pointSize
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x30], 4
lea rax, [r14 + 0x8c]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.fgColor
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x30], 4
lea rax, [r14 + 0x90]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.bgColor
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x30], 0x1000
mov dword [rsp + 0x50], r12d
inc r12d
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.180010280
mov rbx, rax
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 6
lea rdx, str.RegExp
lea rcx, [rbp - 0x50]
call fcn.18000d660
nop
mov r8, rbx
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.180010a40
cmp qword [rax + 0x18], 0x10
jb 0x18000847a
mov rax, qword [rax]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x540]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete bl
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1800084e4
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800084df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008929
call fcn.18003e434
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x18000852f
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000852a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000892f
call fcn.18003e434
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x18000857a
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008575
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008935
call fcn.18003e434
test bl, bl
je 0x180008792
lea rcx, [rbp + 0xc0]
call fcn.18000d590
nop
mov rdx, rax
lea rcx, [rbp + 0x2e0]
call fcn.18000d440
nop
lea r9, [0x1800811d6]
lea r8, str.__0_1___t_.__t__0_1__
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.180015e30
or r15d, 7
mov dword [rsp + 0x40], r15d
lea rcx, [rbp + 0x2e0]
call fcn.18000be60
nop
mov rcx, qword [rbp + 0x2c8]
test rcx, rcx
je 0x1800085f6
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x1800085f6
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x540]
call fcn.180010bc0
movzx ebx, al
and r15d, 0xfffffffe
mov dword [rsp + 0x40], r15d
lea rcx, [rsp + 0x60]
call fcn.18000a6b0
test bl, bl
je 0x180008420
lea rax, [rbp - 0x50]
mov qword [rsp + 0x50], rax
mov r8d, 3
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x10]
call fcn.18000aa50
mov rdi, rax
mov r8d, 2
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x10]
call fcn.18000aa50
mov rsi, rax
mov qword [rsp + 0x70], rax
mov r8d, 1
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x10]
call fcn.18000aa50
mov rbx, rax
mov rcx, rdi
call fcn.180010cf0
mov edi, eax
mov rcx, rbx
call fcn.180010cf0
test eax, eax
setne cl
mov byte [rbp - 0x80], cl
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.18000b080
mov dword [rbp - 0x58], edi
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x1800086dc
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x1800086d7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000893b
mov rcx, r8
call fcn.18003e434
xor edi, edi
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 0xf
mov byte [rsi], dil
lea r8, [rbp - 0x80]
lea rdx, [r14 + 0x128]
lea rcx, [rsp + 0x78]
call fcn.18000fd90
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x18000873e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008739
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008941
call fcn.18003e434
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x180008420
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008788
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008923
call fcn.18003e434
jmp 0x180008420
mov dword [rsp + 0x30], 4
lea rax, [r14 + 0x194]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MsgLv
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x44]
mov dword [r14 + 4], eax
mov eax, dword [rsp + 0x48]
mov dword [r14 + 8], eax
mov r8d, dword [rsp + 0x58]
mov eax, dword [r14]
test r8b, 2
je 0x1800087f6
or eax, 2
jmp 0x1800087f9
and eax, 0xfffffffd
mov edx, r8d
mov ecx, eax
and ecx, 0xfffffffb
or eax, 4
and dl, 4
cmove eax, ecx
mov edx, r8d
mov ecx, eax
and ecx, 0xfffffff7
or eax, 8
and dl, 8
cmove eax, ecx
mov edx, r8d
mov ecx, eax
and ecx, 0xffffffef
or eax, 0x10
and dl, 0x10
cmove eax, ecx
mov edx, r8d
mov ecx, eax
and ecx, 0xffffffdf
or eax, 0x20
and dl, 0x20
cmove eax, ecx
mov edx, r8d
mov ecx, eax
and ecx, 0xffffffbf
or eax, 0x40
and dl, 0x40
cmove eax, ecx
test r8b, r8b
jns 0x18000885b
bts eax, 7
btr eax, 8
bt r8d, 8
jae 0x18000886a
bts eax, 8
btr eax, 7
mov ecx, eax
btr ecx, 0xa
bts eax, 0xa
and r8d, 0x400
cmove eax, ecx
mov dword [r14], eax
mov rdx, qword [r14 + 0x20]
lea rbx, [r14 + 0x4c]
test rdx, rdx
je 0x1800088b3
mov eax, dword [r14 + 0x90]
mov dword [rsp + 0x28], eax
mov eax, dword [r14 + 0x8c]
mov dword [rsp + 0x20], eax
mov r9d, dword [r14 + 0x88]
mov r8, rbx
call fcn.180006600
mov rdx, qword [r14 + 0x28]
test rdx, rdx
je 0x1800088e1
mov eax, dword [r14 + 0x90]
mov dword [rsp + 0x28], eax
mov eax, dword [r14 + 0x8c]
mov dword [rsp + 0x20], eax
mov r9d, dword [r14 + 0x88]
mov r8, rbx
call fcn.180006600
mov rcx, r14
call fcn.180005ad0
nop
lea rcx, [rbp + 0x10]
call fcn.18000aba0
mov rcx, qword [rbp + 0x1540]
xor rcx, rsp
call fcn.18003e410
lea r11, [rsp + 0x1650]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18004a448
nop
call fcn.18004a448
nop
call fcn.18004a448
nop
call fcn.18004a448
nop
call fcn.18004a448
nop
call fcn.18004a448
int3