Function at 0x180004750
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1c0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1801a3080]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rsi, rdx
mov r15, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdx
xor r12d, r12d
mov dword [rsp + 0x34], r12d
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r12w
xor r8d, r8d
lea rdx, [0x180152244]
lea rcx, [rsp + 0x78]
call fcn.18000c0a0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rsp + 0x68], xmm1
mov word [rsp + 0x58], r12w
lea r8d, [r12 + 6]
lea rdx, str.CLSID_
lea rcx, [rsp + 0x58]
call fcn.18000c0a0
nop
mov r9, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004813
mov r9, qword [rsi]
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x18000485b
lea rdi, [rdx + rcx]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp r8, 8
cmovae rbx, qword [rsp + 0x58]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.1800fe030
mov word [rbx + rdi*2], r12w
jmp 0x18000486a
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x58]
call fcn.18000cac0
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x48]
call fcn.18000bd10
nop
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov rax, rdx
sub rax, rcx
cmp rax, 0xf
jb 0x1800048bf
lea rdi, [rcx + 0xf]
mov qword [rbp - 0x38], rdi
lea rbx, [rbp - 0x48]
cmp rdx, 8
cmovae rbx, qword [rbp - 0x48]
lea rcx, [rbx + rcx*2]
mov r8d, 0x1e
lea rdx, str.InProcServer32
call fcn.1800fe030
mov word [rbx + rdi*2], r12w
jmp 0x1800048dd
mov qword [rsp + 0x20], 0xf
lea r9, str.InProcServer32
mov edx, 0xf
lea rcx, [rbp - 0x48]
call fcn.18000cac0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x180004928
lea rdi, [rcx + 6]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
mov r8d, 0xc
lea rdx, str.Shell
call fcn.1800fe030
mov word [rbx + rdi*2], r12w
jmp 0x180004947
mov qword [rsp + 0x20], 6
lea r9, str.Shell
mov edx, 6
lea rcx, [rsp + 0x58]
call fcn.18000cac0
cmp qword [rsi + 0x10], 0
jne 0x180004a6d
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], 7
mov word [r15], r12w
xor r8d, r8d
lea rdx, [0x180152244]
mov rcx, r15
call fcn.18000c0a0
mov dword [rsp + 0x34], 1
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x1800049bc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800049b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000525c
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r12w
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x180004a10
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004a0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005262
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x180005208
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005203
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005256
jmp 0x180005203
mov qword [rsp + 0x38], r12
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov r14, 0xffffffffffffffff
test eax, eax
jne 0x180004d86
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp - 0x20]
call fcn.1800fe490
mov dword [rsp + 0x30], 0xc6
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x180004bb6
cmp word [rbp - 0x20], ax
je 0x180004bb6
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180004b2e
lea rdi, [rcx + 1]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
lea r8d, [r14 + 3]
lea rdx, [0x180152320]
call fcn.1800fe030
mov word [rbx + rdi*2], r12w
jmp 0x180004b4d
mov qword [rsp + 0x20], 1
lea r9, [0x180152320]
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.18000cac0
lea rax, [rbp - 0x20]
mov rdx, r14
inc rdx
cmp word [rax + rdx*2], 0
jne 0x180004b54
mov rcx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x180004ba3
lea rdi, [rdx + rcx]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp r8, 8
cmovae rbx, qword [rsp + 0x58]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
lea rdx, [rbp - 0x20]
call fcn.1800fe030
mov word [rbx + rdi*2], r12w
jmp 0x180004bb6
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x20]
lea rcx, [rsp + 0x58]
call fcn.18000cac0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
lea rax, [rbp - 0x20]
mov r8, r14
inc r8
cmp word [rax + r8*2], 0
jne 0x180004be1
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x68]
call fcn.18000c0a0
nop
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp qword [rbp - 0x58], 0
ja 0x180004c63
cmp rax, 0xd
jb 0x180004c4c
lea rdi, [rcx + 0xd]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
mov r8d, 0x1a
lea rdx, str.opencommand
call fcn.1800fe030
mov word [rbx + rdi*2], r12w
jmp 0x180004cbd
mov qword [rsp + 0x20], 0xd
lea r9, str.opencommand
mov edx, 0xd
jmp 0x180004cb3
cmp rax, 8
jb 0x180004c9e
lea rdi, [rcx + 8]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
mov r8d, 0x10
lea rdx, str.command
call fcn.1800fe030
mov word [rbx + rdi*2], r12w
jmp 0x180004cbd
mov qword [rsp + 0x20], 8
lea r9, str.command
mov edx, 8
lea rcx, [rsp + 0x58]
call fcn.18000cac0
mov ecx, 0x802
call fcn.1800df488
mov rbx, rax
mov dword [rsp + 0x30], 0x800
test rax, rax
je 0x180004d35
xor edx, edx
mov r8d, 0x802
mov rcx, rax
call fcn.1800fe490
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
lea r9, [rsp + 0x30]
mov r8, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x180004d2c
mov r8, r14
