Function at 0x180004760
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1c0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1801a8080]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rsi, rdx
mov r15, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdx
xor r12d, r12d
mov dword [rsp + 0x34], r12d
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r12w
xor r8d, r8d
lea rdx, [0x180156244]
lea rcx, [rsp + 0x78]
call fcn.18000c0b0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rsp + 0x68], xmm1
mov word [rsp + 0x58], r12w
lea r8d, [r12 + 6]
lea rdx, str.CLSID_
lea rcx, [rsp + 0x58]
call fcn.18000c0b0
nop
mov r9, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004823
mov r9, qword [rsi]
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x18000486b
lea rdi, [rdx + rcx]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp r8, 8
cmovae rbx, qword [rsp + 0x58]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.180101f90
mov word [rbx + rdi*2], r12w
jmp 0x18000487a
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x58]
call fcn.18000cad0
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x48]
call fcn.18000bd20
nop
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov rax, rdx
sub rax, rcx
cmp rax, 0xf
jb 0x1800048cf
lea rdi, [rcx + 0xf]
mov qword [rbp - 0x38], rdi
lea rbx, [rbp - 0x48]
cmp rdx, 8
cmovae rbx, qword [rbp - 0x48]
lea rcx, [rbx + rcx*2]
mov r8d, 0x1e
lea rdx, str.InProcServer32
call fcn.180101f90
mov word [rbx + rdi*2], r12w
jmp 0x1800048ed
mov qword [rsp + 0x20], 0xf
lea r9, str.InProcServer32
mov edx, 0xf
lea rcx, [rbp - 0x48]
call fcn.18000cad0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x180004938
lea rdi, [rcx + 6]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
mov r8d, 0xc
lea rdx, str.Shell
call fcn.180101f90
mov word [rbx + rdi*2], r12w
jmp 0x180004957
mov qword [rsp + 0x20], 6
lea r9, str.Shell
mov edx, 6
lea rcx, [rsp + 0x58]
call fcn.18000cad0
cmp qword [rsi + 0x10], 0
jne 0x180004a7d
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], 7
mov word [r15], r12w
xor r8d, r8d
lea rdx, [0x180156244]
mov rcx, r15
call fcn.18000c0b0
mov dword [rsp + 0x34], 1
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x1800049cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800049c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000526c
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r12w
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x180004a20
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004a1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005272
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x180005218
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005213
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005266
jmp 0x180005213
mov qword [rsp + 0x38], r12
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov r14, 0xffffffffffffffff
test eax, eax
jne 0x180004d96
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp - 0x20]
call fcn.1801023f0
mov dword [rsp + 0x30], 0xc6
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x180004bc6
cmp word [rbp - 0x20], ax
je 0x180004bc6
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180004b3e
lea rdi, [rcx + 1]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
lea r8d, [r14 + 3]
lea rdx, [0x180156320]
call fcn.180101f90
mov word [rbx + rdi*2], r12w
jmp 0x180004b5d
mov qword [rsp + 0x20], 1
lea r9, [0x180156320]
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.18000cad0
lea rax, [rbp - 0x20]
mov rdx, r14
inc rdx
cmp word [rax + rdx*2], 0
jne 0x180004b64
mov rcx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x180004bb3
lea rdi, [rdx + rcx]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp r8, 8
cmovae rbx, qword [rsp + 0x58]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
lea rdx, [rbp - 0x20]
call fcn.180101f90
mov word [rbx + rdi*2], r12w
jmp 0x180004bc6
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x20]
lea rcx, [rsp + 0x58]
call fcn.18000cad0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
lea rax, [rbp - 0x20]
mov r8, r14
inc r8
cmp word [rax + r8*2], 0
jne 0x180004bf1
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x68]
call fcn.18000c0b0
nop
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp qword [rbp - 0x58], 0
ja 0x180004c73
cmp rax, 0xd
jb 0x180004c5c
lea rdi, [rcx + 0xd]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
mov r8d, 0x1a
lea rdx, str.opencommand
call fcn.180101f90
mov word [rbx + rdi*2], r12w
jmp 0x180004ccd
mov qword [rsp + 0x20], 0xd
lea r9, str.opencommand
mov edx, 0xd
jmp 0x180004cc3
cmp rax, 8
jb 0x180004cae
lea rdi, [rcx + 8]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
mov r8d, 0x10
lea rdx, str.command
call fcn.180101f90
mov word [rbx + rdi*2], r12w
jmp 0x180004ccd
mov qword [rsp + 0x20], 8
lea r9, str.command
mov edx, 8
lea rcx, [rsp + 0x58]
call fcn.18000cad0
mov ecx, 0x802
call fcn.1800e33e8
mov rbx, rax
mov dword [rsp + 0x30], 0x800
test rax, rax
je 0x180004d45
xor edx, edx
mov r8d, 0x802
mov rcx, rax
call fcn.1801023f0
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
lea r9, [rsp + 0x30]
mov r8, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x180004d3c
mov r8, r14
inc r8
cmp word [rbx + r8*2], 0
jne 0x180004d24
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.18000c0b0
mov rcx, rbx
call fcn.1800e2d24
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x180004d85
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004d80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005278
call fcn.1800e2d24
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
cmp qword [rbp - 0x78], 0
ja 0x180004e20
mov ecx, 0x802
call fcn.1800e33e8
mov rbx, rax
mov dword [rsp + 0x30], 0x800
test rax, rax
je 0x180004e15
xor edx, edx
mov r8d, 0x802
mov rcx, rax
call fcn.1801023f0
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
lea r9, [rsp + 0x30]
mov r8, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x180004e0d
mov r8, r14
inc r8
cmp word [rbx + r8*2], 0
jne 0x180004df5
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.18000c0b0
mov rcx, rbx
call fcn.1800e2d24
cmp qword [rbp - 0x78], 0
jbe 0x180004fd4
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004e2d
mov rcx, qword [rsi]
lea rdx, str.2559A1F0_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fc0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004e50
mov rcx, qword [rsi]
lea rdx, str.2559A1F1_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fc0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004e73
mov rcx, qword [rsi]
lea rdx, str.2559A1F2_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fc0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004e96
mov rcx, qword [rsi]
lea rdx, str.2559A1F3_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fc0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004eb9
mov rcx, qword [rsi]
lea rdx, str.2559A1F5_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fc0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004edc
mov rcx, qword [rsi]
lea rdx, str.2559A1F6_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fc0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004eff
mov rcx, qword [rsi]
lea rdx, str.2559A1F7_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fc0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004f22
mov rcx, qword [rsi]
lea rdx, str.871C5380_42A0_1069_A2EA_08002B30309D
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fc0
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str.http:
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fc0
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str.https:
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fc0
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str.www.
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fc0
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str..com
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180004fd4
xor r8d, r8d
lea rdx, [0x180156244]
lea rcx, [rsp + 0x78]
call fcn.18000c0b0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004fe1
mov rcx, qword [rsi]
lea rdx, str.2559A1F4_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180005107
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp - 0x58], xmm1
mov word [rbp - 0x68], r12w
mov ecx, 0x802
call fcn.1800e33e8
mov rbx, rax
mov dword [rsp + 0x30], 0x800
test rax, rax
je 0x180005082
xor edx, edx
mov r8d, 0x802
mov rcx, rax
call fcn.1801023f0
lea r9, [rsp + 0x30]
mov r8, rbx
lea rdx, str.SoftwareClientsStartMenuInternet
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x18000507a
nop dword [rax + rax]
inc r14
cmp word [rbx + r14*2], 0
jne 0x180005060
mov r8, r14
mov rdx, rbx
lea rcx, [rbp - 0x68]
call fcn.18000c0b0
mov rcx, rbx
call fcn.1800e2d24
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
lea rdx, [0x1801566b8]
call fcn.180104c68
test eax, eax
jne 0x1800050b5
xor r8d, r8d
lea rdx, [0x180156244]
lea rcx, [rsp + 0x78]
call fcn.18000c0b0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x1800050f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800050f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000527e
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp - 0x58], xmm0
mov word [rbp - 0x68], r12w
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [r15 + 0x10], xmm1
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r12w
mov dword [rsp + 0x34], 1
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x180005173
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000516e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005284
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r12w
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1800051c7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800051c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000528a
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x180005218
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005213
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005260
call fcn.1800e2d24
mov word [rsp + 0x78], r12w
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r12
mov rcx, rsi
call fcn.18000c040
mov rax, r15
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.1800e2d00
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.180107ee8
int3
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
int3
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
int3