Function at 0x1800c8220
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x810]
sub rsp, 0x910
mov rax, qword [0x180143ae0]
xor rax, rsp
mov qword [rbp + 0x800], rax
xor edi, edi
mov qword [rsp + 0x58], rdx
mov r14d, r8d
mov qword [rsp + 0x68], rcx
lea eax, [r8 + 0xd]
mov r15, rdx
lea rdx, [0x180000000]
lea r8d, [rdi + 0x2e]
cmp r14d, eax
jae 0x1800c8409
lea ebx, [r14 - 0x12]
movabs rsi, 0x5f003200730077
lea edi, [r8 - 0x21]
lea r12d, [r8 + 5]
lea r15d, [r8 + 0x18]
cmp ebx, 0x18
ja case.0x1800c82a7.1
mov ecx, dword [rdx + rbx*4 + 0xc8848]
add rcx, rdx
jmp rcx
mov dword [rbp + 0x3a6], 0x734944
jmp case.0x1800c82a7.1
mov dword [rbp + 0x3d2], 0x2e0032
jmp case.0x1800c82a7.1
mov r8d, 1
lea rdx, [0x18012f188]
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
lea rdx, [0x180000000]
mov word [rbp + 0x3a5], r15w
mov r8d, PathMakeUniqueName
jmp case.0x1800c82a7.1
mov dword [rbp + 0x3cc], 0x5f0032
jmp case.0x1800c82a7.1
mov eax, dword [0x180132402]
mov dword [rbp + 0x3bc], eax
movzx eax, word [0x180132406]
mov word [rbp + 0x3c0], ax
xor eax, eax
mov word [rbp + 0x3c2], ax
jmp case.0x1800c82a7.1
lea rcx, str.calc___A_simple_calculator_based_on_stack._nCopyright__C__2014__Zhang_Hai._nPowered_by_zhclib._n_nThis_program_comes_with_ABSOLUTELY_NO_WARRANTY._nThis_is_free_software__and_you_are_welcome_to_redistribute_it_nunder_GNU_General_Public_License_v3.0._n_nPress__Enter__to_evaluate_an_expression__nEnter_an_empty_line_to_quit._n_n
call fcn.18000b7c0
lea rdx, [0x180000000]
mov r8d, PathMakeUniqueName
jmp case.0x1800c82a7.1
xor eax, eax
mov qword [rbp + 0x3b0], rsi
mov word [rbp + 0x3b8], ax
jmp case.0x1800c82a7.1
mov word [rbp + 0x3d0], r12w
jmp case.0x1800c82a7.1
xor eax, eax
mov dword [rbp + 0x3b8], 0x320033
mov word [rbp + 0x3bc], ax
jmp case.0x1800c82a7.1
lea rax, [rbp + 0x3a0]
dec rax
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x1800c8391
mov ecx, dword [0x18012a3e0]
mov dword [rax], ecx
jmp case.0x1800c82a7.1
mov r8d, 1
lea rdx, [0x1801325c6]
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
lea rdx, [0x180000000]
mov r8d, PathMakeUniqueName
jmp case.0x1800c82a7.1
mov eax, dword [str.__WS]
mov dword [rbp + 0x3a0], eax
movzx eax, byte [0x1801325f4]
mov byte [rbp + 0x3a4], al
jmp case.0x1800c82a7.1
mov dword [rbp + 0x3c8], 0x730077
inc ebx
sub rdi, 1
jne 0x1800c8294
mov r15, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
movzx ebx, byte [rsp + 0x40]
mov esi, r14d
imul r13d, r14d, 0x2d8
cmp r14d, r13d
ja 0x1800c880f
mov r12, qword [rsp + 0x70]
mov edx, 0x64
nop dword [rax + rax]
cmp esi, 0x28cf
ja 0x1800c8561
je 0x1800c8534
cmp esi, 0x1477
ja 0x1800c84a6
je 0x1800c8486
cmp esi, 0x1f
je 0x1800c847d
cmp esi, 0x6e7
je 0x1800c8471
cmp esi, 0xdaf
jne 0x1800c84fa
mov word [rbp + 0x3dc], di
jmp 0x1800c84fa
mov dword [rbp + 0x3d8], 0x6c006c
jmp 0x1800c84fa
mov word [rbp + 0x3d6], dx
jmp 0x1800c84fa
mov r9d, 0x78
lea r8, [rbp + 0x3a0]
lea rdx, [rbp + 0x3b0]
xor ecx, ecx
call fcn.180097890
mov r12, rax
jmp 0x1800c84f5
cmp esi, 0x1b3f
je 0x1800c8515
cmp esi, 0x2207
jne 0x1800c84fa
mov rax, qword [r15]
cmp rax, 0xffffffffffffffff
je 0x1800c85a4
mov qword [rsp + 0x38], rdi
lea r9, [rsp + 0x50]
mov dword [rsp + 0x30], 0x71
lea rdx, [rbp + 0x190]
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x50], rax
xor ecx, ecx
call fcn.180044380
mov edx, 0x64
imul eax, r14d, 0x38
add esi, eax
cmp esi, r13d
ja 0x1800c880f
mov rcx, qword [rsp + 0x68]
xor edi, edi
jmp 0x1800c8430
mov r9d, 0x78
lea rdx, [rbp + 0x3c8]
xor ecx, ecx
lea r8d, [r9 - 0x66]
call fcn.180097890
mov qword [rsp + 0x78], rax
jmp 0x1800c84f5
mov rax, qword [r15]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x38], rdi
lea rdx, [rbp - 0x80]
mov dword [rsp + 0x30], 0x71
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x50], rax
jmp 0x1800c84ee
cmp esi, 0x43ef
ja 0x1800c87fb
je 0x1800c85e5
cmp esi, 0x2f97
je 0x1800c85d5
cmp esi, 0x365f
je 0x1800c85ab
cmp esi, 0x3d27
jne 0x1800c84fa
cmp dword [rsp + 0x44], 0xffffffff
je 0x1800c85a4
mov rcx, qword [r15]
lea rdx, [rbp - 0x80]
call r12
test eax, eax
je 0x1800c84f5
xor al, al
jmp 0x1800c8812
mov ecx, dword [r15]
lea rax, [rsp + 0x60]
inc ecx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
xor r8d, r8d
lea rdx, [rbp + 0x190]
call qword [rsp + 0x78]
mov dword [rsp + 0x44], eax
jmp 0x1800c84f5
mov eax, dword [rcx]
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x60], eax
jmp 0x1800c84fa
mov rcx, qword [r15]
lea rdx, [rbp + 0x190]
call r12
test eax, eax
je 0x1800c84f5
nop word [rax + rax]
cmp edi, 0x15
ja case.default.0x1800c861c
lea rdx, [0x180000000]
mov eax, edi
mov ecx, dword [rdx + rax*4 + 0xc88ac]
add rcx, rdx
jmp rcx
mov eax, 0x72
mov dword [rbp + 0x406], 0x730065
mov word [rbp + 0x404], ax
jmp case.default.0x1800c861c
xor eax, eax
mov dword [rsp + 0x48], eax
jmp case.default.0x1800c861c
mov qword [rsp + 0x70], 0xffffffff80000001
jmp case.default.0x1800c861c
mov dword [rbp + 0x3f2], 0x61006c
jmp case.default.0x1800c861c
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
xor eax, eax
lea r8, [rbp + 0x5f0]
lea rdx, [rbp + 0x3e0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
jmp case.default.0x1800c861c
mov r8d, 1
lea rdx, [0x180124330]
lea rcx, [rbp + 0x5f0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov dword [rbp + 0x5fe], 0x20
jmp case.default.0x1800c861c
mov dword [rbp + 0x3fe], 0x610065
jmp case.default.0x1800c861c
mov eax, dword [0x1801325fc]
mov dword [rbp + 0x5f0], eax
movzx eax, word [0x180132600]
mov word [rbp + 0x5f4], ax
jmp case.default.0x1800c861c
mov eax, 0x74
mov dword [rbp + 0x3e4], 0x640075
mov word [rbp + 0x3e8], ax
jmp case.default.0x1800c861c
mov r8d, 2
lea rdx, [0x180132604]
lea rcx, [rbp + 0x5f6]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp case.default.0x1800c861c
mov dword [rbp + 0x3e0], 0x630069
jmp case.default.0x1800c861c
mov dword [rbp + 0x3ee], 0x2f006c
jmp case.default.0x1800c861c
mov eax, PathMakeUniqueName
mov word [rbp + 0x402], ax
jmp case.default.0x1800c861c
mov eax, 0x65
mov dword [rbp + 0x5f8], 0x6e
mov dword [rbp + 0x5fa], eax
jmp case.default.0x1800c861c
mov r8d, 6
lea rdx, [0x180132608]
lea rcx, [rbp + 0x5f0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
movabs rax, 0x4400490020
mov qword [rbp + 0x60c], rax
jmp case.default.0x1800c861c
mov eax, reloc.SHELL32.dll_PathMakeUniqueName
mov word [rbp + 0x3fa], ax
jmp case.default.0x1800c861c
mov eax, 0x61
mov dword [rbp + 0x5f4], eax
jmp case.default.0x1800c861c
mov dword [rbp + 0x3f6], 0x67006e
jmp case.default.0x1800c861c
xor eax, eax
mov word [rbp + 0x40a], ax
jmp case.default.0x1800c861c
mov dword [rbp + 0x3ea], 0x310035
jmp case.default.0x1800c861c
mov eax, 0x6b
mov word [rbp + 0x3fc], ax
inc edi
lea eax, [rdi + 0x125]
cmp eax, 0x13b
jb 0x1800c8600
jmp 0x1800c84f5
cmp esi, 0x4ab7
je 0x1800c883c
cmp esi, 0x517f
jne 0x1800c84fa
movzx eax, bl
mov rcx, qword [rbp + 0x800]
xor rcx, rsp
call fcn.1800c9c10
mov rbx, qword [rsp + 0x960]
add rsp, 0x910
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov bl, 1
jmp 0x1800c84fa
mov al, 2
jmp 0x1800c8812