Function at 0x18004a9e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x180097ee8]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rsi, r9
mov qword [rbp - 0x68], r9
mov r14, r8
mov qword [rsp + 0x78], r8
mov dword [rsp + 0x6c], edx
mov edi, edx
mov dword [rsp + 0x40], edx
imul eax, edx, 0x762
mov dword [rsp + 0x70], eax
movzx ebx, byte [rsp + 0x38]
cmp edx, eax
ja 0x18004b4e7
xor r13d, r13d
lea r9, [0x1800643e0]
lea ecx, [r13 + 0x73]
movabs r10, 0x3300790061
lea r11, str.libeay32
lea r15, [0x180000000]
lea edx, [rcx - 0x45]
movabs r8, 0x7ffffffffffffffe
nop dword [rax + rax]
cmp edi, 0x159bc
ja 0x18004ad61
je 0x18004ad36
cmp edi, 0x3e28
ja 0x18004acc5
je 0x18004acbe
mov eax, edi
sub eax, 0x75
je 0x18004aaf2
sub eax, 0x2e
je 0x18004aae9
cmp eax, 0x37
jne 0x18004b4cf
mov eax, dword [0x18008e538]
mov dword [rbp + 0x78], eax
movzx eax, word [0x18008e53c]
mov word [rbp + 0x7c], ax
mov r8d, 7
lea rdx, str.vcr120
lea rcx, [rbp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x18004b4a5
mov qword [r14 + 0x10], r13
jmp 0x18004b4cf
mov rax, qword [r14 + 0x40]
mov ecx, dword [rax + 0x38]
cmp dword [rsi], ecx
jne 0x18004ab28
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, 0xcc
xor ecx, ecx
call fcn.180026de0
test al, al
je 0x18004b51a
lea r9, [0x1800643e0]
mov ecx, dword [rsi]
sub ecx, 1
je 0x18004acb4
sub ecx, 2
je 0x18004ac63
sub ecx, 0x12
je 0x18004ac63
sub ecx, 5
je 0x18004ac08
cmp ecx, 2
je 0x18004abad
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, 0xcc
xor ecx, ecx
call fcn.180026de0
test al, al
je 0x18004acb4
mov eax, dword [r14 + 0xb8]
cmp dword [rsi], eax
jne 0x18004acb4
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0xbe
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.1800295c0
mov edi, 0x75
jmp 0x18004b4a5
mov byte [rsp + 0x30], 1
mov eax, dword [r14 + 0xb8]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, r14
mov r8d, 0xcf
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.180022240
mov dword [r14 + 0xb8], 0x1d
mov edi, 0x75
jmp 0x18004b4a5
mov byte [rsp + 0x30], 1
mov eax, dword [r14 + 0xb8]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, r14
mov r8d, 0xcf
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.180022240
mov dword [r14 + 0xb8], 0x1b
mov edi, 0x75
jmp 0x18004b4a5
mov eax, dword [r14 + 0xb8]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 1
mov qword [rsp + 0x50], r13
mov r9, r14
mov r8d, 0xcf
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.180022240
mov dword [r14 + 0xb8], 0x16
mov edi, 0x75
jmp 0x18004b4a5
mov bl, 1
jmp 0x18004b4cf
cmp edi, 0x73d0
je 0x18004acf5
cmp edi, 0x7bdb
je 0x18004b4e7
cmp edi, 0xe6c6
jne 0x18004b4cf
mov dword [rbp + 0x66], 0x65
mov qword [rbp + 0x68], r10
jmp 0x18004b4cf
movsd xmm0, qword [str.LAUNCH_G]
movsd qword [rbp + 0x50], xmm0
movzx eax, word [0x18008e534]
mov word [rbp + 0x58], ax
movzx eax, byte [0x18008e536]
mov byte [rbp + 0x5a], al
mov dword [rbp + 0x60], ecx
mov r8d, 3
lea rdx, [0x18008d1d4]
lea rcx, [rbp + 0x62]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x18004b4a5
mov r8d, 0xa
lea rdx, [rbp + 0x6e]
lea ecx, [r8 - 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultow]
movups xmm0, xmmword [rbp + 8]
movups xmmword [rbp + 0x20], xmm0
movsd xmm1, qword [rbp + 0x18]
movsd qword [rbp + 0x30], xmm1
jmp 0x18004b4a5
cmp edi, 0x32594
ja 0x18004adb9
je 0x18004adaf
cmp edi, 0x1ccb2
je 0x18004ada2
cmp edi, 0x23fa8
je 0x18004ad94
cmp edi, 0x2b29e
jne 0x18004b4cf
lea rax, [rbp + 0x60]
mov qword [rbp + 0x30], rax
jmp 0x18004b4cf
mov qword [rbp + 0x28], r11
mov dword [rsp + 0x68], r13d
jmp 0x18004b4cf
lea rax, [rbp + 0x78]
mov qword [rbp + 0x20], rax
jmp 0x18004b4cf
mov dword [rsp + 0x74], r13d
jmp 0x18004b4cf
cmp edi, 0x3988a
je 0x18004ade7
cmp edi, 0x40b80
jne 0x18004b4cf
mov r9d, dword [rsp + 0x74]
lea r8, [rbp + 0x50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHPathPrepareForWriteA]
mov al, 1
jmp 0x18004b4ea
mov dword [rsp + 0x58], r13d
lea rsi, [rbp + 0x20]
mov qword [rsp + 0x50], rsi
nop word [rax + rax]
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], r13w
mov edi, 0x10c
mov dword [rsp + 0x48], edi
mov r12d, 8
mov dword [rsp + 0x60], r12d
cmp r12d, 8
ja case.0x18004ae3d.4
mov eax, r12d
mov ecx, dword [r15 + rax*4 + 0x4b5bc]
add rcx, r15
jmp rcx
mov rsi, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x40]
cmp rsi, rcx
jae 0x18004ae6d
lea rax, [rsi + 1]
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x58]
cmp rcx, 8
cmovae rax, qword [rbp - 0x58]
mov dword [rax + rsi*2], 0x2e
jmp 0x18004af47
mov rax, r8
sub rax, rsi
cmp rax, 1
jb 0x18004b5b6
lea r12, [rsi + 1]
mov r14, qword [rbp - 0x40]
mov rdi, r12
or rdi, 7
cmp rdi, r8
jbe 0x18004ae96
mov rdi, r8
jmp 0x18004aeb7
mov rcx, r14
shr rcx, 1
mov rax, r8
sub rax, rcx
cmp r14, rax
jbe 0x18004aeac
mov rdi, r8
jmp 0x18004aeb7
lea rax, [r14 + rcx]
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp - 0x58]
call fcn.180013350
mov r15, rax
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], rdi
add rsi, rsi
mov r8, rsi
mov rcx, rax
cmp r14, 8
jb 0x18004af29
mov rdi, qword [rbp - 0x58]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsi + r15], 0x2e
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x18004af1f
add rdx, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x18004b5a8
mov rdi, rcx
mov rcx, rdi
call fcn.180067650
jmp 0x18004af3a
lea rdx, [rbp - 0x58]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsi + r15], 0x2e
mov edi, dword [rsp + 0x48]
mov r12d, dword [rsp + 0x60]
mov qword [rbp - 0x58], r15
mov byte [rsp + 0x38], 0x69
mov r8d, 3
lea rdx, [0x18008db60]
lea rcx, [rbp - 0x58]
call fcn.180013450
mov rsi, qword [rsp + 0x50]
jmp 0x18004b3e0
mov r8d, 1
lea rdx, [0x18008e3ab]
lea rcx, [rbp + 0x19]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x1a], 0
jmp 0x18004b3e0
mov r8d, 1
lea rdx, [0x18008e3c0]
lea rcx, [rbp + 0x17]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x18], 0
mov r8d, 1
lea rdx, str.invalid_reuse_of_CPackWixFragment_Id:
lea rcx, [rbp + 0x18]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x19], 0
jmp 0x18004b3e0
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rcx, qword [rbp - 0x58]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rbp - 0x78], rax
jmp 0x18004b3e0
mov r8d, 5
lea rdx, [0x18008e4ac]
lea rcx, [rbp + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0xd], 0
mov r8d, 5
lea rdx, [0x18008e4d2]
lea rcx, [rbp + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, dword [0x18008e4f1]
mov dword [rbp + 0x12], eax
movzx eax, byte [0x18008e4f5]
mov byte [rbp + 0x16], al
jmp 0x18004b3e0
mov byte [rbp + 0x17], 0
jmp case.0x18004ae3d.4
movsx edx, byte [rsp + 0x38]
lea rcx, [rbp + 8]
call qword [sym.imp.SHLWAPI.dll_StrChrA]
cmp qword [rbp - 0x78], 0
jne 0x18004b3e0
mov edi, ILClone
nop dword [rax + rax]
cmp edi, 0x11
ja case.default.0x18004b076
mov eax, edi
mov ecx, dword [r15 + rax*4 + 0x4b5e0]
add rcx, r15
jmp rcx
mov r8d, 4
lea rdx, [0x18008e4fc]
lea rcx, [rbp - 0x37]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp case.default.0x18004b076
mov qword [rbp - 0x60], r13
mov dword [rsp + 0x64], r13d
jmp case.default.0x18004b076
mov eax, 0x6565
mov word [rbp + 0x43], ax
jmp case.default.0x18004b076
mov edx, 0x2e
mov word [rbp + 0x4a], dx
jmp 0x18004b241
mov eax, 0x64
mov word [rbp + 0x3c], ax
mov dword [rbp + 0x3d], 0x647261
jmp case.default.0x18004b076
mov byte [rsp + 0x39], 1
jmp case.default.0x18004b076
mov eax, 0x69
mov word [rbp + 0x4b], ax
mov eax, 0x696e
mov word [rbp + 0x4c], ax
mov byte [rbp + 0x4e], 0
jmp case.default.0x18004b076
mov eax, dword [str.ferD]
mov dword [rbp - 0x29], eax
movzx eax, byte [0x18008e504]
mov byte [rbp - 0x25], al
jmp case.default.0x18004b076
lea rcx, [rbp - 0x38]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x18004b117
mov eax, dword [0x18008e508]
mov dword [rcx], eax
jmp case.default.0x18004b076
mov dword [rbp + 0x45], 0x696464
mov eax, 0x6c61
mov word [rbp + 0x48], ax
jmp case.default.0x18004b076
mov qword [rbp - 0x70], 0xffffffff80000001
jmp case.default.0x18004b076
mov eax, 0x6e
mov word [rbp + 0x3b], ax
jmp case.default.0x18004b076
mov eax, dword [str.Name]
mov dword [rbp - 0x31], eax
movzx eax, word [0x18008e514]
mov word [rbp - 0x2d], ax
movzx eax, byte [0x18008e516]
mov byte [rbp - 0x2b], al
lea rax, [rbp - 0x38]
dec rax
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x18004b182
movzx ecx, word [0x18008e518]
mov word [rax], cx
movzx ecx, byte [0x18008e51a]
mov byte [rax + 2], cl
jmp case.default.0x18004b076
mov byte [rbp - 0x38], 0
mov r8d, 1
lea rdx, [0x18008e51c]
lea rcx, [rbp - 0x38]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp case.default.0x18004b076
mov r9d, dword [rsp + 0x64]
lea r8, [rbp + 0x38]
lea rdx, [rbp - 0x38]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.SHLWAPI.dll_SHOpenRegStream2A]
mov qword [rbp - 0x80], rax
mov edx, 0x2e
cmp rax, 0
jne 0x18004b241
mov byte [rsp + 0x39], al
jmp 0x18004b241
mov r8d, 6
lea rdx, str.ata__
lea rcx, [rbp - 0x25]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov ecx, 0x73
mov word [rbp + 0x38], cx
mov eax, 0x74
mov word [rbp + 0x39], ax
mov eax, 0x61
mov word [rbp + 0x3a], ax
jmp case.default.0x18004b076
mov eax, 0x5f
mov word [rbp + 0x40], ax
mov eax, 0x73
mov word [rbp + 0x41], ax
mov eax, 0x70
mov word [rbp + 0x42], ax
mov edx, 0x2e
dec edi
lea eax, [rdi + 0x10]
cmp eax, 0xf
ja 0x18004b060
mov edi, dword [rsp + 0x48]
jmp 0x18004b3e5
mov rsi, qword [r14 + 0x10]
mov rdi, r14
cmp qword [r14 + 0x18], 8
jb 0x18004b269
mov rdi, qword [r14]
cmp rsi, 8
jae 0x18004b282
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x38], xmm0
mov r15d, 7
mov r13, qword [rbp - 0x38]
jmp 0x18004b2c1
mov r15, rsi
or r15, 7
cmp r15, r8
cmova r15, r8
lea rdx, [r15 + 1]
lea rcx, [rbp - 0x38]
call fcn.180013350
mov r13, rax
mov qword [rbp - 0x38], rax
lea r8, [rsi*2 + 2]
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movabs r8, 0x7ffffffffffffffe
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x28], rsi
lea r14, [rbp - 0x38]
cmp r15, 8
cmovae r14, r13
cmp rsi, 8
jae 0x18004b2e9
movups xmm0, xmmword [r14]
mov qword [rbp], 7
jmp 0x18004b323
mov rdi, rsi
or rdi, 7
cmp rdi, r8
cmova rdi, r8
lea rdx, [rdi + 1]
lea rcx, [rbp - 0x18]
call fcn.180013350
mov qword [rbp - 0x18], rax
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp], rdi
movups xmm0, xmmword [rbp - 0x18]
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp - 8], rsi
mov rcx, qword [rbp - 0x40]
cmp rcx, 8
jb 0x18004b36b
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004b366
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004b5a1
call fcn.180067650
movups xmm0, xmmword [rbp + 0x38]
movups xmmword [rbp - 0x58], xmm0
movups xmm0, xmmword [rbp - 8]
movups xmmword [rbp - 0x48], xmm0
cmp r15, 8
jb 0x18004b3b6
lea rdx, [r15*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x18004b3ae
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004b5a8
mov rcx, r13
call fcn.180067650
mov rsi, qword [rsp + 0x50]
mov rdx, qword [rsi]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x18004b3c5
lea rcx, [rbp - 0x58]
call fcn.180013450
mov edi, dword [rsp + 0x48]
xor r13d, r13d
mov edx, 0x2e
movabs r8, 0x7ffffffffffffffe
dec edi
mov dword [rsp + 0x48], edi
dec r12d
mov dword [rsp + 0x60], r12d
cmp edi, 0x103
mov r14, qword [rsp + 0x78]
lea r15, [0x180000000]
ja 0x18004ae25
mov rcx, qword [rbp - 0x40]
cmp rcx, 8
jb 0x18004b455
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004b450
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004b5af
call fcn.180067650
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
add rsi, 8
mov qword [rsp + 0x50], rsi
cmp eax, 3
mov r14, qword [rsp + 0x78]
lea r15, [0x180000000]
mov edx, 0x2e
movabs r8, 0x7ffffffffffffffe
jb 0x18004ae00
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
mov edi, dword [rsp + 0x40]
mov rsi, qword [rbp - 0x68]
lea r15, [0x180000000]
mov ecx, 0x73
lea edx, [rcx - 0x45]
movabs r8, 0x7ffffffffffffffe
lea r9, [0x1800643e0]
movabs r10, 0x3300790061
lea r11, str.libeay32
imul eax, dword [rsp + 0x6c], 0x87
add edi, eax
mov dword [rsp + 0x40], edi
cmp edi, dword [rsp + 0x70]
jbe 0x18004aa80
movzx eax, bl
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.180067b60
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0xbe
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.1800295c0
xor al, al
jmp 0x18004b4ea
cmp byte [rsp + 0x39], 0
je 0x18004b54c
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
call qword [rax + reloc.SHELL32.dll_ILFindLastID]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.SHELL32.dll_DragFinish]
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x18004b59a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004b595
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004b595
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180067650
xor al, al
jmp 0x18004b4ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.180012d20
int3