Function at 0x18001be20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x1800b2020]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r15, rcx
xor r12d, r12d
mov esi, r12d
mov dword [rbp - 0x49], r12d
cmp qword [rcx + 0x78], rsi
jne 0x18001c8f9
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x1800a50e0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x18001c024
lea rdx, [rbp - 0x21]
call fcn.18001c990
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x18001bea9
mov rcx, qword [rax]
mov dword [rsp + 0x30], ebx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x17], xmm0
mov qword [rbp - 0x79], 2
lea rax, [rbp + 0x17]
mov qword [rbp - 0x71], rax
mov qword [rsp + 0x30], rcx
mov rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x18001bed6
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rbp - 0x79]
movdqa xmmword [rbp - 0x79], xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm1
lea r8, [rbp - 0x79]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x41]
call fcn.180024380
nop
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x69]
call fcn.18002e720
nop
lea rbx, [rbp - 0x69]
cmp qword [rbp - 0x51], 8
cmovae rbx, qword [rbp - 0x69]
call fcn.18002f970
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str._antimalware_provider__::_CAntimalwareProvider::GetDisplayName____
lea edx, [r9 + 8]
mov rcx, rax
call fcn.18002caa0
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 8
jb 0x18001bf89
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001bf84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c933
call fcn.18006080c
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], 7
mov word [rbp - 0x69], r12w
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x18001bfdb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001bfd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c939
call fcn.18006080c
nop
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x18001c75d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c01a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c93f
call fcn.18006080c
jmp 0x18001c75d
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x18001c1e1
lea rdx, [rbp - 0x21]
call fcn.18001cb80
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x18001c069
mov rcx, qword [rax]
mov dword [rbp + 0x17], ebx
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 0x17], xmm0
mov qword [rsp + 0x30], 2
lea rax, [rbp + 0x17]
mov qword [rsp + 0x38], rax
mov qword [rbp - 0x79], rcx
mov rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x18001c095
mov qword [rbp - 0x71], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [rbp - 0x79]
movdqa xmmword [rbp - 0x79], xmm1
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x41]
call fcn.180024380
nop
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x69]
call fcn.18002e720
nop
lea rbx, [rbp - 0x69]
cmp qword [rbp - 0x51], 8
cmovae rbx, qword [rbp - 0x69]
call fcn.18002f970
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str._antimalware_provider__::_CAntimalwareProvider::GetDisplayName____
lea edx, [r9 + 8]
mov rcx, rax
call fcn.18002caa0
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 8
jb 0x18001c147
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c142
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c945
call fcn.18006080c
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], 7
mov word [rbp - 0x69], r12w
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x18001c199
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c193
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c94b
call fcn.18006080c
nop
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x18001c75d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c01a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c927
jmp 0x18001c01a
mov eax, dword [rbp - 1]
cmp eax, 0x800
jbe 0x18001c380
lea rdx, [rbp - 0x21]
call fcn.18001cdb0
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x18001c205
mov rdx, qword [rax]
mov ecx, dword [rbp - 1]
mov dword [rbp + 0x17], ecx
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 0x17], xmm0
mov qword [rsp + 0x30], 2
lea rax, [rbp + 0x17]
mov qword [rsp + 0x38], rax
mov qword [rbp - 0x79], rdx
mov rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x18001c234
mov qword [rbp - 0x71], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [rbp - 0x79]
movdqa xmmword [rbp - 0x79], xmm1
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x41]
call fcn.180024380
nop
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x69]
call fcn.18002e720
nop
lea rbx, [rbp - 0x69]
cmp qword [rbp - 0x51], 8
cmovae rbx, qword [rbp - 0x69]
call fcn.18002f970
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str._antimalware_provider__::_CAntimalwareProvider::GetDisplayName____
lea edx, [r9 + 8]
mov rcx, rax
call fcn.18002caa0
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 8
jb 0x18001c2e6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c2e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c951
call fcn.18006080c
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], 7
mov word [rbp - 0x69], r12w
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x18001c338
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c332
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c957
call fcn.18006080c
nop
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x18001c75d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c01a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c92d
jmp 0x18001c01a
lea ecx, [rax + 1]
mov eax, 2
mul rcx
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.1800610fc
mov r14, rax
mov ecx, dword [rbp - 1]
mov word [rax + rcx*2], r12w
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x18001c5d6
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [r14 + r8*2], si
jne 0x18001c3e0
lea rbx, [r15 + 0x68]
mov rdx, r14
mov rcx, rbx
call fcn.180002a60
mov rcx, r14
call fcn.18006080c
call fcn.18002f970
mov rcx, qword [rax]
cmp dword [rcx], esi
je 0x18001c4df
cmp qword [rbx + 0x18], 8
jb 0x18001c41b
mov rbx, qword [rbx]
lea rdx, [rbp - 0x21]
call fcn.18001d2b0
nop
mov dword [rbp - 0x49], 1
cmp qword [rax + 0x18], 8
jb 0x18001c436
mov rax, qword [rax]
mov qword [rbp + 0x17], rbx
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 0x17], xmm0
mov qword [rsp + 0x30], 0xc
lea rcx, [rbp + 0x17]
mov qword [rsp + 0x38], rcx
mov qword [rbp - 0x79], rax
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18001c460
mov qword [rbp - 0x71], rdi
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [rbp - 0x79]
movdqa xmmword [rbp - 0x79], xmm1
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x41]
call fcn.180024380
nop
mov dword [rbp - 0x49], 0x2003
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x69]
call fcn.18002e720
nop
mov esi, 0x6007
mov dword [rbp - 0x49], esi
lea rbx, [rbp - 0x69]
cmp qword [rbp - 0x51], 8
cmovae rbx, qword [rbp - 0x69]
call fcn.18002f970
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str._antimalware_provider__::_CAntimalwareProvider::GetDisplayName____
xor edx, edx
mov rcx, rax
call fcn.18002caa0
nop
test sil, 4
je 0x18001c539
and esi, 0xfffffffb
mov rdx, qword [rbp - 0x51]
cmp rdx, 8
jb 0x18001c528
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c523
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c95d
call fcn.18006080c
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], 7
mov word [rbp - 0x69], r12w
test sil, 2
je 0x18001c583
and esi, 0xfffffffd
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x18001c583
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c57d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c963
call fcn.18006080c
nop
test sil, 1
je 0x18001c8f9
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x18001c8f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c5cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c969
call fcn.18006080c
jmp 0x18001c8f9
lea rdx, [rbp - 0x21]
call fcn.18001d0b0
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x18001c5ec
mov rcx, qword [rax]
mov dword [rbp + 0x17], ebx
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 0x17], xmm0
mov qword [rsp + 0x30], 2
lea rax, [rbp + 0x17]
mov qword [rsp + 0x38], rax
mov qword [rbp - 0x79], rcx
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x18001c611
mov qword [rbp - 0x71], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [rbp - 0x79]
movdqa xmmword [rbp - 0x79], xmm1
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x41]
call fcn.180024380
nop
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x69]
call fcn.18002e720
nop
lea rbx, [rbp - 0x69]
cmp qword [rbp - 0x51], 8
cmovae rbx, qword [rbp - 0x69]
call fcn.18002f970
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str._antimalware_provider__::_CAntimalwareProvider::GetDisplayName____
lea edx, [r9 + 8]
mov rcx, rax
call fcn.18002caa0
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 8
jb 0x18001c6c3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c6be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c96f
call fcn.18006080c
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], 7
mov word [rbp - 0x69], r12w
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x18001c715
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c70f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c975
call fcn.18006080c
nop
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x18001c755
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c750
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c97b
call fcn.18006080c
mov rcx, r14
call fcn.18006080c
lea rdx, [rbp - 0x21]
call fcn.18001d460
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x18001c773
mov rcx, qword [rax]
lea rsi, str.Bitdefender_AMSI_Provider
mov qword [rbp + 0x17], rsi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 0x17], xmm0
mov qword [rsp + 0x30], 0xc
lea rax, [rbp + 0x17]
mov qword [rsp + 0x38], rax
mov qword [rbp - 0x79], rcx
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x18001c7a0
mov qword [rbp - 0x71], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [rbp - 0x79]
movdqa xmmword [rbp - 0x79], xmm1
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x41]
call fcn.180024380
nop
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x69]
call fcn.18002e720
nop
lea rbx, [rbp - 0x69]
cmp qword [rbp - 0x51], 8
cmovae rbx, qword [rbp - 0x69]
call fcn.18002f970
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str._antimalware_provider__::_CAntimalwareProvider::GetDisplayName____
lea edx, [r9 + 8]
mov rcx, rax
call fcn.18002caa0
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 8
jb 0x18001c852
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c84d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c981
call fcn.18006080c
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], 7
mov word [rbp - 0x69], r12w
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x18001c8a4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c89e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c987
call fcn.18006080c
nop
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x18001c8e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c8db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c921
call fcn.18006080c
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x18001c8e0
mov r8, rdi
lea rcx, [r15 + 0x68]
mov rdx, rsi
call fcn.180002a60
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1800607b0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.18006e72c
int3
call fcn.18006e72c
int3
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
int3