Function at 0x180075590
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [0x1800b88d0]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea ebx, [rdx - 5]
mov ebp, edx
mov dword [rsp + 0x38], ebx
mov r15, rcx
cmp edx, ebx
jbe 0x18007582d
movzx r14d, byte [rsp + 0x30]
xor edi, edi
mov rsi, qword [rsp + 0x38]
mov r13d, dword [rsp + 0x38]
mov r12d, dword [rsp + 0x38]
nop dword [rax]
mov eax, ebp
sub eax, 0x8e
je 0x180075875
sub eax, 2
je 0x180075863
sub eax, 1
je 0x1800757f1
sub eax, 1
je 0x1800757bd
cmp eax, 1
jne 0x180075823
xor r8d, r8d
mov rdx, r15
mov ecx, 0x121
call fcn.1800747e0
test al, al
jne 0x180075792
mov ebx, 0x121
nop
cmp ebx, 0x2541
ja 0x180075703
je 0x1800756e4
cmp ebx, 0x121
je 0x1800756c1
cmp ebx, 0xa29
je 0x1800756a2
cmp ebx, 0x1331
je 0x18007568d
cmp ebx, 0x1c39
jne 0x18007577c
mov eax, 0x766f
mov dword [rsp + 0x4d], 0x62616b6f
mov word [rsp + 0x51], ax
jmp 0x18007577c
mov dword [rsp + 0x45], 0x6c666d75
mov dword [rsp + 0x49], 0x6f687865
jmp 0x18007577c
mov eax, dword [0x1800b1855]
mov dword [rsp + 0x40], eax
movzx eax, byte [0x1800b1859]
mov byte [rsp + 0x44], al
mov byte [rsp + 0x45], dil
jmp 0x18007577c
movabs rax, 0x20726f72726528
mov qword [rsp + 0x58], rax
movabs rax, 0x29307830203d3d
mov qword [rsp + 0x5f], rax
jmp 0x18007577c
mov r8d, 1
mov byte [rsp + 0x53], dil
lea rdx, [0x1800b182b]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18007577c
cmp ebx, 0x2e49
je 0x180075772
cmp ebx, 0x3751
je 0x18007574e
cmp ebx, 0x4059
jne 0x18007577c
test r13d, r13d
movzx eax, r14b
cmove edi, eax
test dil, dil
je 0x180075747
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], r12d
lea r8, [rsp + 0x40]
mov rcx, rsi
lea rdx, [rsp + 0x58]
call qword [sym.imp.SHLWAPI.dll_SHRegSetPathA]
xor al, al
jmp 0x180075832
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], edi
lea r8, [rsp + 0x40]
mov rcx, rsi
lea rdx, [rsp + 0x58]
mov r12d, edi
call qword [sym.imp.SHLWAPI.dll_SHRegGetPathA]
mov r13d, eax
jmp 0x18007577c
mov r14b, 1
mov rsi, 0xffffffff80000001
add ebx, 0x908
cmp ebx, 0x4840
jbe 0x180075640
mov ebx, dword [rsp + 0x38]
mov rax, qword [r15 + 0x28]
mov r9d, 0x5b
mov rdx, qword [r15 + 0x20]
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.180098960
mov qword [0x1800b89c0], rax
jmp 0x180075823
cmp qword [0x1800b89c0], rdi
je 0x180075747
mov rax, qword [r15 + 0x30]
mov r9d, 0x5b
mov rdx, qword [r15 + 0x20]
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.180098960
mov qword [0x1800b89c8], rax
jmp 0x18007581a
mov rax, qword [r15 + 0x38]
mov r9d, 0x5b
mov rdx, qword [r15 + 0x20]
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.180098960
mov qword [0x1800b89d0], rax
test rax, rax
je 0x180075747
dec ebp
cmp ebp, ebx
ja 0x1800755f0
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1800a5da0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800b89d8], rax
mov al, 1
jmp 0x180075832
mov rcx, r15
call qword [0x1800b8af0]
jmp 0x180075832