Function at 0x180076510
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x180
mov qword [rsp + 0x138], 0xfffffffffffffffe
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r13, r8
mov rbx, rdx
mov qword [r11 - 0x78], rdx
xor esi, esi
mov ebp, esi
mov dword [rsp + 0x50], esi
lea r12d, [rsi + 7]
cmp byte [rcx + 8], r12b
je 0x1800765c9
mov rax, qword [rdx + 0x30]
mov qword [rsp + 0x38], rax
mov rcx, qword [rdx]
mov qword [rsp + 0x30], rcx
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm1
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.18002d6a0
mov rcx, qword [rbx + 0x30]
call fcn.18009a864
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x38], rsi
mov rcx, qword [rbx]
call fcn.18009a864
xor al, al
jmp 0x180076e49
lea rdx, str.__config
call fcn.1800674f4
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.180066064
nop
cmp byte [rsp + 0xa0], r12b
jne 0x180076dd1
lea rdx, str.EffectiveState
lea rcx, [rsp + 0x98]
call fcn.180067578
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.180066064
nop
lea rdx, str.EffectiveDate
lea rcx, [rsp + 0x98]
call fcn.180067578
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.180066064
nop
lea rdx, str.EffectiveTime
lea rcx, [rsp + 0x98]
call fcn.180067578
mov rdx, rax
lea rcx, [rsp + 0x110]
call fcn.180066064
nop
cmp byte [rsp + 0xc8], r12b
jne 0x1800768f0
mov dword [rsp + 0x58], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
lea r8, str.online
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
cmp eax, esi
jne 0x1800766bb
cmp dword [rsp + 0x54], 4
jne 0x1800766bb
mov eax, dword [rsp + 0x50]
jmp 0x1800766bd
mov eax, esi
cmp eax, esi
je 0x1800767dc
mov qword [rsp + 0x168], socket
mov qword [rsp + 0x160], rsi
mov byte [rsp + 0x150], sil
mov r8d, 6
lea rdx, str.online
lea rcx, [rsp + 0x148]
call fcn.18000f0f0
nop
xor r8d, r8d
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0xc0]
call fcn.180001870
cmp eax, 1
setne dil
cmp qword [rsp + 0x168], 0x10
jb 0x180076733
mov rcx, qword [rsp + 0x150]
call fcn.18009a864
cmp dil, sil
je 0x1800768f0
lea rcx, [rsp + 0x110]
call fcn.180066210
nop
lea rcx, [rsp + 0x70]
call fcn.180066210
nop
lea rcx, [rsp + 0xc0]
call fcn.180066210
nop
lea rcx, [rsp + 0x98]
call fcn.180066210
nop
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x48], rax
mov rcx, qword [rbx]
mov qword [rsp + 0x40], rcx
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm1
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.18002d6a0
mov rcx, qword [rbx + 0x30]
call fcn.18009a864
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x38], rsi
mov rcx, qword [rbx]
call fcn.18009a864
xor al, al
jmp 0x180076e49
mov qword [rsp + 0x168], socket
mov qword [rsp + 0x160], rsi
mov byte [rsp + 0x150], sil
mov r8, r12
lea rdx, str.offline
lea rcx, [rsp + 0x148]
call fcn.18000f0f0
nop
xor r8d, r8d
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0xc0]
call fcn.180001870
cmp eax, 1
setne dil
cmp qword [rsp + 0x168], 0x10
jb 0x180076847
mov rcx, qword [rsp + 0x150]
call fcn.18009a864
cmp dil, sil
je 0x1800768f0
lea rcx, [rsp + 0x110]
call fcn.180066210
nop
lea rcx, [rsp + 0x70]
call fcn.180066210
nop
lea rcx, [rsp + 0xc0]
call fcn.180066210
nop
lea rcx, [rsp + 0x98]
call fcn.180066210
nop
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x48], rax
mov rcx, qword [rbx]
mov qword [rsp + 0x40], rcx
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm1
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.18002d6a0
mov rcx, qword [rbx + 0x30]
call fcn.18009a864
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x38], rsi
mov rcx, qword [rbx]
call fcn.18009a864
xor al, al
jmp 0x180076e49
cmp byte [rsp + 0x78], r12b
jne 0x180076c6e
mov byte [rsp + 0x148], sil
xor eax, eax
mov qword [rsp + 0x149], rax
mov qword [rsp + 0x151], rax
mov qword [rsp + 0x159], rax
mov dword [rsp + 0x161], eax
mov word [rsp + 0x165], ax
mov byte [rsp + 0x167], al
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [rsp + 0x36]
movzx eax, word [rsp + 0x32]
movzx r9d, word [rsp + 0x30]
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], eax
lea r8, str._04d__02d__02d
mov edx, 0x20
lea rcx, [rsp + 0x148]
call qword [sym.imp.SHLWAPI.dll_wnsprintfA]
lea rdx, str.begin
lea rcx, [rsp + 0x70]
call fcn.180067578
or r15, 0xffffffffffffffff
cmp byte [rax + 8], 4
jne 0x180076a21
lea rdx, str.begin
lea rcx, [rsp + 0x70]
call fcn.180067578
mov rcx, rax
lea rdx, [rsp + 0xe8]
call fcn.1800663b0
mov r11, rax
lea ebp, [r15 + 2]
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x148]
repne scasb al, byte [rdi]
not rcx
lea r12, [rcx - 1]
mov rdi, qword [r11 + 0x18]
cmp rdi, rdi
cmovb rdi, rdi
cmp qword [r11 + 0x20], 0x10
jb 0x1800769e5
mov rcx, qword [r11 + 8]
jmp 0x1800769e9
lea rcx, [r11 + 8]
mov r8, r12
cmp rdi, r12
cmovb r8, rdi
lea rdx, [rsp + 0x148]
call fcn.1800a4090
movsxd rcx, eax
mov eax, esi
cmp rdi, r12
setne al
cmp rdi, r12
cmovb eax, r15d
cmp rcx, rsi
cmovne eax, ecx
cmp eax, esi
jle 0x180076a21
mov dil, bpl
jmp 0x180076a24
mov dil, sil
test bpl, 1
je 0x180076a45
and ebp, 0xfffffffe
cmp qword [rsp + 0x108], 0x10
jb 0x180076a45
mov rcx, qword [rsp + 0xf0]
call fcn.18009a864
cmp dil, sil
je 0x180076af3
mov byte [r13], 1
lea rcx, [rsp + 0x110]
call fcn.180066210
nop
lea rcx, [rsp + 0x70]
call fcn.180066210
nop
lea rcx, [rsp + 0xc0]
call fcn.180066210
nop
lea rcx, [rsp + 0x98]
call fcn.180066210
nop
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x48], rax
mov rcx, qword [rbx]
mov qword [rsp + 0x40], rcx
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm1
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.18002d6a0
mov rcx, qword [rbx + 0x30]
call fcn.18009a864
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x38], rsi
mov rcx, qword [rbx]
call fcn.18009a864
xor al, al
jmp 0x180076e49
lea rdx, [0x1800d54c8]
lea rcx, [rsp + 0x70]
call fcn.180067578
cmp byte [rax + 8], 4
jne 0x180076b9f
lea rdx, [0x1800d54c8]
lea rcx, [rsp + 0x70]
call fcn.180067578
mov rcx, rax
lea rdx, [rsp + 0xe8]
call fcn.1800663b0
mov r11, rax
or ebp, 2
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x148]
repne scasb al, byte [rdi]
not rcx
lea r12, [rcx - 1]
mov rdi, qword [r11 + 0x18]
cmp rdi, rdi
cmovb rdi, rdi
cmp qword [r11 + 0x20], 0x10
jb 0x180076b63
mov rcx, qword [r11 + 8]
jmp 0x180076b67
lea rcx, [r11 + 8]
mov r8, r12
cmp rdi, r12
cmovb r8, rdi
lea rdx, [rsp + 0x148]
call fcn.1800a4090
movsxd rcx, eax
mov eax, esi
cmp rdi, r12
setne al
cmp rdi, r12
cmovb eax, r15d
cmp rcx, rsi
cmovne eax, ecx
cmp eax, esi
jge 0x180076b9f
mov dil, 1
jmp 0x180076ba2
mov dil, sil
test bpl, 2
je 0x180076bc0
cmp qword [rsp + 0x108], 0x10
jb 0x180076bc0
mov rcx, qword [rsp + 0xf0]
call fcn.18009a864
cmp dil, sil
je 0x180076c6e
mov byte [r13], 1
lea rcx, [rsp + 0x110]
call fcn.180066210
nop
lea rcx, [rsp + 0x70]
call fcn.180066210
nop
lea rcx, [rsp + 0xc0]
call fcn.180066210
nop
lea rcx, [rsp + 0x98]
call fcn.180066210
nop
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x48], rax
mov rcx, qword [rbx]
mov qword [rsp + 0x40], rcx
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm1
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.18002d6a0
mov rcx, qword [rbx + 0x30]
call fcn.18009a864
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x38], rsi
mov rcx, qword [rbx]
call fcn.18009a864
xor al, al
jmp 0x180076e49
cmp byte [rsp + 0x118], 4
jne 0x180076daa
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x110]
call fcn.1800663b0
nop
mov r8, rax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.18002c7f0
nop
cmp qword [rsp + 0x108], 0x10
jb 0x180076cbb
mov rcx, qword [rsp + 0xf0]
call fcn.18009a864
mov r12, qword [rbx + 0x30]
mov rdi, qword [rsp + 0x40]
cmp rdi, rsi
je 0x180076cce
cmp rdi, qword [rbx]
je 0x180076cd3
call fcn.18009a80c
mov rbp, qword [rsp + 0x48]
cmp rbp, r12
je 0x180076daa
cmp rdi, rsi
jne 0x180076cf0
call fcn.18009a80c
mov rdx, rsi
jmp 0x180076cf3
mov rdx, qword [rdi]
cmp rbp, qword [rdx + 0x30]
jne 0x180076cfe
call fcn.18009a80c
lea rcx, [rbp + 0x40]
call fcn.1800754bc
cmp eax, esi
jne 0x180076daa
mov byte [r13], 1
lea rcx, [rsp + 0x110]
call fcn.180066210
nop
lea rcx, [rsp + 0x70]
call fcn.180066210
nop
lea rcx, [rsp + 0xc0]
call fcn.180066210
nop
lea rcx, [rsp + 0x98]
call fcn.180066210
nop
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x48], rax
mov rcx, qword [rbx]
mov qword [rsp + 0x40], rcx
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm1
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.18002d6a0
mov rcx, qword [rbx + 0x30]
call fcn.18009a864
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x38], rsi
jmp 0x180076e3e
lea rcx, [rsp + 0x110]
call fcn.180066210
nop
lea rcx, [rsp + 0x70]
call fcn.180066210
nop
lea rcx, [rsp + 0xc0]
call fcn.180066210
nop
lea rcx, [rsp + 0x98]
call fcn.180066210
nop
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x48], rax
mov rcx, qword [rbx]
mov qword [rsp + 0x40], rcx
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm1
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.18002d6a0
mov rcx, qword [rbx + 0x30]
call fcn.18009a864
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x38], rsi
mov sil, 1
mov rcx, qword [rbx]
call fcn.18009a864
mov al, sil
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180099fe0
add rsp, 0x180
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret