Function at 0x1800b03d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r13
push r14
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov qword [rbp + 0x58], r12
mov rax, qword [0x1801903f8]
xor rax, rbp
mov qword [rbp + 0x18], rax
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
mov r14, rcx
or r8, 0xffffffffffffffff
xor edx, edx
mov r12, qword [rbp + 0x60]
mov rcx, r12
call fcn.18011ac90
test rsi, rsi
je 0x1800b0441
or ebx, 0x20019
mov r8d, ebx
mov rdx, rsi
mov rcx, r14
call fcn.1800aeab0
mov rsi, rax
jmp 0x1800b0444
mov rsi, r14
test rsi, rsi
je 0x1800b070f
call fcn.1800d08e0
test eax, eax
je 0x1800b052f
lea rax, [rbp]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 4]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800b0702
mov eax, dword [rbp + 4]
cmp eax, 1
je 0x1800b04a2
cmp eax, 2
je 0x1800b04a2
cmp eax, 6
je 0x1800b04a2
cmp eax, 7
jne 0x1800b0702
mov ecx, dword [rbp]
add ecx, 2
call fcn.180030824
mov r13, rax
mov r8d, dword [rbp]
add r8d, 2
xor edx, edx
mov rcx, rax
call fcn.18007ead0
lea r11, [rbp]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800b06fa
mov rbx, r13
cmp word [r13], ax
je 0x1800b06de
nop dword [rax + rax]
mov r8, rbx
mov rdx, qword [r12 + 0x10]
mov rcx, r12
call fcn.18011b8f0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
lea rbx, [rbx + rcx*2]
cmp word [rbx], ax
jne 0x1800b0500
jmp 0x1800b06de
test rdi, rdi
je 0x1800b058b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1800b054a
xor edi, edi
jmp 0x1800b058b
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800b0566
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18011bdc0
sub rsp, rcx
lea rcx, [rsp + 0x30]
mov r9d, 3
mov rdx, rdi
call fcn.180032f40
mov rdi, rax
lea rax, [rbp]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 4]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800b0702
mov eax, dword [rbp + 4]
cmp eax, 1
je 0x1800b05d3
cmp eax, 2
je 0x1800b05d3
cmp eax, 6
je 0x1800b05d3
cmp eax, 7
jne 0x1800b0702
mov ecx, dword [rbp]
add ecx, 2
call fcn.180030824
mov r13, rax
mov r8d, dword [rbp]
add r8d, 2
xor edx, edx
mov rcx, rax
call fcn.18007ead0
lea r11, [rbp]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800b06fa
mov rbx, r13
cmp byte [r13], al
je 0x1800b06de
call fcn.180032e40
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x1800b06d3
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp + 8], rax
test rbx, 0xffffffffffff0000
jne 0x1800b0677
movzx edi, bx
mov ecx, edi
call fcn.180035ed8
test rax, rax
je 0x1800b0684
mov r8d, edi
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.1800155c0
jmp 0x1800b0684
mov rdx, rbx
lea rcx, [rbp + 8]
call fcn.1800154f0
nop
lea r8, [rbp + 8]
mov rdx, qword [r12 + 0x10]
mov rcx, r12
call fcn.18011b5a0
nop
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800b06b5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
mov eax, ecx
add rbx, rax
cmp byte [rbx], 0
jne 0x1800b0628
jmp 0x1800b06de
mov ecx, 0x80004005
call fcn.180004010
int3
cmp rsi, r14
je 0x1800b06eb
mov rcx, rsi
call fcn.1800aeb30
mov rcx, r13
call fcn.18003082c
mov eax, 1
jmp 0x1800b0711
mov rcx, r13
call fcn.18003082c
cmp rsi, r14
je 0x1800b070f
mov rcx, rsi
call fcn.1800aeb30
xor eax, eax
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.18007e1e0
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
mov r12, qword [rbp + 0x58]
lea rsp, [rbp + 0x20]
pop r14
pop r13
pop rbp
ret