Function at 0x180020720
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x1a0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x18017d2b8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, qword [rbp + 0xf0]
lea r14d, [r9 + 0x8b3]
mov qword [rsp + 0x60], r8
mov ebx, r9d
mov r12, rdx
mov r15, rcx
cmp r9d, r14d
jae 0x180020c1d
mov r13, qword [rbp + 0xf8]
xor ecx, ecx
movsd xmm12, qword [0x18015de50]
movabs rdx, 0x54004f004e0045
movsd xmm13, qword [0x18015afd0]
xorps xmm14, xmm14
movsd xmm8, qword [0x18015c170]
movsd xmm6, qword [0x180159948]
movsd xmm9, qword [0x18015a168]
movsd xmm7, qword [0x180159e68]
movsd xmm15, qword [0x18015ae20]
movsd xmm10, qword [rsp + 0x40]
movsd xmm11, qword [rsp + 0x40]
mov esi, dword [rsp + 0x58]
nop
cmp ebx, 0x1d6
ja 0x180020be7
je 0x180020bd0
cmp ebx, reloc.SHLWAPI.dll_SHRegGetIntW
ja 0x180020a71
je 0x180020a35
mov eax, ebx
sub eax, 0x4d
je 0x180020a28
sub eax, 0x48
je 0x1800209f4
sub eax, 0x3b
je 0x1800208d5
cmp eax, 0x43
jne 0x180020d6e
cmp byte [rdi], 0x2d
jne 0x180020871
movaps xmm2, xmm12
jmp 0x180020875
movaps xmm2, xmm13
mov eax, dword [r13]
cdq
xor eax, edx
sub eax, edx
movd xmm1, eax
mov eax, dword [r15]
cvtdq2pd xmm1, xmm1
cdq
xor eax, edx
sub eax, edx
movabs rdx, 0x54004f004e0045
mulsd xmm1, xmm8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
movsd xmm0, qword [r12]
andps xmm0, xmmword [0x1801712f0]
mulsd xmm1, xmm8
addsd xmm1, xmm0
mulsd xmm1, xmm2
divsd xmm1, qword [0x18015ce18]
movsd qword [r8], xmm1
jmp 0x180020d6e
movsd xmm0, qword [0x18015cdc0]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
movsd qword [rsp + 0x50], xmm0
lea rax, [rsp + 0x68]
movsd xmm0, qword [0x18015cf80]
lea rdx, [rsp + 0x50]
mov r8d, 0xec
movsd qword [rsp + 0x68], xmm0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
movsd qword [rsp + 0x48], xmm10
movsd qword [rsp + 0x40], xmm11
call fcn.1800e4d90
movsd xmm0, qword [0x18015ae40]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x50]
movsd qword [rsp + 0x40], xmm0
lea r8, [0x18014da18]
movsd xmm0, qword [rsp + 0x70]
lea rdx, str.eraC2ixy
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
lea rcx, [rsp + 0x48]
movsd qword [rsp + 0x50], xmm0
movsd qword [rsp + 0x48], xmm6
mov qword [rsp + 0x20], rdi
call fcn.1800fe9c0
movsd xmm0, qword [0x1801599b8]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x50]
movsd qword [rsp + 0x40], xmm0
lea r8, [0x18014da1c]
movsd xmm0, qword [rsp + 0x78]
lea rdx, str.eraC2ixy
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
lea rcx, [rsp + 0x48]
movsd qword [rsp + 0x50], xmm0
movsd qword [rsp + 0x48], xmm6
mov qword [rsp + 0x20], rdi
call fcn.1800fe9c0
movsd xmm0, qword [0x18015d618]
lea r8, [0x180113954]
movsd qword [rsp + 0x40], xmm0
movsd xmm0, qword [rbp - 0x80]
jmp 0x180020c99
mov r8d, 4
lea rdx, [0x180158e96]
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov dword [rbp - 0x38], 0x45004c
mov r8, qword [rsp + 0x60]
xor ecx, ecx
movabs rdx, 0x54004f004e0045
jmp 0x180020d6e
movaps xmm11, xmm9
movaps xmm10, xmm7
jmp 0x180020d6e
mov word [rbp - 0x34], cx
lea rdx, [0x180158f82]
lea rcx, [rbp - 0x40]
mov r8d, 5
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8, qword [rsp + 0x60]
xor ecx, ecx
mov word [rbp - 0x26], cx
