Function at 0x18003bd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x1800ab9c8]
xor rax, rsp
mov qword [rbp + 0x38], rax
xor r14d, r14d
mov dword [rbp - 0x80], ecx
lea r13d, [rcx - 0xa]
mov dword [rsp + 0x60], r14d
lea r8, [0x180000000]
mov r15, rdx
mov eax, ecx
mov esi, ecx
lea r9d, [r14 + 0x78]
lea r11d, [r14 + 0x63]
lea r10d, [r14 + 0x68]
cmp ecx, r13d
jbe 0x18003c11d
mov r12d, dword [rsp + 0x70]
movabs rdx, 0x65006400690056
mov edi, dword [rsp + 0x70]
mov r14d, dword [rsp + 0x70]
nop dword [rax]
lea eax, [rsi - 0x7d]
cmp eax, 0x18
ja case.0x18003bdf7.128
mov ecx, dword [r8 + rax*4 + 0x3c9cc]
add rcx, r8
jmp rcx
xor eax, eax
mov dword [rbp + 0x26], 0x200064
mov word [rbp + 0x2e], ax
mov dword [rbp + 0x2a], 0x690046
jmp case.0x18003bdf7.128
mov eax, 0x12
cmp eax, 0x12
je 0x18003be54
cmp eax, 0xac
jne 0x18003be8c
mov eax, dword [rsp + 0x50]
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.180089600
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, dword [r15 + 8]
mov dword [r15 + 0x14], eax
test r12d, r12d
je 0x18003c311
cmp r12d, 1
jne 0x18003be7c
mov edx, 0xeb
mov rcx, r15
call fcn.1800680d0
test eax, eax
js 0x18003be27
mov eax, 0x12
mov dword [rsp + 0x50], 1
lea esi, [rax + 0x6b]
add eax, 0x9a
cmp eax, 0x146
jb 0x18003be17
movsxd rax, dword [r15 + 8]
cmp eax, dword [r15 + 0x10]
jle 0x18003c311
mov rcx, rax
mov rax, qword [r15]
movzx edx, byte [rcx + rax - 1]
cmp dl, 0x64
je 0x18003bec3
cmp dl, 0x73
jne 0x18003c311
lea r9, [rsp + 0x68]
mov dword [rsp + 0x68], 6
mov r8d, reloc.SHELL32.dll_SHSetInstanceExplorer
lea rcx, [0x180092100]
mov rdx, r15
call fcn.1800523c0
mov edi, eax
test eax, eax
je 0x18003c311
mov eax, dword [r15 + 8]
mov ecx, edi
mov dword [r15 + 0x14], eax
test edi, edi
je 0x18003c311
sub ecx, 1
je 0x18003c2e5
sub ecx, 1
je 0x18003c1ef
cmp ecx, 1
jne 0x18003c1d3
mov ebx, 0xd1
cmp ebx, 0xd1
je 0x18003bf37
cmp ebx, 0x179
je 0x18003c2ba
jmp 0x18003bfae
mov eax, dword [r15 + 8]
cmp eax, dword [r15 + 0x10]
jle 0x18003c311
dec eax
mov dword [rsp + 0x68], 1
mov dword [r15 + 8], eax
lea r9, [rsp + 0x58]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x48], 0x79
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x48]
mov edx, 0xbd
mov qword [rsp + 0x20], r15
lea rcx, [0x180093030]
mov dword [rsp + 0x58], 0x61
call fcn.180068db0
test eax, eax
js 0x18003c311
sub dword [r15 + 8], eax
mov edx, 0xeb
mov rcx, r15
call fcn.1800680d0
test eax, eax
js 0x18003be27
add ebx, 0xa8
cmp ebx, 0x221
jb 0x18003bf21
jmp 0x18003c1d3
mov eax, dword [0x1800a38fe]
mov dword [rbp + 0x18], eax
movzx eax, word [0x1800a3902]
mov word [rbp + 0x1c], ax
mov qword [rbp + 0x10], rdx
jmp case.0x18003bdf7.128
xor eax, eax
mov dword [rbp + 0x1e], 0x6b0063
mov word [rbp + 0x22], ax
jmp case.0x18003bdf7.128
xor eax, eax
mov dword [rbp + 0x2e], 0x65006c
mov word [rbp + 0x32], ax
jmp case.0x18003bdf7.128
xor eax, eax
mov dword [rbp + 0x22], 0x6e0065