inc r8
cmp word [rbx + r8*2], 0
jne 0x180004d14
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.18000c0a0
mov rcx, rbx
call fcn.1800dedc4
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x180004d75
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004d70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005268
call fcn.1800dedc4
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
cmp qword [rbp - 0x78], 0
ja 0x180004e10
mov ecx, 0x802
call fcn.1800df488
mov rbx, rax
mov dword [rsp + 0x30], 0x800
test rax, rax
je 0x180004e05
xor edx, edx
mov r8d, 0x802
mov rcx, rax
call fcn.1800fe490
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
lea r9, [rsp + 0x30]
mov r8, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x180004dfd
mov r8, r14
inc r8
cmp word [rbx + r8*2], 0
jne 0x180004de5
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.18000c0a0
mov rcx, rbx
call fcn.1800dedc4
cmp qword [rbp - 0x78], 0
jbe 0x180004fc4
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004e1d
mov rcx, qword [rsi]
lea rdx, str.2559A1F0_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fb0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004e40
mov rcx, qword [rsi]
lea rdx, str.2559A1F1_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fb0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004e63
mov rcx, qword [rsi]
lea rdx, str.2559A1F2_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fb0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004e86
mov rcx, qword [rsi]
lea rdx, str.2559A1F3_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fb0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004ea9
mov rcx, qword [rsi]
lea rdx, str.2559A1F5_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fb0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004ecc
mov rcx, qword [rsi]
lea rdx, str.2559A1F6_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fb0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004eef
mov rcx, qword [rsi]
lea rdx, str.2559A1F7_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fb0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004f12
mov rcx, qword [rsi]
lea rdx, str.871C5380_42A0_1069_A2EA_08002B30309D
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fb0
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str.http:
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fb0
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str.https:
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fb0
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str.www.
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180004fb0
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str..com
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180004fc4
xor r8d, r8d
lea rdx, [0x180152244]
lea rcx, [rsp + 0x78]
call fcn.18000c0a0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180004fd1
mov rcx, qword [rsi]
lea rdx, str.2559A1F4_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x1800050f7
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp - 0x58], xmm1
mov word [rbp - 0x68], r12w
mov ecx, 0x802
call fcn.1800df488
mov rbx, rax
mov dword [rsp + 0x30], 0x800
test rax, rax
je 0x180005072
xor edx, edx
mov r8d, 0x802
mov rcx, rax
call fcn.1800fe490
lea r9, [rsp + 0x30]
mov r8, rbx
lea rdx, str.SoftwareClientsStartMenuInternet
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x18000506a
nop dword [rax + rax]
inc r14
cmp word [rbx + r14*2], 0
jne 0x180005050
mov r8, r14
mov rdx, rbx
lea rcx, [rbp - 0x68]
call fcn.18000c0a0
mov rcx, rbx
call fcn.1800dedc4
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
lea rdx, [0x1801526b8]
call fcn.180100d08
test eax, eax
jne 0x1800050a5
xor r8d, r8d
lea rdx, [0x180152244]
lea rcx, [rsp + 0x78]
call fcn.18000c0a0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x1800050e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800050e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000526e
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp - 0x58], xmm0
mov word [rbp - 0x68], r12w
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [r15 + 0x10], xmm1
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r12w
mov dword [rsp + 0x34], 1
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x180005163
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000515e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005274
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r12w
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1800051b7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800051b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000527a
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x180005208
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005203
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005250
call fcn.1800dedc4
mov word [rsp + 0x78], r12w
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r12
mov rcx, rsi
call fcn.18000c030
mov rax, r15
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.1800deda0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.180103f88
int3
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
int3
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
int3