Function at 0x100018730
Capabilities:
Query or enumerate registry value
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x610
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1000341e0]
xor rax, rsp
mov qword [rsp + 0x600], rax
mov rbp, rdx
mov rbx, rcx
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CDaoIndexFieldInfo::CDaoIndexFieldInfo
nop
lea rcx, [rsp + 0x68]
call sub.MFC42u.dll_CDaoIndexFieldInfo::CDaoIndexFieldInfo
nop
lea rcx, [rsp + 0x50]
call sub.MFC42u.dll_CDaoIndexFieldInfo::CDaoIndexFieldInfo
nop
mov rcx, rbp
call sub.MFC42u.dll_CPropertySheet::EnableStackedTabs
mov rdx, rbx
lea rcx, [rsp + 0x50]
call sub.MFC42u.dll_AfxDaoGetEngine
lea rdx, [0x100002d58]
lea rcx, [rsp + 0x70]
call sub.MFC42u.dll_CDaoException::CDaoException
mov rbx, rax
mov edi, 1
mov r8d, edi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call sub.MFC42u.dll_CFormView::SetOccDialogInfo
mov r9, qword [rbx]
mov rcx, qword [rax]
sub r9, rcx
movzx r8d, word [rcx]
movzx eax, word [rcx + r9]
sub r8d, eax
jne 0x1000187e9
add rcx, 2
test eax, eax
jne 0x1000187d3
xor r12d, r12d
cmp r8d, r12d
setne bl
lea rcx, [rsp + 0x60]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x70]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
cmp bl, r12b
je 0x100018836
lea rdx, [0x100002d58]
lea rcx, [rsp + 0x60]
call sub.MFC42u.dll_CDaoException::CDaoException
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call sub.MFC42u.dll_Ordinal_1284
nop
lea rcx, [rsp + 0x60]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
mov edx, 0x66
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CPropertySheet::OnCtlColor
lea rdx, [0x100008008]
lea rcx, [rsp + 0x70]
call sub.MFC42u.dll_CCtrlView::CCtrlView
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x60]
call sub.MFC42u.dll_AfxThrowNotSupportedException
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_AfxDaoGetEngine
nop
lea rcx, [rsp + 0x60]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x70]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
mov edx, 0x4b5
lea rcx, [rsp + 0x68]
call sub.MFC42u.dll_CPropertySheet::OnCtlColor
lea r11, [rsp + 0x80]
mov qword [rsp + 0x20], r11
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x100018930
mov dword [rsp + 0x70], 0x104
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, [0x100007fe8]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x100018922
cmp dword [rsp + 0x60], edi
jne 0x100018922
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_AfxDaoTerm
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x48]
call sub.MFC42u.dll_CDaoIndexFieldInfo::CDaoIndexFieldInfo
nop
mov edx, 0xa
lea rcx, [rsp + 0x88]
call sub.MFC42u.dll_CDaoQueryDef::CDaoQueryDef
nop
mov r13d, 0x7c
mov rax, qword [rsp + 0x40]
cmp dword [rax - 8], r12d
je 0x100018ae0
mov edx, r13d
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CRichEditView::FindTextSimple
cmp eax, 0xffffffff
jne 0x100018986
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call sub.MFC42u.dll_AfxDaoGetEngine
jmp 0x1000189be
mov edx, r13d
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CRichEditView::FindTextSimple
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CDialog::OnCommandHelp
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call sub.MFC42u.dll_AfxDaoGetEngine
nop
lea rcx, [rsp + 0x60]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
lea rcx, [rsp + 0x88]
call sub.MFC42u.dll_COleServerItem::XDataObject::SetData
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x48]
call fcn.100018fb4
mov rbx, qword [rsp + 0x90]
cmp rbx, r12
jne 0x100018a84
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax - 8]
mov rax, qword [rsp + 0x48]
sub r8d, dword [rax - 8]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CFormView::SetOccDialogInfo
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_AfxDaoGetEngine
nop
lea rcx, [rsp + 0x70]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
mov edx, r13d
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CRichEditView::FindTextSimple
cmp eax, r12d
jne 0x100018a73
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax - 8]
dec r8d
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CFormView::SetOccDialogInfo
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_AfxDaoGetEngine
nop
lea rcx, [rsp + 0x78]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
mov rax, qword [rsp + 0x40]
cmp dword [rax - 8], r12d
jne 0x100018963
jmp 0x100018ae0
mov r8d, edi
mov edx, 0x18
mov rcx, rbx
call sub.MFC42u.dll_Ordinal_1483
cmp eax, r12d
jne 0x100018a9f
call sub.MFC42u.dll_CTreeCtrl::SetCheck
int3
lea rdx, [rbx + 0x10]
mov rcx, rbp
call sub.MFC42u.dll_AfxDaoGetEngine
nop
lea rcx, [rsp + 0x88]
call sub.MFC42u.dll_COleControl::XOleInPlaceActiveObject::AddRef
nop
lea rcx, [rsp + 0x48]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x50]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x68]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
jmp 0x100018f38
lea rdx, [0x100008010]
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_AfxDeleteObject
mov r11, qword [rsp + 0x40]
cmp dword [r11 - 8], r12d
je 0x100018f4c
mov edx, r13d
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CRichEditView::FindTextSimple
cmp eax, 0xffffffff
jne 0x100018b23
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call sub.MFC42u.dll_AfxDaoGetEngine
jmp 0x100018b5b
mov edx, r13d
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CRichEditView::FindTextSimple
mov r8d, eax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CDialog::OnCommandHelp
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call sub.MFC42u.dll_AfxDaoGetEngine
nop
lea rcx, [rsp + 0x78]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
lea rcx, [rsp + 0x88]
call sub.MFC42u.dll_COleServerItem::XDataObject::SetData
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x48]
call fcn.100018fb4
mov rsi, qword [rsp + 0x90]
cmp rsi, r12
je 0x100018d2f
mov rbx, rsi
mov r8d, edi
mov edx, 0x18
mov rcx, rsi
call sub.MFC42u.dll_Ordinal_1483
cmp eax, r12d
je 0x100018f46
mov rsi, qword [rsi]
lea rdx, [rbx + 0x10]
mov rcx, rbp
call sub.MFC42u.dll_AfxDaoGetEngine
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, edi
mov edx, 0x80000000
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x100018d26
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x58]
mov r8d, edi
lea rdx, [rsp + 0xd0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
je 0x100018efc
cmp word [rsp + 0xd0], 0x3c
jne 0x100018c8b
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x58]
mov r8d, 0x12
lea rdx, [rsp + 0xd0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
je 0x100018e01
lea rdx, [0x100008020]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r12d
je 0x100018dc3
mov r9d, edi
xor r8d, r8d
lea edx, [r8 - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [rsp + 0x58], 0x12
je 0x100018c24
jmp 0x100018d1d
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x58]
mov r8d, edi
lea rdx, [rsp + 0x3f0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
je 0x100018ebe
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x58]
mov r8d, 0x12
lea rdx, [rsp + 0x3f0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
je 0x100018e80
mov word [rsp + 0x414], r12w
lea rdx, [0x100008020]
lea rcx, [rsp + 0x3f0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r12d
je 0x100018e42
mov r9d, edi
xor r8d, r8d
lea edx, [r8 - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [rsp + 0x58], 0x12
je 0x100018cb2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rsi, r12
jne 0x100018b90
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax - 8]
mov rax, qword [rsp + 0x48]
sub r8d, dword [rax - 8]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CFormView::SetOccDialogInfo
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_AfxDaoGetEngine
nop
lea rcx, [rsp + 0x60]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
mov edx, r13d
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CRichEditView::FindTextSimple
cmp eax, r12d
jne 0x100018daf
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax - 8]
dec r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CFormView::SetOccDialogInfo
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_AfxDaoGetEngine
nop
lea rcx, [rsp + 0x70]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
mov rax, qword [rsp + 0x40]
cmp dword [rax - 8], r12d
je 0x100018f4c
jmp 0x100018b00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x88]
call sub.MFC42u.dll_COleControl::XOleInPlaceActiveObject::AddRef
nop
lea rcx, [rsp + 0x48]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x50]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x68]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
jmp 0x100018f38
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x88]
call sub.MFC42u.dll_COleControl::XOleInPlaceActiveObject::AddRef
nop
lea rcx, [rsp + 0x48]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x50]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x68]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
mov edi, r12d
jmp 0x100018f38
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x88]
call sub.MFC42u.dll_COleControl::XOleInPlaceActiveObject::AddRef
nop
lea rcx, [rsp + 0x48]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x50]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x68]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
jmp 0x100018f38
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x88]
call sub.MFC42u.dll_COleControl::XOleInPlaceActiveObject::AddRef
nop
lea rcx, [rsp + 0x48]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x50]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x68]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
mov edi, r12d
jmp 0x100018f38
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x88]
call sub.MFC42u.dll_COleControl::XOleInPlaceActiveObject::AddRef
nop
lea rcx, [rsp + 0x48]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x50]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x68]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
mov edi, r12d
jmp 0x100018f38
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x88]
call sub.MFC42u.dll_COleControl::XOleInPlaceActiveObject::AddRef
nop
lea rcx, [rsp + 0x48]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x50]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x68]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
mov edi, r12d
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
mov eax, edi
jmp 0x100018f87
call sub.MFC42u.dll_CTreeCtrl::SetCheck
nop
lea rcx, [rsp + 0x88]
call sub.MFC42u.dll_COleControl::XOleInPlaceActiveObject::AddRef
nop
lea rcx, [rsp + 0x48]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x50]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x68]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
xor eax, eax
mov rcx, qword [rsp + 0x600]
xor rcx, rsp
call fcn.100020710
mov rbx, qword [rsp + 0x650]
add rsp, 0x610
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret