Function at 0x180006420
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x2e0
mov rax, qword [0x180013240]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
test edx, edx
je 0x1800068ed
cmp edx, 1
jne 0x180006902
mov qword [r11 + 8], rbp
lea rcx, str.dwmcore.dll
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x28], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x48]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x11c
call fcn.18000a3be
mov r8b, 3
mov dword [rsp + 0x60], 0x11c
mov edx, 4
mov dword [rsp + 0x6c], 0x55f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 4
lea rcx, [rsp + 0x60]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
setne byte [0x180013df0]
test eax, eax
je 0x180006686
mov esi, dword [rsp + 0x50]
lea r15, str._SUVWAVAWH
mov r10, qword [0x180013c18]
lea r12, str._USVWATAUAVAWH
mov r11, qword [0x180013c08]
lea r14, [0x18000cb30]
mov rbx, qword [0x180013c00]
mov r9, rdi
lea rbp, [rsi - 9]
neg r9
test r10, r10
jne 0x180006573
mov rax, rsi
sub rax, r9
sub rax, rdi
cmp rax, 0x20
jb 0x180006573
xor ecx, ecx
mov r8, rdi
sub r8, r15
nop dword [rax]
movzx edx, byte [rcx + r15]
lea rax, [rcx + r15]
cmp byte [r8 + rax], dl
je 0x180006554
cmp dl, 0x3f
jne 0x180006573
inc rcx
cmp rcx, 0x20
jl 0x180006540
mov r10, rdi
mov qword [0x180013c18], rdi
mov qword [0x180013c10], rdi
jmp 0x180006607
test r11, r11
jne 0x1800065b9
mov rax, rsi
sub rax, r9
sub rax, rdi
cmp rax, 0x15
jb 0x1800065b9
xor ecx, ecx
mov r8, rdi
sub r8, r12
nop
movzx edx, byte [rcx + r12]
lea rax, [rcx + r12]
cmp byte [r8 + rax], dl
je 0x1800065a4
cmp dl, 0x3f
jne 0x1800065b9
inc rcx
cmp rcx, 0x15
jl 0x180006590
mov r11, rdi
mov qword [0x180013c08], rdi
jmp 0x180006607
test rbx, rbx
jne 0x180006607
mov rax, rsi
sub rax, r9
sub rax, rdi
cmp rax, 9
jb 0x180006607
xor eax, eax
mov r8, rdi
sub r8, r14
nop word [rax + rax]
movzx edx, byte [rax + r14]
lea rcx, [rax + r14]
cmp byte [r8 + rcx], dl
je 0x1800065f4
cmp dl, 0x3f
jne 0x180006607
inc rax
cmp rax, 9
jl 0x1800065e0
mov rbx, rdi
mov qword [0x180013c00], rbx
test r10, r10
je 0x180006616
test r11, r11
je 0x180006616
test rbx, rbx
jne 0x180006626
inc rdi
lea rax, [r9 + rdi]
cmp rax, rbp
jbe 0x180006521
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x30], rax
lea r8, [0x18000c8d8]
lea rax, [rsp + 0x44]
mov r9d, 0x18
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov rbp, qword [0x180013c18]
mov r14, qword [0x180013c08]
mov rsi, qword [0x180013c00]
jmp 0x18000677f
mov r12d, dword [rsp + 0x50]
mov rbx, rdi
mov rbp, qword [0x180013c18]
sub r12, 0x24
mov r14, qword [0x180013c08]
mov rsi, qword [0x180013c00]
mov r15d, dword [0x180013bf8]
mov qword [rsp + 0x2d0], r13
movzx r13d, word [0x18000cb84]
nop
test rbp, rbp
jne 0x1800066ef
lea r8d, [rbp + 0x24]
mov rcx, rbx
lea rdx, [0x18000cba0]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1800066ef
mov rbp, rbx
mov qword [0x180013c18], rbx
mov qword [0x180013c10], rbx
jmp 0x18000674f
test r14, r14
jne 0x180006721
lea r8d, [r14 + 0x15]
mov rcx, rbx
lea rdx, [0x18000cb88]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180006721
inc r15d
cmp r15d, 2
jne 0x18000674f
lea r14, [rbx - 0xa]
mov qword [0x180013c08], r14
jmp 0x18000674f
test rsi, rsi
jne 0x18000674f
mov rax, qword [0x18000cb78]
cmp qword [rbx], rax
jne 0x18000674f
mov eax, dword [0x18000cb80]
cmp dword [rbx + 8], eax
jne 0x18000674f
cmp word [rbx + 0xc], r13w
jne 0x18000674f
lea rsi, [rbx - 7]
mov qword [0x180013c00], rsi
test rbp, rbp
je 0x18000675e
test r14, r14
je 0x18000675e
test rsi, rsi
jne 0x180006770
inc rbx
mov rax, rbx
sub rax, rdi
cmp rax, r12
jbe 0x1800066c0
mov r13, qword [rsp + 0x2d0]
mov dword [0x180013bf8], r15d
mov r9, r14
mov qword [rsp + 0x20], rsi
mov r8, rbp
lea rdx, str.Current_variable_states:_COverlayContext::Present____p_tCOverlayContext::IsCandidateDirectFlipCompatible____p_tCOverlayContext::OverlaysEnabled____p
lea rcx, [rsp + 0x180]
call fcn.1800079b0
cmp qword [0x180013c18], 0
mov r15, qword [rsp + 0x2c0]
mov r14, qword [rsp + 0x2c8]
mov r12, qword [rsp + 0x2d8]
mov rdi, qword [rsp + 0x300]
mov rsi, qword [rsp + 0x2f8]
mov rbp, qword [rsp + 0x2f0]
je 0x1800068e9
cmp qword [0x180013c08], 0
je 0x1800068e9
cmp qword [0x180013c00], 0
je 0x1800068e9
call fcn.1800082b0
mov rcx, qword [0x180013c18]
lea r8, [0x180013c18]
lea rdx, [0x180005b20]
call fcn.180008010
mov rcx, qword [0x180013c08]
lea r8, [0x180013c08]
lea rdx, [0x1800063f0]
call fcn.180008010
mov rcx, qword [0x180013c00]
lea r8, [0x180013c00]
lea rdx, [0x180006410]
call fcn.180008010
xor ecx, ecx
call fcn.1800082a0
cmp byte [0x1800132b4], 0
je 0x180006902
lea rdx, [0x18000c504]
lea rcx, str.C:UserskamDownloadsdwm_lut_masterDwmLutGUIDwmLutGUI_binx64Debuglog.txt
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
je 0x1800068e0
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
cmp eax, 0x1400000
jle 0x1800068b2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
xor edx, edx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__chsize]
cmp eax, 0xffffffff
je 0x1800068d7
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
lea r8, str.DWM_HOOK_DLL_INITIALIZATION._START_LOGGING
mov rcx, rbx
lea rdx, [0x18000c560]
call fcn.180007960
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov byte [0x1800132b4], 0
jmp 0x180006902
xor eax, eax
jmp 0x180006907
call fcn.180008350
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180004eb0
mov eax, 1
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1800095d0
add rsp, 0x2e0
pop rbx
ret