movabs rdx, 0x54004f004e0045
mov dword [rbp - 0x2a], 0x4c0049
jmp 0x180020d6e
mov eax, ebx
sub eax, 0x153
je 0x180020abf
sub eax, 0x43
je 0x180020aaa
cmp eax, 5
jne 0x180020d6e
mov qword [rbp - 0x26], rdx
lea r8d, [rax - 2]
mov word [rbp - 0x1e], cx
lea rdx, [0x180158f72]
lea rcx, [rbp - 0x1e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x180020a12
cmp dword [r13], 0x17
jbe 0x180020d6e
mov eax, 1
jmp 0x180020c21
movsd xmm0, qword [0x18015d158]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x50]
movsd qword [rsp + 0x40], xmm0
lea r8, [0x18014da20]
movsd xmm0, qword [rbp - 0x78]
lea rdx, str.eraC2ixy
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
lea rcx, [rsp + 0x48]
movsd qword [rsp + 0x50], xmm0
movsd qword [rsp + 0x48], xmm6
mov qword [rsp + 0x20], rdi
call fcn.1800fe9c0
movsd xmm0, qword [0x18015af50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x50]
movsd qword [rsp + 0x40], xmm0
lea r8, [0x18014da28]
movsd xmm0, qword [rbp - 0x70]
lea rdx, str.eraC2ixy
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
lea rcx, [rsp + 0x48]
movsd qword [rsp + 0x50], xmm0
movsd qword [rsp + 0x48], xmm6
mov qword [rsp + 0x20], rdi
call fcn.1800fe9c0
movsd xmm0, qword [0x18015d4a0]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x50]
movsd qword [rsp + 0x40], xmm0
lea r8, [0x18011394c]
movsd xmm0, qword [rbp - 0x68]
lea rdx, str.eraC2ixy
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
lea rcx, [rsp + 0x48]
movsd qword [rsp + 0x50], xmm0
movsd qword [rsp + 0x48], xmm6
mov qword [rsp + 0x20], rdi
call fcn.1800fe9c0
movsd xmm0, qword [rbp - 0x60]
lea r8, [0x180113950]
movsd qword [rsp + 0x40], xmm9
jmp 0x180020c99
movsd xmm0, qword [rbp - 0x58]
lea r8, [0x18014d9fc]
movsd qword [rsp + 0x40], xmm7
jmp 0x180020c99
cmp ebx, 0x2a1
ja 0x180020d11
je 0x180020d0b
mov eax, ebx
sub eax, 0x219
je 0x180020ce3
sub eax, 5
je 0x180020cd7
sub eax, 0x3b
je 0x180020c86
cmp eax, 0x43
jne 0x180020d6e
mov eax, dword [rsp + 0x58]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180110960
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movsd xmm0, qword [rbp - 0x50]
lea r8, [0x18014da00]
movsd qword [rsp + 0x40], xmm15
lea rax, [rsp + 0x40]
movsd qword [rsp + 0x50], xmm0
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
lea rdx, str.eraC2ixy
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rdi
movsd qword [rsp + 0x48], xmm6
call fcn.1800fe9c0
jmp 0x180020a12
mov dword [rbp - 0x18], 0x44004e
jmp 0x180020d6e
cmp dword [r15], 0x3b
ja 0x180020d8c
movsd xmm0, qword [r12]
comisd xmm14, xmm0
ja 0x180020d82
comisd xmm0, xmm8
jae 0x180020d82
mov dword [rsp + 0x58], ecx
jmp 0x180020d6e
mov word [rbp - 0x14], cx
jmp 0x180020d6e
cmp ebx, 0x324
je 0x180020d6c
cmp ebx, 0x3a7
je 0x180020d2f
cmp ebx, 0x42a
je 0x180020c1d
jmp 0x180020d6e
mov r9d, 1
lea rcx, [rbp - 0x40]
mov r8d, esi
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_SHRegGetBoolUSValueW]
cmp qword [0x18017d3b8], 0
je 0x180020d62
cmp qword [0x18017d3b0], 0
je 0x180020d62
mov byte [rsp + 0x58], 1
jmp 0x180020a12
mov byte [rsp + 0x58], 0
jmp 0x180020a12
mov esi, ecx
add ebx, 0x83
cmp ebx, r14d
jb 0x180020820
jmp 0x180020c1d
mov eax, 3
jmp 0x180020c21
mov eax, 2
jmp 0x180020c21