mov word [rbp + 0x26], ax
jmp case.0x18003bdf7.128
mov ebx, r10d
nop dword [rax + rax]
mov eax, ebx
sub eax, 0x68
je 0x18003c078
sub eax, 1
je 0x18003c048
sub eax, 1
je 0x18003c0d5
cmp eax, 1
jne 0x18003c0da
mov esi, 0x95
jmp 0x18003c0da
mov eax, dword [r15 + 8]
mov dword [r15 + 0x14], eax
test edi, edi
je 0x18003c0ca
cmp edi, 1
jne 0x18003c06e
mov edx, 0xeb
mov rcx, r15
call fcn.1800680d0
test eax, eax
js 0x18003be27
mov ebx, 0x69
lea esi, [rbx + 0x2c]
jmp 0x18003c0da
movsxd rax, dword [r15 + 8]
mov r14d, dword [r15 + 0xc]
sub r14d, eax
mov dword [r15 + 0x18], eax
cmp eax, dword [r15 + 0x10]
jle 0x18003c0d5
mov rcx, rax
mov rax, qword [r15]
movzx edx, byte [rcx + rax - 1]
cmp dl, 0x27
je 0x18003c0a2
cmp dl, 0x73
jne 0x18003c0d5
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], 3
mov r8d, reloc.SHELL32.dll_SHSetInstanceExplorer
lea rcx, [0x180092090]
mov rdx, r15
call fcn.1800523c0
mov edi, eax
test eax, eax
jne 0x18003c0da
mov eax, dword [r15 + 0xc]
sub eax, r14d
mov dword [r15 + 8], eax
mov ebx, 0x6a
inc ebx
cmp ebx, 0x6c
jb 0x18003c020
movabs rdx, 0x65006400690056
lea r8, [0x180000000]
mov r10d, 0x68
mov eax, dword [r15 + 8]
mov dword [r15 + 0x18], eax
dec esi
cmp esi, r13d
ja 0x18003bde0
mov eax, dword [rbp - 0x80]
xor r14d, r14d
lea r9d, [r14 + 0x78]
lea r11d, [r14 + 0x63]
mov rbx, qword [rsp + 0x78]
mov edi, eax
movzx esi, byte [rsp + 0x40]
mov edx, dword [rsp + 0x50]
mov r12d, dword [rsp + 0x50]
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x40], sil
mov dword [rsp + 0x58], edx
add eax, 0xb
mov dword [rsp + 0x68], edi
cmp edi, eax
jae case.0x18003c38e.0
lea eax, [rdi - 0x8a]
cmp eax, 0xd
ja case.0x18003c169.146
mov ecx, dword [r8 + rax*4 + 0x3ca30]
add rcx, r8
jmp rcx
movsxd rax, dword [r15 + 8]
cmp eax, dword [r15 + 0x10]
jle 0x18003c311
mov rcx, rax
mov rax, qword [r15]
movzx edx, byte [rcx + rax - 1]
movzx eax, dl
and al, 0xe0
cmp al, 0xc0
jne 0x18003c311
mov ecx, edx
mov edx, 0x3a2a723
and ecx, 0x1f
sar edx, cl
test dl, 1
je 0x18003c311
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], 0x24
mov r8d, reloc.SHELL32.dll_SHSetInstanceExplorer
lea rcx, [0x180099220]
mov rdx, r15
call fcn.1800523c0
mov r12d, eax
test eax, eax
je 0x18003c311
movabs rdx, 0x65006400690056
lea r8, [0x180000000]
mov r10d, 0x68
jmp case.0x18003bdf7.128
mov edi, dword [rsp + 0x70]
mov ebx, 0x4d
nop dword [rax + rax]
mov eax, ebx
sub eax, 0x4d
je 0x18003c2a7
sub eax, 1
je 0x18003c25d
sub eax, 1
je 0x18003c2ba
sub eax, 1
je 0x18003c251
cmp eax, 1
jne 0x18003c2af
mov r9, r15
mov dword [rsp + 0x48], 2
lea r8d, [rax + 0x7f]
lea rdx, [rsp + 0x48]
lea rcx, [0x180093044]
call fcn.180080480
test eax, eax
js 0x18003be27
jmp 0x18003c2af
mov eax, dword [r15 + 0xc]
sub eax, edi
mov dword [r15 + 8], eax
jmp 0x18003c2af
mov eax, dword [r15 + 8]
sub eax, 2
cmp dword [r15 + 0x10], eax
jg 0x18003c2a0
cmp eax, dword [r15 + 0xc]
jg 0x18003c2a0
mov r9, r15
mov dword [r15 + 8], eax
mov r8d, 0x80
mov dword [rsp + 0x48], 1
lea rdx, [rsp + 0x48]
lea rcx, [0x18008be0f]
call fcn.180080480
test eax, eax
js 0x18003be27
jmp 0x18003c2af
mov ebx, 0x4f
jmp 0x18003c2af
mov edi, dword [r15 + 0xc]
sub edi, dword [r15 + 8]
inc ebx
cmp ebx, 0x52
jb 0x18003c200
mov rbx, qword [rsp + 0x78]
movzx esi, byte [rsp + 0x40]
mov edx, dword [rsp + 0x50]
mov r12d, dword [rsp + 0x50]
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x40], sil
mov dword [rsp + 0x58], edx
mov edi, 0x95
jmp case.0x18003c169.146
mov r9, r15
mov dword [rsp + 0x48], 2
mov r8d, 0x80
lea rdx, [rsp + 0x48]
lea rcx, [0x180093040]
call fcn.180080480
test eax, eax
js 0x18003be27
jmp 0x18003c2ba
xor eax, eax
jmp 0x18003be27
mov dword [rsp + 0x50], 1
jmp case.0x18003c169.146
mov dword [rbp - 0x30], 0x5f0039
jmp case.0x18003c169.146
mov eax, 0x74
mov dword [rbp - 0x2a], 0x730072
mov word [rbp - 0x2c], ax
mov eax, 0x2e
mov word [rbp - 0x26], ax
jmp case.0x18003c169.146
call qword [sym.imp.dbghelp.dll_SymGetOptions]
cmp qword [r15 + 0x10], 0x35
mov edx, eax
mov dword [rsp + 0x58], eax
jb case.0x18003c169.146
mov r13d, reloc.SHELL32.dll_ILRemoveLastID
nop dword [rax]
cmp r13d, 0x11
ja case.0x18003c38e.4
lea rdx, [0x180000000]
mov ecx, r13d
mov eax, dword [rdx + rcx*4 + 0x3ca68]
add rax, rdx
jmp rax
mov r8d, 2
lea rdx, [0x1800a3923]
lea rcx, [rbp - 0x4e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp - 0x4c], 0
jmp case.0x18003c38e.4
mov eax, 0x5372
mov dword [rbp - 0x42], 0x58383231
mov word [rbp - 0x44], ax
mov eax, 0x726f
mov word [rbp - 0x3e], ax
mov eax, 0x6b
mov word [rbp - 8], ax
mov byte [rbp - 0x3c], 0
jmp case.0x18003c38e.4
mov eax, 0x68
mov word [rbp - 6], ax
jmp case.0x18003c38e.4
mov eax, dword [0x1800a3950]
movsd xmm0, qword [str.alid__]
mov dword [rbp - 0x20], 0x49
mov dword [rbp - 0x1e], eax
mov eax, dword [0x1800a3960]
mov dword [rbp - 0x12], eax
movzx eax, word [0x1800a3964]
mov word [rbp - 0xe], ax
movsd qword [rbp - 0x1a], xmm0
jmp case.0x18003c38e.4
movzx eax, word [0x1800a397b]
mov word [rbp - 0x55], ax
movzx eax, byte [0x1800a397d]
mov byte [rbp - 0x53], al
jmp case.0x18003c38e.4
mov word [rbp - 0x4a], 0x73
jmp case.0x18003c38e.4
mov eax, 0x7272
mov byte [rbp - 0x58], 0x45
mov word [rbp - 0x57], ax
jmp case.0x18003c38e.4
mov rax, qword [r15 + 0x10]
mov qword [rbp - 0x60], ILRemoveLastID
mov byte [rbp - 0x78], 0
cmp rax, 0x11
jb 0x18003c9be
add rax, 0xffffffffffffffef
mov ebx, 0x24
cmp rax, rbx
cmovb rbx, rax
cmp qword [r15 + 0x18], 0x10
mov rax, r15
jb 0x18003c48d
mov rax, qword [r15]
lea r14, [rax + 0x11]
cmp rbx, 0xf
ja 0x18003c4b4
mov r8, rbx
mov qword [rbp - 0x68], rbx
mov rdx, r14
lea rcx, [rbp - 0x78]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rbx - 0x78], 0
jmp 0x18003c54d
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x18003c9b8
mov rdi, rbx
or rdi, 0xf
cmp rdi, rax
jbe 0x18003c4d8
mov rdi, rax
jmp 0x18003c4e5
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18003c51e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18003c9c4
mov rcx, rax
call fcn.1800890b8
test rax, rax
je 0x18003c9b1
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x18003c52f
test rcx, rcx
je 0x18003c52a
call fcn.1800890b8
jmp 0x18003c52c
xor eax, eax
mov rsi, rax
mov r8, rbx
mov qword [rbp - 0x68], rbx
mov rdx, r14
mov qword [rbp - 0x60], rdi
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
mov qword [rbp - 0x78], rsi
or dword [rsp + 0x60], 1
lea rdx, [rbp - 0x78]
lea rcx, [0x1800ab918]
call fcn.18002e200
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x18003c59d
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003c598
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003c9b1
call fcn.1800890f4
xor r14d, r14d
mov dword [rsp + 0x70], r14d
call qword [sym.imp.dbghelp.dll_ImagehlpApiVersion]
mov rbx, qword [rsp + 0x78]
mov dword [rsp + 0x48], r14d
jmp case.0x18003c38e.4
lea rax, [rsp + 0x48]
mov r9d, r12d
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x58]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], r14
lea rdx, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueA]
mov r8d, 8
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 8]
call qword [sym.imp.SHLWAPI.dll_StrCmpNW]
mov byte [rsp + 0x50], 1
jmp case.0x18003c38e.4
mov eax, 0x70
mov dword [rbp - 0x48], 0x78456b
mov word [rbp - 0x45], ax
jmp case.0x18003c38e.4
mov word [rbp - 0x4c], 0x2564
mov byte [rbp - 0x4a], 0
jmp case.0x18003c38e.4
mov ebx, 0xb
mov dword [rbp - 0xe], 0x2d
cmp qword [r15 + 0x10], rbx
mov r14, r15
mov qword [rsp + 0x78], 0xffffffff80000001
cmovb rbx, qword [r15 + 0x10]
cmp qword [r15 + 0x18], 0x10
mov qword [rbp - 0x60], ILRemoveLastID
mov byte [rbp - 0x78], 0
jb 0x18003c660
mov r14, qword [r15]
cmp rbx, 0xf
ja 0x18003c683
mov r8, rbx
mov qword [rbp - 0x68], rbx
mov rdx, r14
lea rcx, [rbp - 0x78]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rbx - 0x78], 0
jmp 0x18003c71c
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x18003c9b8
mov rdi, rbx
or rdi, 0xf
cmp rdi, rax
jbe 0x18003c6a7
mov rdi, rax
jmp 0x18003c6b4
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18003c6ed
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18003c9c4
mov rcx, rax
call fcn.1800890b8
test rax, rax
je 0x18003c9b1
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x18003c6fe
test rcx, rcx
je 0x18003c6f9
call fcn.1800890b8
jmp 0x18003c6fb
xor eax, eax
mov rsi, rax
mov r8, rbx
mov qword [rbp - 0x68], rbx
mov rdx, r14
mov qword [rbp - 0x60], rdi
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
mov qword [rbp - 0x78], rsi
or dword [rsp + 0x60], 2
lea rdx, [rbp - 0x78]
lea rcx, [0x1800ab938]
call fcn.18002e200
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x18003c76c
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003c767
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003c9b1
call fcn.1800890f4
mov rbx, qword [rsp + 0x78]
xor r14d, r14d
jmp case.0x18003c38e.4
mov dword [rbp - 4], 0x5f0073
mov dword [rbp], 0x61004c
mov dword [rbp + 4], 0x6e0074
jmp case.0x18003c38e.4
mov rax, qword [r15 + 0x10]
mov qword [rbp - 0x60], ILRemoveLastID
mov byte [rbp - 0x78], 0
cmp rax, 0xb
jb 0x18003c9be
add rax, 0xfffffffffffffff5
mov ebx, 6
cmp rax, rbx
cmovb rbx, rax
cmp qword [r15 + 0x18], 0x10
mov rax, r15
jb 0x18003c7ca
mov rax, qword [r15]
lea r14, [rax + 0xb]
cmp rbx, 0xf
ja 0x18003c7f1
mov r8, rbx
mov qword [rbp - 0x68], rbx
mov rdx, r14
lea rcx, [rbp - 0x78]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rbx - 0x78], 0
jmp 0x18003c88a
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x18003c9b8
mov rdi, rbx
or rdi, 0xf
cmp rdi, rax
jbe 0x18003c815
mov rdi, rax
jmp 0x18003c822
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18003c85b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18003c9c4
mov rcx, rax
call fcn.1800890b8
test rax, rax
je 0x18003c9b1
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x18003c86c
test rcx, rcx
je 0x18003c867
call fcn.1800890b8
jmp 0x18003c869
xor eax, eax
mov rsi, rax
mov r8, rbx
mov qword [rbp - 0x68], rbx
mov rdx, r14
mov qword [rbp - 0x60], rdi
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
mov qword [rbp - 0x78], rsi
or dword [rsp + 0x60], 4
lea rdx, [rbp - 0x78]
lea rcx, [0x1800ab958]
call fcn.18002e200
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x18003c8da
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003c8d5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003c9b1
call fcn.1800890f4
mov rbx, qword [rsp + 0x78]
mov r12d, reloc.SHELL32.dll_ILFindLastID
xor r14d, r14d
jmp case.0x18003c38e.4
mov dword [rbp + 8], 0x5a005f
mov dword [rbp + 0xc], 0x5a
jmp case.0x18003c38e.4
mov r8d, 4
mov byte [rbp - 0x52], 0
lea rdx, [0x1800a39a0]
lea rcx, [rbp - 0x52]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp - 0x4e], 0
dec r13d
lea eax, [r13 + 0xf5]
cmp eax, 0xf4
ja 0x18003c370
mov edi, dword [rsp + 0x68]
movzx esi, byte [rsp + 0x40]
jmp 0x18003c991
mov word [rbp - 0x36], r9w
mov dword [rbp - 0x34], 0x300035
jmp case.0x18003c169.146
mov word [rbp - 0x38], r11w
jmp case.0x18003c169.146
mov sil, 1
mov dword [rbp - 0x24], 0x63
mov byte [rsp + 0x40], sil
jmp case.0x18003c169.146
test edx, edx
movzx eax, sil
mov ecx, r14d
cmovne ecx, eax
mov byte [rsp + 0x40], cl
movzx esi, cl
test cl, cl
je 0x18003c97e
mov ecx, edx
call qword [sym.imp.dbghelp.dll_SymSetOptions]
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x10]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov byte [rsp + 0x50], 0
mov edx, dword [rsp + 0x58]
mov eax, dword [rbp - 0x80]
lea r8, [0x180000000]
inc edi
xor r14d, r14d
lea r9d, [r14 + 0x78]
lea r11d, [r14 + 0x63]
jmp 0x18003c140
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180047360
int3
call fcn.1800473a0
int3
call fcn.180047220
int3