Function at 0x18001e500
Capabilities:
Query or enumerate registry key

Disassembly:
mov byte [rsp + 0x20], r9b
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x148
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov rax, qword [0x1800881a0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov eax, SafeArrayDestroy
mov word [rsp + 0x4c], ax
movsx rax, word [rsp + 0x4c]
lea rcx, [0x180087980]
cmp dword [rcx + rax*4], 1
jne 0x18001e578
movsx rax, word [rsp + 0x4c]
lea rcx, [0x180087980]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x4c]
lea rdx, [0x180087980]
mov dword [rdx + rcx*4], eax
mov eax, reloc.OLEAUT32.dll_SafeArrayGetDim
mov word [rsp + 0x48], ax
movsx rax, word [rsp + 0x48]
lea rcx, [0x180087980]
cmp dword [rcx + rax*4], 1
jne 0x18001e5b7
movsx rax, word [rsp + 0x48]
lea rcx, [0x180087980]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x48]
lea rdx, [0x180087980]
mov dword [rdx + rcx*4], eax
mov edx, 1
lea rcx, [rsp + 0xc8]
call fcn.180019030
lea rcx, [rsp + 0xc8]
call fcn.18001bf00
nop
cmp qword [rsp + 0x158], 0
je 0x18001e622
mov r8, 0xffffffffffffffff
mov rdx, qword [rsp + 0x158]
lea rcx, [rsp + 0x98]
call fcn.18001be50
nop
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xc8]
call fcn.18001c490
nop
lea rcx, [rsp + 0x98]
call fcn.180011730
mov qword [rsp + 0xb8], 0
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087980]
mov eax, dword [rcx + rax]
xor edx, edx
mov ecx, SafeArrayGetElement
div rcx
mov rax, rdx
mov dword [rsp + 0x5c], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087980]
movsxd rdx, dword [rsp + 0x5c]
lea r8, [0x180087980]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx*4], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087980]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0
lea rdx, [0x180087980]
mov dword [rdx + rcx], eax
mov eax, dword [rsp + 0x160]
or eax, 0x2001f
mov dword [rsp + 0x6c], eax
lea rcx, [rsp + 0xc8]
call fcn.1800324c0
lea rcx, [rsp + 0xb8]
mov qword [rsp + 0x20], rcx
mov ecx, dword [rsp + 0x6c]
mov r9d, ecx
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x40], eax
xor eax, eax
mov word [rsp + 0x44], ax
movsx rax, word [rsp + 0x44]
lea rcx, [0x180087980]
cmp dword [rcx + rax*4], 1
jne 0x18001e722
movsx rax, word [rsp + 0x44]
lea rcx, [0x180087980]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x44]
lea rdx, [0x180087980]
mov dword [rdx + rcx*4], eax
cmp dword [rsp + 0x40], 0
je 0x18001e9ac
cmp dword [rsp + 0x40], 2
jne 0x18001e8b4
movzx eax, byte [rsp + 0x168]
test eax, eax
je 0x18001e8b4
mov edx, 1
lea rcx, [rsp + 0xf8]
call fcn.180019030
lea rcx, [rsp + 0xc8]
call fcn.1800324c0
mov rdx, rax
lea rcx, [rsp + 0xf8]
call fcn.180022a60
nop
mov edx, 1
lea rcx, [rsp + 0x110]
call fcn.180019030
lea rcx, [rsp + 0xc8]
call fcn.1800324c0
mov rcx, rax
call fcn.180022160
mov r8, 0xffffffffffffffff
mov rdx, rax
lea rcx, [rsp + 0x110]
call fcn.18001be50
nop
lea rcx, [rsp + 0xf8]
call fcn.180019300
movzx eax, al
test eax, eax
jne 0x18001e899
lea rcx, [rsp + 0x110]
call fcn.180019300
movzx eax, al
test eax, eax
jne 0x18001e899
mov dword [rsp + 0x64], 1
mov eax, dword [rsp + 0x64]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x18001e816
xor r9d, r9d
lea r8, [0x180089ffc]
lea rdx, [0x18008a004]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rsp + 0x110]
call fcn.1800324c0
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0xf8]
call fcn.1800324c0
mov r9d, dword [rsp + 0x160]
mov rcx, qword [rsp + 0x90]
mov r8, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x150]
call fcn.18001d360
test eax, eax
jne 0x18001e899
mov dword [rsp + 0x74], 0
lea rcx, [rsp + 0x110]
call fcn.180011730
nop
lea rcx, [rsp + 0xf8]
call fcn.180011730
nop
lea rcx, [rsp + 0xc8]
call fcn.180011730
mov eax, dword [rsp + 0x74]
jmp 0x18001ec76
lea rcx, [rsp + 0x110]
call fcn.180011730
nop
lea rcx, [rsp + 0xf8]
call fcn.180011730
cmp dword [rsp + 0x40], 2
je 0x18001e919
cmp dword [rsp + 0x40], 3
je 0x18001e919
mov dword [rsp + 0x7c], 1
mov eax, dword [rsp + 0x7c]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x18001e8f1
xor r9d, r9d
lea r8, [0x180089ffc]
lea rdx, [0x18008a004]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rsp + 0xc8]
call fcn.1800324e0
mov r9, rax
mov r8d, dword [rsp + 0x40]
lea rdx, [0x18008a450]
mov ecx, 4
call fcn.180040a70
jmp 0x18001e988
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087980]
mov eax, dword [rcx + rax]
xor edx, edx
mov ecx, SafeArrayGetElement
div rcx
mov rax, rdx
mov dword [rsp + 0x70], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087980]
movsxd rdx, dword [rsp + 0x70]
lea r8, [0x180087980]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx*4], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087980]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0
lea rdx, [0x180087980]
mov dword [rdx + rcx], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x84], eax
lea rcx, [rsp + 0xc8]
call fcn.180011730
mov eax, dword [rsp + 0x84]
jmp 0x18001ec76
mov edx, 1
lea rcx, [rsp + 0xe0]
call fcn.180019030
lea rcx, [rsp + 0xe0]
call fcn.18001bf00
nop
mov edx, 0x8000
lea rcx, [rsp + 0xe0]
call fcn.1800242f0
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087980]
mov eax, dword [rcx + rax]
xor edx, edx
mov ecx, SafeArrayGetElement
div rcx
mov rax, rdx
mov dword [rsp + 0x78], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087980]
movsxd rdx, dword [rsp + 0x78]
lea r8, [0x180087980]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx*4], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087980]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0
lea rdx, [0x180087980]
mov dword [rdx + rcx], eax
lea rcx, [rsp + 0xe0]
call fcn.1800324e0
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0xe0]
call fcn.180006e60
mov dword [rsp + 0xc0], eax
mov dword [rsp + 0x54], 1
mov eax, dword [rsp + 0x54]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x18001eaa5
xor r9d, r9d
lea r8, [0x180089ffc]
lea rdx, [0x18008a004]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [rsp + 0xc0], 0
je 0x18001eaba
cmp qword [rsp + 0x88], 0
jne 0x18001eaec
mov dword [rsp + 0x80], 8
lea rcx, [rsp + 0xe0]
call fcn.180011730
nop
lea rcx, [rsp + 0xc8]
call fcn.180011730
mov eax, dword [rsp + 0x80]
jmp 0x18001ec76
lea rax, [rsp + 0x128]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xc0]
mov r8, qword [rsp + 0x88]
xor edx, edx
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x18001ec18
xor r9d, r9d
mov r8d, dword [rsp + 0x160]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0xb8]
call fcn.18001e500
mov dword [rsp + 0x40], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087980]
mov eax, dword [rcx + rax]
xor edx, edx
mov ecx, SafeArrayGetElement
div rcx
mov rax, rdx
mov dword [rsp + 0x68], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087980]
movsxd rdx, dword [rsp + 0x68]
lea r8, [0x180087980]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx*4], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087980]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0
lea rdx, [0x180087980]
mov dword [rdx + rcx], eax
cmp dword [rsp + 0x40], 0
je 0x18001ebff
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0xe0]
call fcn.180011730
nop
lea rcx, [rsp + 0xc8]
call fcn.180011730
mov eax, dword [rsp + 0x58]
jmp 0x18001ec76
lea rcx, [rsp + 0xe0]
call fcn.180006e60
mov dword [rsp + 0xc0], eax
jmp 0x18001eaec
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0xc8]
call fcn.1800324c0
mov r8d, dword [rsp + 0x160]
mov rdx, rax
mov rcx, qword [rsp + 0x150]
call fcn.18001d2e0
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x60], eax
lea rcx, [rsp + 0xe0]
call fcn.180011730
nop
lea rcx, [rsp + 0xc8]
call fcn.180011730
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18004d370
add rsp, 0x148
ret