Function at 0x18001d330
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
mov rbp, rsp
sub rsp, 0x60
cmp word [0x180037cb0], 0
mov r12, rcx
je 0x18001d392
lea rsi, [0x180037cb0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r12
mov ebx, eax
add ebx, ebx
mov edx, ebx
call fcn.180005b40
mov edi, eax
test eax, eax
jne 0x18001d685
mov rcx, qword [r12 + 8]
movsxd r8, ebx
mov rdx, rsi
call fcn.18002525c
xor edi, edi
mov eax, edi
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor edi, edi
mov qword [rsp + 0x58], r13
mov dword [rbp + 0x40], 0x80
cmp qword [0x180037b18], rdi
mov qword [rsp + 0x50], r14
mov dword [rbp + 0x38], edi
jne 0x18001d3de
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180037b18], rax
test rax, rax
jne 0x18001d3de
mov ecx, edi
jmp 0x18001d3f8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rbp + 0x38]
mov rcx, rax
call qword [0x180037b18]
mov ecx, edi
test eax, eax
setne cl
test ecx, ecx
lea rax, [rbp + 0x48]
mov dword [rbp + 0x38], ecx
mov r13d, 1
mov r14d, 0x101
lea rdx, str.SoftwareCLASSES360SD
mov r9d, r13d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
cmovne r9d, r14d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rsi, [0x180037cb0]
mov ebx, eax
test eax, eax
jne 0x18001d476
mov rcx, qword [rbp + 0x48]
lea rax, [rbp + 0x40]
lea rdx, str.CLSID
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x48]
mov ebx, eax
test eax, eax
je 0x18001d64a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x18001d650
cmp qword [0x180037b18], rdi
mov dword [rbp + 0x40], 0x80
mov dword [rbp + 0x38], edi
jne 0x18001d4be
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180037b18], rax
test rax, rax
jne 0x18001d4be
mov ecx, edi
jmp 0x18001d4d8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rbp + 0x38]
mov rcx, rax
call qword [0x180037b18]
mov ecx, edi
test eax, eax
setne cl
test ecx, ecx
lea rax, [rbp + 0x48]
mov dword [rbp + 0x38], ecx
cmovne r13d, r14d
lea rdx, str.SoftwareCLASSES360SD
mov rcx, 0xffffffff80000001
mov r9d, r13d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x18001d543
mov rcx, qword [rbp + 0x48]
lea rax, [rbp + 0x40]
lea rdx, str.CLSID
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x48]
mov ebx, eax
test eax, eax
je 0x18001d64a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x18001d650
mov rbx, rdi
nop
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11d, dword [0x180037b20]
inc rbx
imul r11d, r11d, 0x7f
add r11d, dword [rbp + 0x44]
mov eax, r11d
shr eax, 3
add eax, dword [rbp + 0x40]
add r11d, eax
mov byte [rbp + rbx + 0x37], r11b
mov dword [0x180037b20], r11d
cmp rbx, 8
jl 0x18001d550
movzx eax, byte [rbp + 0x3f]
movzx ecx, byte [rbp + 0x3e]
movzx edx, byte [rbp + 0x3d]
movzx r10d, byte [rbp + 0x3c]
movzx r11d, byte [rbp + 0x3b]
movzx ebx, byte [rbp + 0x3a]
movzx r9d, byte [rbp + 0x39]
movzx r8d, byte [rbp + 0x38]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
lea rdx, str._2.2X_2.2X_2.2X_2.2X_2.2X_2.2X_2.2X_2.2X
mov rcx, rsi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, str.CLSID
lea rdx, str.SoftwareCLASSES360SD
lea eax, [rax + rax + 2]
mov r9, rsi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], eax
call fcn.18001cdf0
test eax, eax
je 0x18001d650
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, str.CLSID
lea rdx, str.SoftwareCLASSES360SD
lea eax, [rax + rax + 2]
mov r9, rsi
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], eax
call fcn.18001cdf0
jmp 0x18001d650
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r12
mov ebx, eax
add ebx, ebx
mov edx, ebx
call fcn.180005b40
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
test eax, eax
jne 0x18001d687
mov rcx, qword [r12 + 8]
movsxd r8, ebx
mov rdx, rsi
call fcn.18002525c
mov eax, edi
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret