Function at 0x18000fff0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x180059178]
xor rax, rsp
mov qword [rbp + 0x38], rax
lea edi, [rcx + rcx*8]
mov qword [rbp - 0x78], rdx
shl edi, 2
mov r15, rdx
mov dword [rsp + 0x4c], ecx
mov r14d, ecx
mov ebx, ecx
cmp ecx, edi
ja 0x1800101e4
lea esi, [rcx + rcx*2]
mov edx, 0x7365
mov ecx, 0x5f
mov r10d, 0x7672
mov r9d, 0x756c
lea eax, [rcx - 0xd]
lea r12d, [rcx + 6]
lea r13d, [rcx + 0x15]
lea r11d, [rcx + 0xa]
lea r8d, [rcx + 0x10]
nop dword [rax]
cmp ebx, 0x261
ja 0x180010176
je 0x18001016c
cmp ebx, 0x62
ja 0x180010142
je 0x180010122
cmp ebx, 0xe
je 0x180010106
cmp ebx, 0x38
je 0x1800100bd
cmp ebx, 0x57
jne 0x1800101da
mov r13d, 0x73
mov word [rbp - 0x60], r13w
lea r13d, [rbx + 0x1d]
mov word [rbp - 0x5f], r12w
jmp 0x1800101da
mov r8d, 4
mov dword [rbp - 0x3a], 0x61684365
lea rdx, [0x18004e33b]
mov byte [rbp - 0x36], 0
lea rcx, [rbp - 0x36]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp - 0x32], 0
mov ecx, 0x5f
mov edx, 0x7365
mov r9d, 0x756c
mov r10d, 0x7672
lea r8d, [rcx + 0x10]
lea r11d, [rcx + 0xa]
jmp 0x1800101d5
mov eax, dword [0x18004e3b6]
mov dword [rbp - 0x3f], eax
movzx eax, byte [0x18004e3ba]
mov byte [rbp - 0x3b], al
mov byte [rbp - 0x40], 0x4d
jmp 0x1800101d5
mov r8d, 3
lea rdx, [0x18004e393]
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov dword [rbp - 0x2f], 0x327472
jmp 0x1800100e3
mov eax, ebx
sub eax, 0xf6
je 0x180010166
cmp eax, 0x66
jne 0x1800101d5
mov word [rbp - 0x5e], r13w
mov word [rbp - 0x5d], cx
mov dword [rbp - 0x5c], 0x65707954
jmp 0x1800101d5
and dword [r15], 0xffffffdf
jmp 0x1800101d5
mov word [rbp - 0x58], ax
mov word [rbp - 0x57], dx
jmp 0x1800101da
mov eax, ebx
sub eax, 0x366
je 0x1800101cb
sub eax, 0x72
je 0x1800101c5
sub eax, 0x93
je 0x1800101b7
sub eax, 0x105
je 0x1800101b0
cmp eax, 0x105
jne 0x1800101d5
mov eax, 0x63
mov dword [rbp - 0x4c], 0x697672
mov word [rbp - 0x49], ax
mov word [rbp - 0x48], r12w
jmp 0x1800101d5
mov word [rbp - 0x4d], r12w
jmp 0x1800101d5
mov word [rbp - 0x52], r13w
mov dword [rbp - 0x51], 0x536e6f69
jmp 0x1800101d5
or dword [r15], 0x10
jmp 0x1800101d5
mov word [rbp - 0x55], r8w
mov word [rbp - 0x54], r9w
mov eax, 0x52
add ebx, esi
cmp ebx, edi
jbe 0x180010070
movzx ebx, byte [rsp + 0x44]
mov esi, r14d
imul eax, r14d, 0x589
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x48], eax
cmp r14d, eax
ja 0x1800105df
movzx r12d, word [rsp + 0x44]
xor r8d, r8d
mov r13d, dword [rsp + 0x48]
mov r14d, dword [rsp + 0x48]
movzx edi, byte [rsp + 0x40]
mov byte [rsp + 0x44], bl
cmp esi, 0x1ddc
ja 0x1800104cf
je 0x180010360
cmp esi, 0xbfa
ja 0x1800102f6
je 0x1800102c5
cmp esi, 0xe
je 0x180010272
cmp esi, 0x57
je 0x180010265
cmp esi, 0x604
jne 0x1800105ca
mov word [rbp + 6], r8w
jmp 0x1800105ca
mov qword [rbp - 0x68], 0xffffffff80000001
jmp 0x1800105ca
mov word [rbp - 8], r8w
lea rdx, [0x18004e468]
mov r8d, 3
lea rcx, [rbp - 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, dword [0x18004e500]
lea rdx, [0x18004e580]
mov dword [rbp - 2], eax
lea rcx, [rbp + 4]
movzx eax, word [0x18004e504]
mov word [rbp + 2], ax
xor eax, eax
mov word [rbp + 4], ax
lea r8d, [rax + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor r8d, r8d
jmp 0x1800105ca
movsd xmm0, qword [0x18004e688]
movzx eax, word [0x18004e690]
mov byte [rsp + 0x40], 1
movzx edi, byte [rsp + 0x40]
movsd qword [rbp + 6], xmm0
mov word [rbp + 0xe], ax
mov word [rbp + 0x10], r8w
mov byte [rsp + 0x41], 1
jmp 0x1800105ca
cmp esi, 0x11f0
je 0x180010345
cmp esi, 0x17e6
jne 0x1800105ca
mov eax, dword [rsp + 0x58]
lea r9, [rsp + 0x70]
mov edx, dword [rsp + 0x54]
lea rcx, [rbp - 0x40]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHLWAPI.dll_SHRegOpenUSKeyA]
mov rcx, qword [rbp - 0x80]
lea rdx, [rsp + 0x78]
mov r13d, eax
call sub.IMM32.dll_ImmGetStatusWindowPos
mov dword [rsp + 0x5c], eax
xor r8d, r8d
jmp 0x1800105ca
mov qword [rbp - 0x80], r8
mov dword [rsp + 0x54], 0xf003f
mov qword [rsp + 0x78], r8
mov dword [rsp + 0x58], r8d
jmp 0x1800105ca
mov edx, 0xb8
lea r9, [rbp - 8]
xor ecx, ecx
lea r8d, [rdx - 1]
call fcn.180008a80
movzx ecx, byte [rsp + 0x41]
xor r8d, r8d
test r13d, r13d
mov qword [rbp - 0x70], rax
mov edx, r8d
cmove edx, ecx
cmp dword [rsp + 0x5c], r8d
mov byte [rsp + 0x41], dl
mov edx, r8d
movzx ecx, dil
cmovne edx, ecx
mov byte [rsp + 0x40], dl
cmp byte [rsp + 0x41], r8b
je 0x1800104c5
mov edi, 0x98
lea r15d, [r8 + 0x3e]
lea ebx, [rdi - 0x5c]
lea esi, [rdi - 0x2a]
nop word [rax + rax]
mov eax, edi
sub eax, 0x98
je 0x18001046a
sub eax, 1
je 0x18001044b
sub eax, 1
je 0x180010442
sub eax, 1
je 0x180010415
cmp eax, 1
jne 0x1800104aa
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x60]
movzx edx, r12w
lea r8, [rbp - 0x28]
mov dword [rsp + 0x20], r14d
call qword [sym.imp.SHLWAPI.dll_SHRegEnumUSKeyA]
mov rcx, qword [rsp + 0x70]
mov r13d, eax
call qword [sym.imp.SHLWAPI.dll_SHRegCloseUSKey]
jmp 0x1800104a7
mov word [rbp - 0x11], r15w
lea rcx, [rbp - 0x28]
mov r12d, r8d
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180010430
mov dword [rsp + 0x60], eax
mov r14d, r8d
jmp 0x1800104aa
mov dword [rbp - 0x14], 0x656d61
jmp 0x1800104aa
mov eax, dword [str.ayNa]
mov dword [rbp - 0x1d], eax
mov eax, dword [str.me__n]
mov dword [rbp - 0x19], eax
movzx eax, word [0x18004e648]
mov word [rbp - 0x15], ax
jmp 0x1800104aa
mov word [rbp - 0x28], bx
lea rdx, str.ame_Di
mov r8d, 7
mov word [rbp - 0x27], si
lea rcx, [rbp - 0x26]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, 0x73
mov word [rbp - 0x20], ax
movzx eax, word [0x18004e654]
mov word [rbp - 0x1f], ax
movzx eax, byte [0x18004e656]
mov byte [rbp - 0x1d], al
xor r8d, r8d
inc edi
cmp edi, 0x9d
jb 0x1800103c0
movzx ebx, byte [rsp + 0x44]
mov esi, dword [rsp + 0x50]
mov r15, qword [rbp - 0x78]
movzx edi, byte [rsp + 0x40]
jmp 0x1800105ca
cmp esi, 0x4a6d
ja 0x180010567
je 0x180010561
cmp esi, 0x23d2
je 0x18001053c
cmp esi, 0x2562
je 0x180010502
cmp esi, 0x29c8
je 0x1800105df
jmp 0x1800105ca
mov qword [r15 + 0x10], r8
movzx eax, word [0x18004e638]
movups xmm0, xmmword [str.BFD_RELOC_FRV_TLSOFF_RELAX]
mov word [rbp + 0x30], ax
movzx eax, byte [0x18004e63a]
movsd xmm1, qword [0x18004e630]
mov byte [rbp + 0x32], al
movups xmmword [rbp + 0x18], xmm0
mov qword [r15 + 0x18], r8
movsd qword [rbp + 0x28], xmm1
jmp 0x1800105ca
test dil, dil
je 0x18001054f
mov rcx, qword [rbp - 0x80]
lea rdx, [rsp + 0x78]
call sub.IMM32.dll_ImmSetStatusWindowPos
call qword [rbp - 0x70]
cmp eax, 1
sete bl
xor r8d, r8d
mov byte [rsp + 0x44], bl
jmp 0x1800105ca
mov qword [r15 + 0x20], r8
jmp 0x1800105ca
cmp esi, 0x6f78
je 0x1800105b0
cmp esi, 0x9483
jne 0x1800105ca
mov r9d, dword [rsp + 0x64]
lea rax, [rsp + 0x6c]
mov rcx, qword [rbp - 0x68]
lea rdx, [rbp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], r8
lea r8, [rbp - 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueA]
xor r8d, r8d
mov qword [r15 + 0x38], r8
jmp 0x1800105ca
mov dword [rsp + 0x64], reloc.SHELL32.dll_ILFindLastID
mov dword [r15 + 0x28], r8d
mov dword [rsp + 0x68], r8d
mov qword [r15 + 0x30], r8
mov dword [rsp + 0x6c], r8d
imul eax, dword [rsp + 0x4c], 0x6d
add esi, eax
mov dword [rsp + 0x50], esi
cmp esi, dword [rsp + 0x48]
jbe 0x180010221
movzx eax, bl
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.1800461b0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret