Function at 0x18003c0e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r14, rdx
lea rax, [rsp + 0x40]
mov rbp, r8
lea rdx, str.Software7_zip
xor r12d, r12d
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18003c35d
mov rbx, qword [rsp + 0x40]
lea ecx, [rax + 8]
call fcn.180077f70
lea r9, [rsp + 0x34]
xor r8d, r8d
mov word [rax], r12w
mov r13, rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov rdx, r14
mov rcx, rbx
mov esi, r12d
mov dword [rsp + 0x34], r12d
mov dword [rsp + 0xa8], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or r15, 0xffffffffffffffff
mov r11d, eax
test eax, eax
je 0x18003c192
cmp eax, 0xea
jne 0x18003c24f
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x30], eax
cmp eax, 3
jbe 0x18003c1ec
cmp eax, 0x40000000
jb 0x18003c1c3
lea rdx, [0x18010cca8]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x38], 0x13329ad
call fcn.1800797b8
int3
lea ecx, [rax + 1]
mov eax, 2
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.180077f70
mov rcx, r13
mov word [rax], r12w
mov rdi, rax
call fcn.18007702c
mov r13, rdi
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r14
mov rcx, rbx
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x3c], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0xa8]
mov r11d, eax
mov eax, dword [rsp + 0x30]
cmp ecx, eax
cmova ecx, eax
mov dword [rsp + 0xa8], ecx
mov eax, ecx
shr rax, 1
mov word [r13 + rax*2], r12w
cmp word [r13], si
je 0x18003c24f
mov rax, r13
add rax, 2
inc esi
cmp word [rax], r12w
jne 0x18003c243
test r11d, r11d
jne 0x18003c347
lea rax, [rsp + 0x48]
cmp rax, rbp
je 0x18003c2a7
cmp esi, dword [rbp + 0xc]
jbe 0x18003c291
lea ecx, [rsi + 1]
mov eax, 2
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.180077f70
mov rcx, qword [rbp]
mov rdi, rax
call fcn.18007702c
mov qword [rbp], rdi
mov dword [rbp + 0xc], esi
mov rcx, qword [rbp]
lea r8d, [rsi + 1]
mov rdx, r13
add r8, r8
mov dword [rbp + 8], esi
call fcn.1800785c0
mov rcx, rbp
call fcn.1800399f0
cmp word [str.7z.dll], r12w
je 0x18003c2cd
lea rcx, str.7z.dll
add rcx, 2
inc r12d
cmp word [rcx], 0
jne 0x18003c2c0
mov edi, dword [rbp + 8]
mov rsi, qword [rbp]
mov eax, 2
lea r8d, [r12 + rdi + 1]
mul r8
cmovo rax, r15
mov rcx, rax
call fcn.180077f70
add rdi, rdi
mov rdx, rsi
mov rcx, rax
mov r8, rdi
mov rbp, rax
call fcn.1800785c0
lea r8d, [r12 + 1]
lea rcx, [rdi + rbp]
lea rdx, str.7z.dll
add r8, r8
call fcn.1800785c0
mov rcx, rbp
call fcn.18002ee70
mov rcx, rbp
movzx edi, al
call fcn.18007702c
mov rcx, r13
call fcn.18007702c
test rbx, rbx
je 0x18003c342
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, dil
jmp 0x18003c35f
mov rcx, r13
call fcn.18007702c
test rbx, rbx
je 0x18003c35d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret