Function at 0x18002ef20
Capabilities:
Encode data using base64
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c58]
mov eax, 0x1d58
call fcn.18006ce90
sub rsp, rax
imul eax, r8d, 0x6ce
mov r10, r9
mov rsi, rdx
mov dword [rsp + 0x60], r8d
mov r14, rcx
mov edi, r8d
mov dword [rbp - 0x38], eax
cmp r8d, eax
ja 0x18002fc9c
mov r13, qword [rsp + 0x78]
lea r11, [0x180000000]
mov r15, qword [rsp + 0x58]
xor ebx, ebx
mov r12, qword [rsp + 0x68]
movabs rdx, 0xaaaaaaaaaaaaaaab
mov eax, 2
cmp edi, 0x4cfe
ja 0x18002f339
je 0x18002f2e2
cmp edi, 0x121
ja 0x18002f0f4
je 0x18002f044
mov eax, edi
sub eax, 0x40
je 0x18002f025
sub eax, 0x52
je 0x18002eff7
cmp eax, 0x3b
jne 0x18002fc83
mov ecx, 0xfffffe5c
mov qword [rbp + 0x13b2], rbx
lea rdx, [rbp + 0xe60]
call qword [0x1800ce8f0]
jmp 0x18002fc6b
mov qword [rsp + 0x70], rbx
mov r15, rbx
mov qword [rbp - 0x30], rbx
mov r12, rbx
mov qword [rsp + 0x58], rbx
mov r13, rbx
mov qword [rbp - 0x58], rbx
mov qword [rsp + 0x68], rbx
mov qword [rbp - 0x80], rbx
mov qword [rsp + 0x78], rbx
jmp 0x18002fc83
mov rcx, qword [r14]
mov rax, rdx
dec rcx
mul rcx
shr rdx, 1
lea rax, [rdx*4 + 4]
mov qword [r10], rax
jmp 0x18002fc79
xor edx, edx
lea rcx, [rbp + 0x220]
mov r8d, 0x104
call fcn.18006e5e0
lea rcx, [rbp]
mov edx, 2
lea rax, [rbp + 0x220]
nop dword [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x18002f070
mov eax, dword [rax]
lea rdx, [rbp]
mov dword [rcx], eax
mov ecx, 0x104
mov qword [rbp - 0x60], rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, str.Matrix3DConverter
mov edx, 0x104
lea rcx, [rbp]
call fcn.180071490
jmp 0x18002fc6b
cmp edi, 0x21c0
je 0x18002f184
cmp edi, 0x4340
jne 0x18002fc83
mov rcx, qword [r14]
mov rax, rdx
mul rcx
mov r8d, ebx
mov r9, rbx
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rcx, rax
cmp dword [r11 + rcx*4 + 0xb5040], 0
jle 0x18002f177
mov rbx, qword [rbp - 0x28]
movabs rsi, 0xaaaaaaaaaaaaaaab
nop
mov rax, qword [r10]
inc r8d
sub rax, r9
inc r9
mov byte [rax + rbx - 1], 0x3d
mov rax, rsi
mov rcx, qword [r14]
mul rcx
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rcx, rax
cmp r8d, dword [r11 + rcx*4 + 0xb5040]
jl 0x18002f140
mov rsi, qword [rbp + 0x1ca8]
xor ebx, ebx
mov rcx, rsi
call fcn.180072184
jmp 0x18002fc6b
mov rcx, qword [r10]
call fcn.18007218c
mov qword [rbp - 0x28], rax
mov r11, rax
test rax, rax
je 0x18002fcb4
cmp qword [r14], 0
mov edx, ebx
mov r8, rbx
mov r9, rbx
jbe 0x18002fc6b
mov edi, dword [rbp - 0x50]
lea r12, [0x180000000]
mov r15d, dword [rbp - 0x64]
mov r13d, dword [rbp - 0x68]
mov r10d, 0xe9
nop word [rax + rax]
mov eax, r10d
sub eax, 0xe9
je 0x18002f28c
sub eax, 1
je 0x18002f273
sub eax, 1
je 0x18002f21c
sub eax, 1
je 0x18002f214
cmp eax, 1
jne 0x18002f2a3
mov eax, edi
and eax, 0x3f
movzx eax, byte [rax + r12 + 0xb5000]
mov byte [r9 + r11], al
inc r9
jmp 0x18002f2a3
mov eax, edi
shr rax, 6
jmp 0x18002f1fc
movsxd rax, edx
cmp rax, qword [r14]
jae 0x18002f230
movzx eax, byte [r8 + rsi]
inc edx
inc r8
jmp 0x18002f232
mov eax, ebx
mov edi, r15d
shl edi, 8
add edi, r13d
shl edi, 8
add edi, eax
mov eax, edi
shr rax, 0x12
and eax, 0x3f
mov ecx, edi
shr rcx, 0xc
and ecx, 0x3f
movzx eax, byte [rax + r12 + 0xb5000]
mov byte [r9 + r11], al
movzx eax, byte [rcx + r12 + 0xb5000]
mov byte [r9 + r11 + 1], al
add r9, 2
jmp 0x18002f2a3
movsxd rax, edx
cmp rax, qword [r14]
jae 0x18002f287
movzx r13d, byte [r8 + rsi]
inc edx
inc r8
jmp 0x18002f2a3
mov r13d, ebx
jmp 0x18002f2a3
movsxd rax, edx
cmp rax, qword [r14]
jae 0x18002f2a0
movzx r15d, byte [r8 + rsi]
inc edx
inc r8
jmp 0x18002f2a3
mov r15d, ebx
inc r10d
cmp r10d, 0xee
jb 0x18002f1d0
movsxd rax, edx
mov dword [rbp - 0x68], r13d
mov dword [rbp - 0x64], r15d
mov dword [rbp - 0x50], edi
cmp rax, qword [r14]
jb 0x18002f1c0
mov edi, dword [rsp + 0x60]
mov r13, qword [rsp + 0x78]
mov r15, qword [rsp + 0x58]
mov r12, qword [rsp + 0x68]
jmp 0x18002fc6b
xor edx, edx
lea rcx, [rbp + 0x1450]
mov r8d, 0x800
call fcn.18006e5e0
xor edx, edx
lea rcx, [rbp + 0x660]
mov r8d, 0x800
call fcn.18006e5e0
mov eax, 1
lea r8, [rsp + 0x50]
mov word [rsp + 0x50], ax
lea rdx, [rbp - 0x58]
mov rax, qword [rsi]
mov ecx, 0x42
mov qword [rbp - 0x58], rax
call fcn.180018420
cdqe
mov qword [rbp - 0x58], rax
jmp 0x18002fc6b
cmp edi, 0x996a
ja 0x18002f42b
je 0x18002f384
cmp edi, 0x64c0
je 0x18002fcc9
cmp edi, 0x6c1b
je 0x18002fcb9
cmp edi, 0x9867
jne 0x18002fc83
lea rdx, [0x18009879c]
lea rcx, [rbp]
call fcn.180074404
mov qword [rbp - 0x60], rax
jmp 0x18002fc6b
mov word [rsp + 0x50], ax
lea r8, [rsp + 0x50]
mov rax, qword [rsi]
lea rdx, [rsp + 0x58]
mov r9d, 0x53
mov qword [rsp + 0x58], rax
lea rcx, [rbp + 0x1450]
call fcn.18002dab0
mov eax, 3
lea r8, [rbp - 0x48]
mov word [rbp - 0x48], ax
lea rdx, [rsp + 0x58]
mov rax, qword [rsi]
lea rcx, [rbp + 0x660]
mov r9d, 0x53
mov qword [rsp + 0x58], rax
call fcn.18002dab0
mov rax, qword [rbp - 0x58]
xor r9d, r9d
mov qword [rsp + 0x58], rax
xor edx, edx
lea rax, [rsp + 0x58]
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0x67]
call fcn.180051020
lea rcx, [rbp - 0x80]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0x1450]
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movsxd r15, eax
mov qword [rsp + 0x58], r15
jmp 0x18002fc6b
cmp edi, 0xe5d6
je 0x18002f46a
cmp edi, 0x12fad
jne 0x18002fc83
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x18002fc83
lea rdx, str.Locked_n
call fcn.18006ab80
mov rcx, qword [rbp - 0x60]
call fcn.18007412c
mov qword [rbp - 0x60], rbx
jmp 0x18002fc6b
test r15, r15
jne 0x18002fc22
mov rcx, qword [rbp - 0x80]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rbp + 0x660]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd r15, eax
mov qword [rsp + 0x58], r15
test eax, eax
jne 0x18002fc22
mov eax, dword [rbp - 0x40]
dec eax
cmp eax, 6
ja case.0x18002f4c9.6
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x2fcd0]
add rcx, rdx
jmp rcx
mov edi, 0x54
mov eax, edi
sub eax, 0x52
je case.0x18002f4c9.6
sub eax, 1
je 0x18002f500
cmp eax, 1
jne 0x18002f582
mov rcx, qword [rsp + 0x70]
call fcn.18007218c
mov r13, rax
mov qword [rsp + 0x78], rax
jmp 0x18002f582
mov rcx, qword [rbp - 0x80]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x660]
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd r15, eax
mov qword [rsp + 0x58], r15
test eax, eax
jne 0x18002f57a
mov eax, dword [rsp + 0x70]
lea r9, [rsp + 0x50]
mov dword [rsp + 0x60], eax
lea rcx, [rsp + 0x68]
mov eax, 4
mov r8, r13
mov word [rsp + 0x50], ax
mov edx, 0xb3
mov rax, qword [rsi]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.180037b90
mov eax, 1
mov r12d, eax
mov qword [rsp + 0x68], rax
mov rcx, r13
call fcn.180072184
dec edi
cmp edi, 0x51
ja 0x18002f4d0
mov edi, 0xdb
mov eax, edi
sub eax, 0xdb
je 0x18002f600
sub eax, 1
je 0x18002f5ae
cmp eax, 1
je case.0x18002f4c9.6
jmp 0x18002f63c
test r15, r15
jne 0x18002f63c
mov eax, dword [rbp - 0x3c]
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], eax
lea rcx, [rsp + 0x68]
mov eax, 4
mov r9d, 0xd9
mov word [rsp + 0x50], ax
xor edx, edx
mov rax, qword [rsi]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.180028370
mov eax, 1
mov r12d, eax
mov qword [rsp + 0x68], rax
jmp 0x18002f63c
mov rcx, qword [rbp - 0x80]
lea rdx, [rbp + 0x660]
mov eax, 4
xor r9d, r9d
mov qword [rsp + 0x70], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd r15, eax
mov qword [rsp + 0x58], r15
inc edi
cmp edi, 0xde
jb 0x18002f592
mov edi, 0x2e
nop
mov eax, edi
sub eax, 0x2e
je 0x18002f710
sub eax, 1
je 0x18002f680
sub eax, 1
je 0x18002f673
cmp eax, 1
je case.0x18002f4c9.6
jmp 0x18002f750
mov rcx, r13
call fcn.180072184
jmp 0x18002f750
test r15, r15
jne 0x18002f750
mov qword [rsp + 0x40], rbx
lea r9, [rsp + 0x78]
mov qword [rsp + 0x38], rbx
lea r8d, [r15 + 0x7d]
mov qword [rsp + 0x30], rbx
xor edx, edx
mov qword [rsp + 0x28], rbx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.1800604b0
mov r13, qword [rsp + 0x78]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rax + r13], 0
jne 0x18002f6c0
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x68]
mov eax, 4
lea rcx, [rsp + 0x60]
mov word [rbp - 0x70], ax
mov r9d, 0x2f
mov rax, qword [rsi]
mov r8, r13
mov qword [rsp + 0x68], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
call fcn.1800203b0
mov eax, 1
mov r12d, eax
mov qword [rsp + 0x68], rax
jmp 0x18002f750
mov rcx, qword [rsp + 0x70]
call fcn.18007218c
mov rcx, qword [rbp - 0x80]
lea rdx, [rbp + 0x660]
mov r13, rax
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd r15, eax
mov qword [rsp + 0x58], r15
inc edi
cmp edi, 0x32
jb 0x18002f650
mov r12d, 0xe5
cmp r12d, 0xe5
je 0x18002f79a
cmp r12d, 0x947e
jne 0x18002fae8
mov rcx, r13
call fcn.180072184
mov r12, qword [rsp + 0x68]
mov edi, 0xe5d6
mov r14, qword [rbp + 0x1ca0]
mov r15, qword [rsp + 0x58]
jmp 0x18002fc22
mov rcx, qword [rsp + 0x70]
call fcn.18007218c
mov r14d, 4
mov qword [rsp + 0x78], rax
mov r13, rax
mov word [rsp + 0x50], r14w
mov rax, qword [rsi]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x58], rax
lea r9d, [r14 + 0x43]
lea rcx, [rbp + 0x220]
call fcn.180015320
mov edi, 2
lea rcx, [rbp + 0x550]
mov edx, edi
nop dword [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x18002f7f0
mov rax, qword [rax]
mov rdx, rdi
mov qword [rcx], rax
lea rcx, [rbp + 0x110]
lea rax, [rbp + 0x550]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x18002f860
mov eax, dword [rax]
lea rdx, [rbp + 0x660]
mov dword [rcx], eax
xor r9d, r9d
mov rcx, qword [rbp - 0x80]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cdqe
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x18002fae8
mov r15d, 0xb7
cmp r15d, 0xb7
je 0x18002fb2c
cmp r15d, 0x44a0
je 0x18002f9e0
cmp r15d, 0x8889
je 0x18002f9d1
cmp r15d, 0xcc72
jne 0x18002fad4
lea rcx, [rbp + 0x330]
mov rdx, rdi
lea rax, [rbp + 0x110]
nop dword [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x18002f940
mov eax, dword [rax]
lea r9, [rbp - 0x78]
mov dword [rcx], eax
lea r8, [rbp + 0x330]
mov rax, qword [rsi]
lea rcx, [rsp + 0x60]
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x50]
mov byte [rsp + 0x50], dl
mov edx, 0x26
mov qword [rsp + 0x20], rax
mov word [rsp + 0x60], r14w
call fcn.18005fbb0
jmp 0x18002fad4
mov eax, 1
mov qword [rsp + 0x68], rax
jmp 0x18002fad4
mov eax, 1
mov rsi, r13
mov r14d, eax
cmp rax, qword [rbp - 0x30]
jg 0x18002fac7
lea ebx, [rax + 1]
nop dword [rax + rax]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], 0
jne 0x18002fa07
lea rdx, [rbp + 0x440]
mov rcx, rbx
lea rax, [rbp + 0x110]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x18002fa21
mov ecx, dword [rax]
lea r8, [rsp + 0x60]
mov dword [rdx], ecx
lea rax, [rbp + 0x440]
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 0x220]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x60], rdi
mov r9, rsi
mov qword [rsp + 0x20], rax
mov edx, 0xa5
mov qword [rbp - 0x78], r14
call fcn.18003b5b0
inc rsi
inc r14
add rsi, rdi
cmp r14, qword [rbp - 0x30]
jle 0x18002fa00
xor ebx, ebx
lea edi, [rbx + 2]
mov rsi, qword [rbp + 0x1ca8]
mov r14d, 4
add r15d, 0x43e9
cmp r15d, 0x10fa4
jbe 0x18002f8f3
add r12d, 0x9399
cmp r12d, 0x12732
jbe 0x18002f761
mov r12, qword [rsp + 0x68]
mov edi, 0xbb
mov r14d, 1
nop dword [rax]
mov eax, edi
sub eax, 0xbb
je 0x18002fb74
sub eax, r14d
je 0x18002fb67
cmp eax, r14d
je 0x18002fc03
jmp 0x18002fbf5
xor edx, edx
mov r9, r13
xor r8d, r8d
lea ecx, [rdx + 0x1f]
call fcn.180061190
mov r9d, 0xb6
mov qword [rbp - 0x30], rax
lea r8, [rbp + 0x110]
mov dword [rsp + 0x60], eax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call fcn.180034b90
jmp 0x18002fad4
mov rcx, r13
call fcn.180072184
jmp 0x18002fbf5
mov rcx, qword [rsp + 0x70]
call fcn.18007218c
mov rcx, qword [rbp - 0x80]
lea rdx, [rbp + 0x660]
mov r13, rax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rbx, eax
mov qword [rsp + 0x58], rbx
test eax, eax
jne 0x18002fbf5
mov rax, qword [rsp + 0x70]
lea rdx, [rbp - 0x78]
dec rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x78], rax
mov r9d, 0x2f
mov eax, 4
mov r8, r13
mov word [rsp + 0x60], ax
mov rax, qword [rsi]
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.1800203b0
mov r12, r14
inc edi
cmp edi, 0xbe
jb 0x18002fb10
mov r14, qword [rbp + 0x1ca0]
xor ebx, ebx
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x68], r12
mov r15, qword [rsp + 0x58]
mov edi, 0xe5d6
jmp 0x18002fc22
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsi]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x40], rbx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov qword [rbp - 0x78], rax
xor edx, edx
lea rax, [rbp - 0x78]
mov dword [rsp + 0x60], r12d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x28
call fcn.180036ed0
mov r10, qword [rbp + 0x1cb8]
lea r11, [0x180000000]
movabs rdx, 0xaaaaaaaaaaaaaaab
imul eax, dword [rbp + 0x1cb0], 0x86
add edi, eax
mov dword [rsp + 0x60], edi
cmp edi, dword [rbp - 0x38]
jbe 0x18002ef9b
mov rax, qword [rbp - 0x78]
add rsp, 0x1d58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, rbx
jmp 0x18002fca0
mov rax, qword [rbp + 0x13b2]
mov word [0x1800ce8f8], bx
jmp 0x18002fca0
mov rax, qword [rbp - 0x28]
jmp 0x18002fca0