Function at 0x18002a7b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x938
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x50], 0
lea rdx, [rsp + 0x62c]
lea rcx, [rsp + 0x46]
call fcn.18002b3a0
mov rcx, rax
call fcn.18002bc30
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18002a821
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x18002b317
mov eax, 2
imul rax, rax, 0
mov ecx, 0x22
mov word [rsp + rax + 0x720], cx
mov dword [rsp + 0x60], 0x206
lea rdx, [rsp + 0x410]
lea rcx, [rsp + 0x38]
call fcn.18002b3d0
mov rcx, rax
call fcn.18002a060
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x722]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18002a8ba
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x18002b317
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x720]
lea rcx, [rsp + 0x3f0]
call fcn.1800056f0
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xa8], rax
lea r8, [0x180140ea4]
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0x1d8]
call fcn.180007f20
nop
lea rcx, [rsp + 0x3f0]
call fcn.180005580
lea rdx, [rsp + 0x3d0]
lea rcx, [rsp + 0x39]
call fcn.18002b470
mov rcx, rax
call fcn.18002bbf0
mov rdx, rax
lea rcx, [rsp + 0x2f0]
call fcn.1800056f0
nop
lea rcx, [rsp + 0x2f0]
call fcn.1800c34b0
nop
lea rcx, [rsp + 0x2f0]
call fcn.180005580
lea rdx, [rsp + 0x45c]
lea rcx, [rsp + 0x3a]
call fcn.18002b510
mov rcx, rax
call fcn.18002bbb0
mov rdx, rax
lea rcx, [rsp + 0x310]
call fcn.1800056f0
nop
lea rcx, [rsp + 0x310]
call fcn.1800c34b0
nop
lea rcx, [rsp + 0x310]
call fcn.180005580
lea rdx, [rsp + 0x558]
lea rcx, [rsp + 0x3b]
call fcn.18002b5b0
mov rcx, rax
call fcn.18002bb70
mov rdx, rax
lea rcx, [rsp + 0x2d0]
call fcn.1800056f0
nop
lea rcx, [rsp + 0x2d0]
call fcn.1800c34b0
nop
lea rcx, [rsp + 0x2d0]
call fcn.180005580
lea rdx, [rsp + 0x5e0]
lea rcx, [rsp + 0x3c]
call fcn.18002b650
mov rcx, rax
call fcn.18002bb30
mov rdx, rax
lea rcx, [rsp + 0x3b0]
call fcn.1800056f0
nop
lea rcx, [rsp + 0x3b0]
call fcn.1800c34b0
nop
lea rcx, [rsp + 0x3b0]
call fcn.180005580
lea rdx, [rsp + 0x448]
lea rcx, [rsp + 0x3d]
call fcn.18002b510
mov rcx, rax
call fcn.18002bbb0
mov rdx, rax
lea rcx, [rsp + 0x350]
call fcn.1800056f0
nop
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x350]
call fcn.1800c3240
movzx eax, al
test eax, eax
jne 0x18002ab20
lea rdx, [rsp + 0x57a]
lea rcx, [rsp + 0x3e]
call fcn.18002b5b0
mov rcx, rax
call fcn.18002bb70
mov rdx, rax
lea rcx, [rsp + 0x370]
call fcn.1800056f0
nop
mov eax, dword [rsp + 0x30]
or eax, 2
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x370]
call fcn.1800c3240
movzx eax, al
test eax, eax
jne 0x18002ab20
lea rdx, [rsp + 0x606]
lea rcx, [rsp + 0x3f]
call fcn.18002b650
mov rcx, rax
call fcn.18002bb30
mov rdx, rax
lea rcx, [rsp + 0x390]
call fcn.1800056f0
nop
mov eax, dword [rsp + 0x30]
or eax, 4
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x390]
call fcn.1800c3240
movzx eax, al
test eax, eax
jne 0x18002ab20
mov dword [rsp + 0x48], 1
jmp 0x18002ab28
mov dword [rsp + 0x48], 0
movzx eax, byte [rsp + 0x48]
mov byte [rsp + 0x35], al
mov eax, dword [rsp + 0x30]
and eax, 4
test eax, eax
je 0x18002ab4f
and dword [rsp + 0x30], 0xfffffffb
lea rcx, [rsp + 0x390]
call fcn.180005580
nop
mov eax, dword [rsp + 0x30]
and eax, 2
test eax, eax
je 0x18002ab6d
and dword [rsp + 0x30], 0xfffffffd
lea rcx, [rsp + 0x370]
call fcn.180005580
nop
mov eax, dword [rsp + 0x30]
and eax, 1
test eax, eax
je 0x18002ab8a
and dword [rsp + 0x30], 0xfffffffe
lea rcx, [rsp + 0x350]
call fcn.180005580
movzx eax, byte [rsp + 0x35]
test eax, eax
je 0x18002ab95
jmp 0x18002abc2
mov dword [rsp + 0x64], 0x64
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x280]
call fcn.18002c1c0
mov rcx, rax
call fcn.18002c1e0
xor eax, eax
cmp eax, 1
jne 0x18002a91c
lea rax, [rsp + 0x488]
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0x40]
call fcn.1800053b0
mov qword [rsp + 0xb0], rax
lea rdx, [rsp + 0x422]
lea rcx, [rsp + 0x41]
call fcn.18002b680
mov rcx, rax
call fcn.18002a060
mov rdx, rax
lea rcx, [rsp + 0x2a8]
call fcn.1800056f0
nop
lea rax, [rsp + 0x2c8]
mov r8, rax
lea rdx, [rsp + 0x2a8]
lea rcx, [rsp + 0x3e0]
call fcn.180005c50
lea rcx, [rsp + 0x240]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x250]
lea rcx, [rsp + 0x240]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0xb0]
lea rdx, [rsp + 0x250]
mov rcx, qword [rsp + 0xb8]
call fcn.18001dfc0
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0xe0], rax
lea rax, [rsp + 0x4b8]
mov qword [rsp + 0xd0], rax
lea rdx, [rsp + 0x1d8]
mov rcx, qword [rsp + 0xd0]
call fcn.180005750
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xe8], rax
lea r8, [rsp + 0x1c0]
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe8]
call fcn.1800c3090
movzx eax, al
test eax, eax
jne 0x18002ad11
mov dword [rsp + 0x4c], 1
jmp 0x18002ad19
mov dword [rsp + 0x4c], 0
movzx eax, byte [rsp + 0x4c]
mov byte [rsp + 0x36], al
lea r9, [fcn.180005580]
mov r8d, 1
mov edx, 0x20
lea rcx, [rsp + 0x2a8]
call fcn.1800dbfd8
movzx eax, byte [rsp + 0x36]
test eax, eax
je 0x18002ad84
mov rcx, qword [rsp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x68], 1
lea rcx, [rsp + 0x1d8]
call fcn.180005580
mov eax, dword [rsp + 0x68]
jmp 0x18002b317
lea rdx, [rsp + 0x59c]
lea rcx, [rsp + 0x42]
call fcn.18002b5b0
mov rcx, rax
call fcn.18002bb70
mov rdx, rax
lea rcx, [rsp + 0x330]
call fcn.1800056f0
nop
lea rcx, [rsp + 0x330]
call fcn.1800c3240
mov byte [rsp + 0x37], al
lea rcx, [rsp + 0x330]
call fcn.180005580
movzx eax, byte [rsp + 0x37]
test eax, eax
je 0x18002adf4
mov dword [rsp + 0x6c], 1
lea rcx, [rsp + 0x1d8]
call fcn.180005580
mov eax, dword [rsp + 0x6c]
jmp 0x18002b317
mov ecx, 0x98
call fcn.1800dbf60
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x18002af2e
lea rax, [rsp + 0x4d8]
mov qword [rsp + 0xf0], rax
lea rdx, [0x180140ea8]
mov rcx, qword [rsp + 0xf0]
call fcn.1800056f0
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0x4f8]
mov qword [rsp + 0x108], rax
lea rdx, [0x180140eac]
mov rcx, qword [rsp + 0x108]
call fcn.1800056f0
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x138], rax
lea rax, [rsp + 0x518]
mov qword [rsp + 0x120], rax
lea rdx, [rsp + 0x434]
lea rcx, [rsp + 0x43]
call fcn.18002b510
mov rcx, rax
call fcn.18002bbb0
mov rdx, rax
mov rcx, qword [rsp + 0x120]
call fcn.1800056f0
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x140], rax
mov r9, qword [rsp + 0x130]
mov r8, qword [rsp + 0x138]
mov rdx, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x80]
call fcn.18003a9f0
mov qword [rsp + 0x88], rax
jmp 0x18002af3a
mov qword [rsp + 0x88], 0
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x1c0]
mov rcx, qword [rsp + 0x58]
call fcn.18003adb0
mov edx, dword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x58]
call fcn.18003add0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
add rax, 0x7530
mov qword [rsp + 0x150], rax
mov byte [rsp + 0x34], 0
xor eax, eax
cmp eax, 1
je 0x18002afff
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, qword [rsp + 0x150]
jbe 0x18002afac
jmp 0x18002afff
lea rdx, [rsp + 0x5be]
lea rcx, [rsp + 0x44]
call fcn.18002b6b0
mov rcx, rax
call fcn.18002bb70
xor r8d, r8d
mov rdx, rax
mov ecx, dword [rsp + 0x1d0]
call fcn.1800c1220
mov qword [rsp + 0x158], rax
cmp qword [rsp + 0x158], 0
je 0x18002aff2
mov byte [rsp + 0x34], 1
jmp 0x18002afff
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18002af93
movzx eax, byte [rsp + 0x34]
test eax, eax
jne 0x18002b026
mov dword [rsp + 0x70], 0x405f
lea rcx, [rsp + 0x1d8]
call fcn.180005580
mov eax, dword [rsp + 0x70]
jmp 0x18002b317
mov r8d, 0x23c00
lea rdx, [0x1803297c0]
lea rcx, [rsp + 0x1f8]
call fcn.1800c0670
nop
lea rax, [rsp + 0x470]
mov qword [rsp + 0x160], rax
lea rdx, [rsp + 0x1f8]
mov rcx, qword [rsp + 0x160]
call fcn.1800052b0
mov qword [rsp + 0x168], rax
mov rdx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x58]
call fcn.18003ad30
lea rcx, [rsp + 0x1f8]
call fcn.18000dc80
call fcn.18001d8b0
mov rdx, rax
lea rcx, [rsp + 0x660]
call fcn.18002b6e0
nop
call fcn.18001d8b0
mov dword [rax + 0x28], 0
call fcn.18001d8b0
mov dword [rax + 0x24], 1
call fcn.18001d8b0
mov dword [rax + 0x20], 1
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.18001dd80
mov qword [rsp + 0x170], rax
lea rdx, [rsp + 0x260]
mov rcx, qword [rsp + 0x170]
call fcn.18001dd30
nop
lea r8, str.vcs2.dll
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x210]
call fcn.180007e50
nop
lea rcx, [rsp + 0x45]
call fcn.1800053b0
mov qword [rsp + 0x188], rax
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x210]
call fcn.1800054b0
mov rax, qword [rax]
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x190], rax
lea rdx, [rsp + 0x238]
lea rcx, [rsp + 0x210]
call fcn.180005520
mov rax, qword [rax]
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x198], rax
mov r9, qword [rsp + 0x188]
mov r8, qword [rsp + 0x190]
mov rdx, qword [rsp + 0x198]
lea rcx, [rsp + 0x288]
call fcn.1800084c0
nop
lea rax, [rsp + 0x4a0]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x58]
call fcn.18003adf0
mov rdx, rax
mov rcx, qword [rsp + 0x1a0]
call fcn.1800052b0
mov qword [rsp + 0x1a8], rax
mov rdx, qword [rsp + 0x1a8]
lea rcx, [rsp + 0x210]
call fcn.1800c7d30
lea rax, [rsp + 0x538]
mov qword [rsp + 0x1b0], rax
lea rdx, [rsp + 0x288]
mov rcx, qword [rsp + 0x1b0]
call fcn.180005b50
mov qword [rsp + 0x1b8], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x58]
call fcn.1800295b0
mov dword [rsp + 0x74], eax
call fcn.18001d8b0
lea rdx, [rsp + 0x660]
mov rcx, rax
call fcn.18002b930
cmp dword [rsp + 0x74], 0
je 0x18002b2b8
call fcn.18002a7b0
mov dword [rsp + 0x78], eax
lea rcx, [rsp + 0x288]
call fcn.1800059c0
nop
lea rcx, [rsp + 0x210]
call fcn.180005580
nop
lea rcx, [rsp + 0x260]
call fcn.180005580
nop
lea rcx, [rsp + 0x660]
call fcn.18002b900
nop
lea rcx, [rsp + 0x1f8]
call fcn.180005290
nop
lea rcx, [rsp + 0x1d8]
call fcn.180005580
mov eax, dword [rsp + 0x78]
jmp 0x18002b317
mov dword [rsp + 0x7c], 0
lea rcx, [rsp + 0x288]
call fcn.1800059c0
nop
lea rcx, [rsp + 0x210]
call fcn.180005580
nop
lea rcx, [rsp + 0x260]
call fcn.180005580
nop
lea rcx, [rsp + 0x660]
call fcn.18002b900
nop
lea rcx, [rsp + 0x1f8]
call fcn.180005290
nop
lea rcx, [rsp + 0x1d8]
call fcn.180005580
mov eax, dword [rsp + 0x7c]
add rsp, 0x938
pop rdi
pop rsi
ret