Function at 0x1800578b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x1804762b8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
movzx ebx, byte [rbp - 0x69]
lea esi, [rdx - 0x15]
xor edi, edi
mov r14, rcx
lea rcx, [0x180000000]
mov r15, r8
mov r13d, edx
cmp edx, esi
jbe 0x180057aa0
lea edi, [rdx - 0x89]
mov edx, 0x73
lea r8d, [rdx - 0x21]
lea r12d, [rdx - 0x14]
lea r9d, [rdx - 0x4b]
lea r10d, [rdx - 0x4a]
lea r11d, [rdx - 4]
cmp edi, 0x2c
ja case.default.0x180057944
movzx eax, byte [rcx + rdi + 0x57d20]
mov ecx, dword [rcx + rax*4 + 0x57cc8]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov word [rbp + 7], r8w
jmp case.0x180057944.21
mov eax, 0x43
mov word [rbp + 1], r12w
mov word [rbp + 2], ax
jmp case.0x180057944.21
mov word [rbp + 8], r12w
jmp case.0x180057944.21
mov r9, r15
xor r8d, r8d
xor edx, edx
mov ecx, 0x10e
call fcn.18008b610
mov edx, 0x73
lea r8d, [rdx - 0x21]
lea r9d, [rdx - 0x4b]
lea r10d, [rdx - 0x4a]
lea r11d, [rdx - 4]
jmp case.0x180057944.21
mov eax, 0x54
mov word [rbp + 0xb], ax
mov eax, 0x4c
mov word [rbp + 0xc], ax
jmp case.0x180057944.21
mov dword [rbp + 0xf], 0x730073
jmp case.0x180057944.21
mov dword [rbp - 0x13], 0x642520
mov word [rbp - 0x10], r9w
jmp case.0x180057944.21
movzx ebx, byte [r14]
jmp case.0x180057944.21
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
mov ecx, 0x112
call fcn.180081610
mov word [0x180472360], ax
jmp 0x18005797f
mov word [rbp - 0xd], r10w
jmp case.0x180057944.21
mov word [rbp - 0x17], r11w
jmp case.0x180057944.21
mov eax, 0x61
mov dword [rbp + 0x13], 0x65006c
mov word [rbp + 0x17], ax
jmp case.0x180057944.21
mov eax, 0x4552
mov word [rbp - 1], ax
jmp case.0x180057944.21
mov eax, 0x25
mov word [rbp - 0xf], ax
mov word [rbp - 0xe], dx
jmp case.0x180057944.21
mov eax, 0x4954
mov word [rbp + 9], ax
jmp case.0x180057944.21
mov eax, 0x256d
mov word [rbp - 0x16], ax
jmp case.0x180057944.21
mov dword [rbp - 9], 0x56444948
mov dword [rbp - 5], 0x505f4c4f
jmp case.0x180057944.21
mov eax, 0x49
mov word [rbp + 3], ax
mov dword [rbp + 4], 0x454850
jmp case.0x180057944.21
mov word [rbp - 0x14], dx
jmp case.0x180057944.21
mov eax, 0x45
mov word [rbp + 0xd], ax
mov eax, 0x6366
mov word [rbp - 0x19], ax
lea rcx, [0x180000000]
dec edi
lea eax, [rdi + 0x89]
cmp eax, esi
ja 0x180057922
xor edi, edi
lea r15d, [r13 + 0x16]
cmp r13d, r15d
jae case.0x180057944.1
mov r14, qword [rbp - 0x31]
lea esi, [r13 - 0xb5]
mov r12d, dword [rbp - 0x65]
mov edx, 0x6c
mov r11d, 0x33
lea r10d, [r11 - 5]
lea r9d, [r11 - 1]
lea r8d, [r11 + 0x46]
cmp esi, 0x15
ja case.default.0x180057aed
mov ecx, dword [rcx + rsi*4 + 0x57d50]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov word [rbp + 0x19], r8w
jmp case.default.0x180057aed
xor edx, edx
lea rax, [rbp + 0xf]
mov qword [rsp + 0x28], rax
mov r9d, 0xb7
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea ecx, [rdx + 0x3e]
call fcn.180062e10
mov r14, rax
mov dword [rbp - 0x61], 0xa
mov edx, 0x6c
jmp case.default.0x180057aed
mov dword [rbp - 0x5d], edi
jmp case.default.0x180057aed
mov ecx, r12d
call qword [sym.imp.GDI32.dll_GetStockObject]
mov edx, 0x6c
jmp case.default.0x180057aed
mov eax, dword [rbp - 0x39]
mov r9d, dword [rbp - 0x4d]
mov r8d, dword [rbp - 0x5d]
mov edx, dword [rbp - 0x65]
mov rcx, qword [rbp - 0x21]
mov dword [rsp + 0x50], eax
mov eax, dword [rbp - 0x61]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp - 0x59]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp - 0x51]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp - 0x45]
mov dword [rsp + 0x30], eax
mov rax, qword [rbp - 0x31]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x41]
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_GdiTransparentBlt]
mov r9d, dword [rbp - 0x55]
lea rax, [rbp - 0x3d]
mov rcx, qword [rbp - 0x29]
lea r8, [rbp - 0x19]
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 9]
lea rax, [rbp - 0x49]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueA]
mov edx, 0x6c
jmp case.default.0x180057aed
mov dword [rbp - 0x59], 0xa
jmp case.default.0x180057aed
mov edi, 0x10f
nop dword [rax]
mov eax, edi
sub eax, 0x10f
je 0x180057c1e
cmp eax, 1
jne 0x180057c27
movzx eax, bl
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1800e9340
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call r14
cmp eax, 1
sete bl
inc edi
cmp edi, 0x111
jb 0x180057be0
mov edx, 0x6c
mov dword [rbp + 0x21], 0x6c0064
jmp case.default.0x180057aed
mov word [rbp + 0x1d], r9w
jmp case.default.0x180057aed
mov dword [rbp - 0x55], 0x10
mov dword [rbp - 0x51], edi
jmp case.default.0x180057aed
mov qword [rbp - 0x29], 0xffffffff80000001
jmp case.default.0x180057aed
mov dword [rbp - 0x4d], 0xa
jmp case.default.0x180057aed
mov qword [rbp - 0x21], rdi
jmp case.default.0x180057aed
mov word [rbp + 0x1f], r10w
jmp case.default.0x180057aed
mov dword [rbp - 0x49], edi
jmp case.default.0x180057aed
mov word [rbp + 0x1b], r11w
jmp case.default.0x180057aed
mov dword [rbp + 0x25], 0x6c
jmp case.default.0x180057aed
mov qword [rbp - 0x31], rdi
jmp case.default.0x180057aed
mov dword [rbp - 0x45], edi
mov r12d, 4
jmp case.default.0x180057aed
mov dword [rbp - 0x41], 0xa
jmp case.default.0x180057aed
mov dword [rbp - 0x3d], edi
mov dword [rbp - 0x39], edi
jmp case.default.0x180057aed
mov dword [rbp - 0x65], edi
inc r13d
inc esi
cmp r13d, r15d
jae case.0x180057944.1
lea rcx, [0x180000000]
xor edi, edi
jmp 0x180057ac1