Function at 0x180043e10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x318]
sub rsp, 0x418
lea eax, [r9 - 0x10]
mov r11, r8
mov dword [rsp + 0x40], eax
mov r8, rdx
mov r10, rcx
cmp r9d, eax
jbe 0x1800445ca
movzx edi, byte [rbp + 0x378]
lea ebx, [r9 - 0x80]
mov r15, qword [rbp + 0x388]
lea rdx, [0x180000000]
mov r13d, dword [rbp + 0x378]
mov r9d, 1
mov rsi, qword [rbp - 0x78]
mov ecx, eax
mov r14d, dword [rbp + 0x378]
mov dword [rsp + 0x50], ebx
lea r12d, [r9 + 1]
mov qword [rbp - 0x68], rdi
cmp ebx, 0x21
ja case.default.0x180043ea6
mov ecx, dword [rdx + rbx*4 + 0x445e4]
add rcx, rdx
jmp rcx
cmp dword [r10], 0
mov edx, dword [r11]
jle 0x180043f8e
mov rdi, qword [rbp + 0x380]
nop dword [rax]
mov r9d, 0x71
mov eax, r9d
sub eax, 0x71
je 0x180043f34
sub eax, 0x35
je 0x180043f1a
sub eax, 0x35
je 0x180043f05
cmp eax, 0x35
jne 0x180043f69
movsxd rax, r13d
lea rcx, [0x180000000]
mov eax, dword [rcx + rax*4 + 0xd6250]
mov dword [r8], eax
add r8, 4
dec dword [r10]
mov qword [rbp + 0x368], r8
jmp 0x180043f69
cmp edx, dword [rdi]
jae 0x180043f69
mov rax, qword [r15]
mov ecx, edx
cmp byte [rcx + rax], 0x3a
jne 0x180043f69
or r13d, 2
jmp 0x180043f69
mov ecx, dword [rdi]
cmp edx, ecx
jae 0x180043f69
mov r8, qword [r15]
mov eax, edx
cmp byte [rax + r8], 0x2d
jne 0x180043f62
inc edx
cmp edx, ecx
jb 0x180043f23
jmp 0x180043f62
mov r8, qword [r15]
xor r13d, r13d
mov eax, edx
cmp byte [rax + r8], 0x2d
je 0x180043f4c
inc edx
cmp byte [rdx + r8], 0x2d
jne 0x180043f43
cmp edx, dword [r11]
jbe 0x180043f62
lea eax, [rdx - 1]
cmp byte [rax + r8], 0x3a
mov eax, 1
cmove r13d, eax
mov r8, qword [rbp + 0x368]
add r9d, 0x35
cmp r9d, 0x145
jb 0x180043ec6
cmp dword [r10], 0
jg 0x180043ec0
mov rdi, qword [rbp - 0x68]
mov r9d, 1
lea rdx, [0x180000000]
mov ecx, dword [rsp + 0x40]
dec ebx
mov dword [rsp + 0x50], ebx
lea eax, [rbx + 0x80]
cmp eax, ecx
jbe 0x1800445ca
mov r8, qword [rbp + 0x368]
jmp 0x180043e93
xor edx, edx
mov qword [rsp + 0x20], 0
mov eax, 3
lea r9, [rbp + 0x378]
mov word [rbp + 0x378], ax
lea rcx, [rsp + 0x58]
mov rax, qword [r15]
lea r8d, [rdx + 0x28]
mov qword [rsp + 0x58], rax
call fcn.180068730
mov rbx, rax
mov qword [rsp + 0x20], 0
xor edx, edx
lea r9, [rbp + 0x378]
mov eax, 4
lea rcx, [rsp + 0x58]
mov word [rbp + 0x378], ax
mov rax, qword [r15]
lea r8d, [rdx + 0x28]
mov qword [rsp + 0x58], rax
call fcn.180068730
mov r10, qword [rbp + 0x360]
mov r11, qword [rbp + 0x370]
movzx ecx, al
movzx eax, bl
mov ebx, dword [rsp + 0x50]
shl eax, 8
shl ecx, 0x10
or ecx, eax
movzx eax, dil
or ecx, eax
mov dword [rsp + 0x70], ecx
jmp 0x180043f88
lea r8, [rsp + 0x70]
mov ecx, r9d
lea rdx, [rbp - 0x78]
call qword [sym.imp.USER32.dll_SetSysColors]
mov r10, qword [rbp + 0x360]
lea rdx, [0x180000000]
mov r11, qword [rbp + 0x370]
mov r9d, 1
mov ecx, dword [rsp + 0x40]
movsxd r12, eax
mov qword [rbp - 0x80], r12
lea r12d, [r9 + 1]
test eax, eax
je case.default.0x180043ea6
mov qword [rbp - 0x80], r9
jmp case.default.0x180043ea6
mov rcx, qword [rbp - 0x70]
lea rax, [rsp + 0x68]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r10, qword [rbp + 0x360]
mov r11, qword [rbp + 0x370]
movsxd rsi, eax
jmp 0x180043f88
test rsi, rsi
jne 0x1800440f7
xor ecx, ecx
nop
movzx eax, byte [rbp + rcx + 0xc0]
mov byte [rbp + rcx + 0x160], al
lea rcx, [rcx + 1]
test al, al
jne 0x1800440e0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [str.Cannot_chown_content:_user__1_.500s__does_not_exist.]
mov r10, qword [rbp + 0x360]
movups xmm1, xmmword [0x1800a2948]
mov r11, qword [rbp + 0x370]
movsxd rsi, eax
mov eax, dword [0x1800a2968]
movaps xmmword [rbp - 0x50], xmm0
movups xmm0, xmmword [0x1800a2958]
mov dword [rbp - 0x20], eax
movzx eax, byte [0x1800a296c]
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm1
mov byte [rbp - 0x1c], al
jmp 0x180043f88
mov rcx, qword [rbp - 0x70]
lea rax, [rsp + 0x78]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x68], 0xffffffff80000001
lea rdx, [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne case.0x180043ea6.8
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rax, [rbp + 0xc0]
xor r8d, r8d
lea rdx, str.Device
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r10, qword [rbp + 0x360]
mov r11, qword [rbp + 0x370]
movsxd rsi, eax
jmp 0x180043f88
xor eax, eax
mov qword [rbp - 0x60], rax
jmp case.0x180043ea6.2
mov rax, qword [rbp - 0x80]
lea rdx, [rbp + 0x378]
mov dword [rbp + 0x378], eax
lea rcx, [rsp + 0x58]
mov rax, qword [r15]
mov r8d, 0x92
mov qword [rsp + 0x58], rax
call fcn.18004ff10
mov r10, qword [rbp + 0x360]
mov r11, qword [rbp + 0x370]
jmp 0x180043f88
test rsi, rsi
je case.0x180043ea6.2
mov rax, qword [rbp - 0x60]
jmp 0x1800445ce
xor r14d, r14d
mov dword [rsp + 0x48], r9d
jmp case.0x180043ea6.2
movups xmm0, xmmword [str.OpenCL_only._OpenCL_language_standard_to_compile_for]
mov eax, dword [0x1800a29b0]
movups xmm1, xmmword [0x1800a2990]
mov dword [rbp - 0x20], eax
movzx eax, byte [0x1800a29b4]
movaps xmmword [rbp - 0x50], xmm0
movups xmm0, xmmword [0x1800a29a0]
mov byte [rbp - 0x1c], al
movaps xmmword [rbp - 0x40], xmm1
movaps xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x70], 0xffffffff80000001
mov qword [rsp + 0x78], 0xffffffff80000001
jmp case.0x180043ea6.2
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0xc0]
mov dword [rsp + 0x44], 0x96
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x20]
lea rax, [rsp + 0x48]
mov edx, r14d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd r12, eax
cmp r12, 0x103
je 0x1800444f1
nop dword [rax]
mov esi, 0xe4
nop word [rax + rax]
mov eax, esi
sub eax, 0xe2
je 0x18004448f
sub eax, 1
je 0x18004447d
cmp eax, 1
jne 0x1800444d2
test r12, r12
jne 0x180044478
mov ebx, 0x34
nop dword [rax]
mov eax, ebx
sub eax, 0x33
je 0x18004435f
cmp eax, 1
jne 0x18004446d
lea eax, [r14 + 1]
mov r8d, 0xff
mov rdx, r15
mov dword [rbp + 0x378], eax
lea rcx, [rbp + 0x378]
call fcn.180020da0
lea rcx, [rbp + 0x20]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180044346
movzx eax, word [0x18009f47c]
mov word [rcx], ax
jmp 0x18004446d
lea rcx, [rbp + 0x20]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180044366
lea r8, [rbp + 0xc0]
xor edx, edx
nop dword [rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180044380
lea rax, [rbp + 0x20]
lea r8, [rbp + 0x160]
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800443b3
inc rax
test ecx, ecx
jne 0x1800443a0
test edx, edx
jne 0x1800443bf
lea eax, [r14 + 1]
mov qword [rbp - 0x60], rax
mov rcx, r15
lea rax, [rbp + 0x200]
mov edx, 2
nop
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x1800443d0
mov ecx, dword [rcx]
mov dword [rax], ecx
lea rcx, [rbp + 0x20]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180044432
lea ecx, [r14 + 1]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x58]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
mov edx, 0xeb
lea r8, [rbp + 0x200]
call fcn.180032ba0
dec ebx
cmp ebx, 0x32
ja 0x180044310
inc r14d
jmp 0x1800444d2
mov dword [rsp + 0x44], 0x96
mov dword [rsp + 0x4c], 0x96
jmp 0x1800444d2
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0xc0]
mov edx, r14d
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x20]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd r12, eax
dec esi
cmp esi, 0xe1
ja 0x1800442e0
cmp r12, 0x103
jne 0x1800442d0
mov ebx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r10, qword [rbp + 0x360]
mov r12d, 2
mov r11, qword [rbp + 0x370]
movsxd rsi, eax
jmp 0x180043f88
movdqa xmm0, xmmword [0x1800a3cb0]
movups xmmword [0x1800d6250], xmm0
jmp case.0x180043ea6.2
mov rax, qword [r15]
lea rcx, [rsp + 0x60]
xor edx, edx
mov word [rbp + 0x378], r9w
lea r9, [rbp + 0x378]
mov qword [rbp - 0x80], 0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x20], 0
lea r8d, [rdx + 0x28]
call fcn.180068730
movsxd rcx, eax
lea r9, [rbp + 0x378]
mov rax, qword [r15]
xor edx, edx
mov qword [rbp - 0x78], rcx
lea rcx, [rsp + 0x60]
mov word [rbp + 0x378], r12w
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 0x28]
mov qword [rsp + 0x20], 0
call fcn.180068730
mov r10, qword [rbp + 0x360]
mov rdi, rax
mov r11, qword [rbp + 0x370]
mov qword [rbp - 0x68], rax
jmp 0x180043f88
mov dword [rsp + 0x44], 0x96
mov dword [rsp + 0x4c], 0x96
jmp case.0x180043ea6.2
mov rax, qword [rbp - 0x78]
add rsp, 0x418
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret