Function at 0x1800654a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push r14
push r15
lea rbp, [rsp - 0x1918]
mov eax, 0x1a18
call fcn.18006ece0
sub rsp, rax
imul r15d, r9d, 0x861
mov ebx, r9d
mov rax, r8
mov r14, rcx
mov dword [rsp + 0x70], r15d
cmp r9d, r15d
ja 0x180065fee
mov qword [rsp + 0x1a10], rsi
mov rsi, qword [rbp - 0x50]
mov qword [rsp + 0x1a08], rdi
mov qword [rsp + 0x1a00], r12
mov r12, qword [rsp + 0x40]
mov qword [rsp + 0x19f8], r13
imul r13d, ebx, 0xa5
xor r8d, r8d
lea ecx, [r8 + 1]
mov dword [rbp - 0x68], r13d
lea edi, [rcx + 1]
lea r10d, [r8 + 3]
nop word [rax + rax]
cmp ebx, 0x3c10
ja 0x18006575e
je 0x18006566e
cmp ebx, 0x141a
ja 0x1800655f6
je 0x1800655bf
cmp ebx, 0x1f
je 0x18006558f
cmp ebx, 0x35
je 0x18006557f
cmp ebx, 0xf4
jne 0x180065fbd
mov qword [rsp + 0x48], r8
mov rsi, r8
mov qword [rbp - 0x80], r8
mov r12, r8
mov qword [rsp + 0x58], r8
jmp 0x180065fbd
movzx eax, word [r14]
mov word [rbp + 0x748], ax
jmp 0x180065fb6
mov rax, qword [r14]
lea r9, [rsp + 0x60]
xor edx, edx
mov word [rsp + 0x60], cx
mov qword [rsp + 0x20], r8
lea rcx, [rbp - 0x48]
mov qword [rbp - 0x48], rax
lea r8d, [rdx + 0x28]
call fcn.180068730
cdqe
mov qword [rbp - 0x60], rax
jmp 0x180065fa3
mov rax, qword [r14]
lea r9, [rbp + 0x1958]
xor edx, edx
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x78]
mov word [rbp + 0x1958], di
mov qword [rsp + 0x78], rax
lea r8d, [rdx + 0x28]
call fcn.180068730
cdqe
mov qword [rsp + 0x78], rax
jmp 0x180065fa3
cmp ebx, 0x225e
je 0x180065648
cmp ebx, 0x2815
jne 0x180065fbd
cmp dword [rax], 0
mov rax, qword [rbp - 0x60]
je 0x18006563f
mov dword [rbp - 0x78], eax
xor r9d, r9d
lea rax, [rbp - 0x78]
xor edx, edx
mov qword [rsp + 0x28], rax
mov ecx, 0xb4
mov qword [rsp + 0x20], r8
xor r8d, r8d
call fcn.180052ca0
mov qword [rbp - 0x58], rax
jmp 0x180065fa3
mov qword [rbp - 0x58], rax
jmp 0x180065fb6
movzx eax, word [rax]
mov word [rbp + 0x74a], ax
mov eax, dword [rdx]
mov dword [rbp + 0x87c], eax
mov qword [rbp + 0x852], r8
mov word [rbp + 0x85a], r8w
jmp 0x180065fb6
mov rdi, qword [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x180065732
cmp qword [0x1800c5710], 1
mov rcx, rdi
jne 0x180065721
mov rax, qword [rsp + 0x78]
cmp rax, 3
je 0x1800656ff
cmp rax, 6
je 0x1800656df
cmp rax, 9
je 0x1800656bf
mov edx, eax
call qword [sym.imp.USER32.dll_ShowWindowAsync]
mov eax, 1
mov ebx, 0x3c10
jmp 0x180065734
xor r9d, r9d
mov edx, 0x112
mov r8d, 0xf120
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov ebx, 0x3c10
jmp 0x180065734
xor r9d, r9d
mov edx, 0x112
mov r8d, 0xf020
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov ebx, 0x3c10
jmp 0x180065734
mov edx, 3
mov qword [0x1800c5760], 0xc
call qword [sym.imp.USER32.dll_ShowWindowAsync]
mov ebx, 0x3c10
mov eax, 1
jmp 0x180065734
mov edx, dword [rsp + 0x78]
call qword [sym.imp.USER32.dll_ShowWindowAsync]
mov eax, 1
jmp 0x180065734
xor eax, eax
mov dword [rbp + 0x1958], eax
mov rax, qword [r14]
lea rdx, [rbp + 0x1958]
mov r8d, 0x92
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.18004ff10
jmp 0x180065fa3
cmp ebx, 0x13b7c
ja 0x180065883
je 0x180065850
cmp ebx, 0x4487
je 0x180065839
cmp ebx, 0x66b0
je 0x180065826
cmp ebx, 0x9e38
jne 0x180065fbd
xor edx, edx
lea rcx, [rbp + 0x10f0]
mov r8d, 0x800
call fcn.180070440
xor edx, edx
lea rcx, [rbp + 0x8f0]
mov r8d, 0x800
call fcn.180070440
xor edx, edx
mov qword [rsp + 0x20], 0
mov eax, 1
lea r9, [rbp + 0x1958]
mov word [rbp + 0x1958], ax
lea rcx, [rbp - 0x80]
mov rax, qword [r14]
lea r8d, [rdx + 0x28]
mov qword [rbp - 0x80], rax
call fcn.180068730
cdqe
lea r9, [rsp + 0x40]
mov qword [rbp - 0x80], rax
lea rdx, [rbp + 0x1958]
mov rax, qword [r14]
lea rcx, [rbp + 0x10f0]
mov r8d, 0x10c
mov qword [rsp + 0x40], rax
mov word [rbp + 0x1958], di
call fcn.180059270
jmp 0x180065fa3
movzx eax, word [rbp + 0x85a]
mov word [0x1800d5918], ax
jmp 0x180065fb6
mov ecx, 0xffffffee
lea rdx, [rbp + 0x300]
call qword [0x1800d5910]
jmp 0x180065fa3
mov rax, qword [r14]
lea r9, [rsp + 0x40]
mov r8d, 0x10c
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x1958]
mov word [rbp + 0x1958], r10w
lea rcx, [rbp + 0x8f0]
call fcn.180059270
jmp 0x180065fa3
cmp ebx, 0x1d8c0
je 0x1800658a2
cmp ebx, 0x27604
jne 0x180065fbd
mov dword [rbp + 0x1958], esi
jmp 0x18006573a
mov rax, qword [rbp - 0x80]
lea rcx, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x40], rax
lea r8d, [rdx + 0x12]
call fcn.180014600
lea rcx, [rsp + 0x58]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0x10f0]
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180065f98
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x70]
xor r8d, r8d
mov qword [rsp + 0x20], 0
lea rdx, [rbp + 0x8f0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rdi, eax
test eax, eax
jne 0x180065f98
mov eax, dword [rbp - 0x70]
dec eax
cmp eax, 6
ja case.0x18006593c.6
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x65ffc]
add rcx, rdx
jmp rcx
mov ebx, 0x16
cmp ebx, 0x16
je 0x18006596b
cmp ebx, 0xcb8
je 0x180065961
cmp ebx, 0x195a
je case.0x18006593c.6
jmp 0x1800659ea
mov rcx, r12
call fcn.180073cf4
jmp 0x1800659ea
mov rcx, qword [rsp + 0x48]
call fcn.180073cfc
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp + 0x8f0]
mov r12, rax
xor r9d, r9d
lea rax, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rdi, eax
test eax, eax
jne 0x1800659ea
mov ecx, dword [rsp + 0x48]
lea r9, [rsp + 0x50]
mov eax, 4
mov dword [rsp + 0x40], ecx
mov word [rbp + 0x1958], ax
lea rdx, [rsp + 0x40]
mov rax, qword [r14]
mov r8, r12
mov qword [rsp + 0x50], rax
mov ecx, 0x67
lea rax, [rbp + 0x1958]
mov qword [rsp + 0x20], rax
call fcn.180014130
mov esi, 1
add ebx, 0xca2
cmp ebx, 0x25e6
jbe 0x180065943
mov ebx, 0xe4
mov eax, ebx
sub eax, 0xe3
je 0x180065a77
cmp eax, 1
jne 0x180065a47
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp + 0x8f0]
mov eax, 4
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rdi, eax
dec ebx
cmp ebx, 0xe2
ja 0x180065a01
mov ebx, 0xb1
cmp ebx, 0xb1
je 0x180065abc
cmp ebx, 0x157
jne 0x180065b64
mov rcx, r12
call fcn.180073cf4
jmp case.0x18006593c.6
test rdi, rdi
jne case.0x18006593c.6
mov eax, dword [rbp - 0x6c]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
lea r8, [rsp + 0x50]
mov eax, 4
lea edx, [rdi + 0x27]
mov word [rbp + 0x1958], ax
lea rcx, [rbp + 0x1958]
mov rax, qword [r14]
mov qword [rsp + 0x50], rax
call fcn.180030a70
lea esi, [rdi + 1]
jmp case.0x18006593c.6
mov rcx, qword [rsp + 0x48]
call fcn.180073cfc
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp + 0x8f0]
mov r12, rax
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180065b64
mov edx, 0xdc
lea rcx, [rsp + 0x40]
call fcn.180016e80
mov r12, qword [rsp + 0x40]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r12 + rax], 0
jne 0x180065b14
mov qword [rbp - 0x40], rax
lea r9, [rbp - 0x50]
mov eax, 4
mov qword [rsp + 0x30], 0
mov word [rsp + 0x68], ax
lea r8, [rsp + 0x68]
mov rax, qword [r14]
mov edx, 0x12f
mov qword [rbp - 0x50], rax
xor ecx, ecx
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call fcn.18001fab0
mov esi, 1
add ebx, 0xa6
cmp ebx, 0x1fd
jb 0x180065a56
mov r13d, 0x86
nop dword [rax]
mov eax, r13d
sub eax, 0x86
je 0x180065dfb
sub eax, 1
je 0x180065bae
cmp eax, 1
jne 0x180065ea7
mov rcx, r12
call fcn.180073cf4
mov r15d, dword [rsp + 0x70]
jmp case.0x18006593c.6
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x8f0]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180065ea7
mov r15d, 0xee
nop dword [rax]
nop word [rax + rax]
mov eax, r15d
sub eax, 0xee
je 0x180065cba
cmp eax, 0xa
jne 0x180065de5
lea rcx, [rbp + 0x1f0]
mov edx, 2
lea rax, [rbp - 0x30]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x180065c20
mov eax, dword [rax]
lea r8d, [rdx + 0x1d]
mov dword [rcx], eax
lea r9, [rsp + 0x40]
mov eax, 4
mov byte [rbp + 0x1958], dl
mov word [rsp + 0x40], ax
lea rdx, [rbp + 0x1958]
mov rax, qword [r14]
lea rcx, [rbp + 0x1f0]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.180012d20
jmp 0x180065de5
mov dword [rsp + 0x30], 0xb9
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
xor ecx, ecx
call fcn.1800544b0
mov r14, rax
lea rdx, [rbp - 0x30]
mov r8d, 0xff
mov dword [rbp + 0x1958], r14d
lea rcx, [rbp + 0x1958]
call fcn.180020da0
mov eax, 1
mov rdi, r12
mov esi, eax
cmp rax, r14
jg 0x180065ddb
nop dword [rax]
nop word [rax + rax]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], 0
jne 0x180065d27
lea rdx, [rbp + 0xe0]
mov ecx, 2
lea rax, [rbp - 0x30]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x180065d40
mov ecx, dword [rax]
lea r9, [rsp + 0x40]
mov dword [rdx], ecx
lea rax, [rsp + 0x50]
mov edx, 0xeb
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov qword [rsp + 0x50], rbx
lea r8, [rbp + 0xe0]
mov qword [rsp + 0x40], rsi
call fcn.180032ba0
inc rdi
inc rsi
add rdi, rbx
cmp rsi, r14
jle 0x180065d20
mov eax, 1
mov r14, qword [rbp + 0x1940]
mov rsi, rax
add r15d, 0xa
cmp r15d, 0x102
jb 0x180065bf0
jmp 0x180065ea7
mov rcx, qword [rsp + 0x48]
call fcn.180073cfc
mov r12, rax
lea r9, [rsp + 0x50]
mov eax, 4
lea r8, [rbp + 0x1958]
mov word [rbp + 0x1958], ax
lea rcx, [rbp + 0xe0]
mov rax, qword [r14]
mov edx, 0xc2
mov qword [rsp + 0x50], rax
call fcn.180010500
lea rcx, [rbp - 0x30]
mov edx, 2
lea rax, [rbp + 0xe0]
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x180065e50
mov eax, dword [rax]
mov dword [rcx], eax
inc r13d
cmp r13d, 0x89
jb 0x180065b80
mov r15d, dword [rsp + 0x70]
mov ebx, 0xa9
cmp ebx, 0xa9
je 0x180065eef
cmp ebx, 0x9e7
je 0x180065ee2
cmp ebx, 0x1325
je case.0x18006593c.6
jmp 0x180065f7d
mov rcx, r12
call fcn.180073cf4
jmp 0x180065f7d
mov rcx, qword [rsp + 0x48]
call fcn.180073cfc
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp + 0x8f0]
mov r12, rax
xor r9d, r9d
lea rax, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180065f7d
mov rax, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
dec rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x50], rax
lea r8, [rbp + 0x1958]
mov eax, 4
mov edx, 0x12f
mov word [rbp + 0x1958], ax
xor ecx, ecx
mov rax, qword [r14]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call fcn.18001fab0
mov esi, 1
add ebx, 0x93e
cmp ebx, 0x1bba
jbe 0x180065ec1
mov r13d, dword [rbp - 0x68]
mov ebx, 0x1d8c0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp + 0x1948]
mov ecx, 1
xor r8d, r8d
lea r10d, [rcx + 2]
mov rax, qword [rbp + 0x1950]
add ebx, r13d
mov edi, 2
cmp ebx, r15d
jbe 0x180065530
mov r13, qword [rsp + 0x19f8]
mov r12, qword [rsp + 0x1a00]
mov rdi, qword [rsp + 0x1a08]
mov rsi, qword [rsp + 0x1a10]
add rsp, 0x1a18
pop r15
pop r14
pop rbx
pop rbp
ret