Function at 0x1800403d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x1800624d0]
xor rax, rsp
mov qword [rbp + 0x340], rax
mov rax, qword [rbp + 0x3b0]
mov r14, r9
imul edi, ecx, 0x273
mov rsi, rdx
mov dword [rsp + 0x40], ecx
mov r15d, ecx
movzx ebx, word [rsp + 0x40]
mov qword [rbp - 0x68], r9
mov qword [rsp + 0x70], r8
mov qword [rbp - 0x28], rdx
mov dword [rbp - 0x54], ecx
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x50], edi
cmp ecx, edi
ja 0x180040bf9
movzx edi, byte [rsp + 0x50]
xor r9d, r9d
movzx r12d, word [rsp + 0x40]
mov ecx, 0x170
mov dword [rsp + 0x64], edi
mov r13d, 0xb0
mov word [rsp + 0x68], bx
cmp r15d, 0x3e40
ja 0x1800409b2
je 0x18004092e
cmp r15d, 0x1920
ja 0x18004085b
je 0x180040847
cmp r15d, 0x60
je 0x18004081f
cmp r15d, 0x76
je 0x1800407f0
cmp r15d, 0xcc0
je 0x1800407e0
cmp r15d, 0xfac
jne 0x180040993
lea r9, [rbp - 0x38]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
test eax, eax
movzx edi, dil
mov r9d, 0
lea rcx, [0x180040d90]
cmovne edi, r9d
mov qword [rsi], rcx
mov dword [rsp + 0x64], edi
test dil, dil
je 0x180040989
movzx ebx, byte [rsp + 0x50]
lea r13d, [r9 + 0xc]
mov r15d, dword [rbp - 0x70]
mov r14d, r9d
nop dword [rax + rax]
cmp r14d, 0xb
ja case.default.0x18004051e
lea rdx, [0x180000000]
mov eax, r14d
mov ecx, dword [rdx + rax*4 + 0x40d3c]
add rcx, rdx
jmp rcx
mov eax, 0x63
mov dword [rbp - 2], 0x490065
mov word [rbp - 4], ax
jmp case.default.0x18004051e
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je case.default.0x18004051e
call sub.RPCRT4.dll_MesHandleFree
jmp case.default.0x18004051e
mov dword [rbp + 0x10], 0x67006e
jmp case.default.0x18004051e
mov dword [rbp + 4], 0x650064
jmp case.default.0x18004051e
mov eax, 0x6e
mov word [rbp + 2], ax
jmp case.default.0x18004051e
mov dword [rsp + 0x20], r9d
lea rcx, [rbp - 0x18]
lea r9, [rbp - 0x48]
xor r8d, r8d
mov edx, r15d
call qword [sym.imp.SHLWAPI.dll_SHRegOpenUSKeyW]
mov rcx, qword [rbp - 0x38]
mov edi, eax
test rcx, rcx
je 0x18004059b
call sub.RPCRT4.dll_MesHandleFree
test edi, edi
je case.default.0x18004051e
xor bl, bl
jmp case.default.0x18004051e
mov eax, 0x79
mov dword [rbp - 0xa], 0x6c0053
mov word [rbp - 0xc], ax
mov eax, 0x69
mov word [rbp - 6], ax
jmp case.default.0x18004051e
mov eax, 0x4f
mov dword [rbp - 0x16], 0x41006e
mov word [rbp - 0x18], ax
mov eax, 0x72
mov word [rbp - 0x12], ax
mov dword [rbp - 0x10], 0x610072
jmp case.default.0x18004051e
mov dword [rbp + 0x14], 0x640065
mov bl, 1
mov word [rbp + 0x18], r9w
jmp case.default.0x18004051e
test bl, bl
je case.default.0x18004051e
mov edi, 8
lea esi, [rdi + 1]
lea r15d, [rdi + 0x41]
cmp edi, 8
ja case.default.0x180040629
mov eax, edi
mov ecx, dword [rdx + rax*4 + 0x40d6c]
add rcx, rdx
jmp rcx
mov word [rbp + 0x20], r9w
jmp case.default.0x180040629
mov r8d, 3
lea rdx, [0x180056adc]
lea rcx, [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x180040761
movsd xmm0, qword [0x180056b18]
movzx eax, word [0x180056b20]
movsd qword [rbp + 0x46], xmm0
mov word [rbp + 0x4e], ax
jmp case.default.0x180040629
mov eax, dword [0x180056b3c]
lea rdx, [0x180056c06]
mov dword [rbp + 0x26], eax
lea rcx, [rbp + 0x20]
movzx eax, word [0x180056b40]
mov r8d, 4
mov word [rbp + 0x2a], ax
mov word [rbp + 0x2c], r9w
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x180040761
mov r8d, 1
mov word [rbp + 0x50], r9w
lea rdx, [0x180056c3a]
lea rcx, [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov word [rbp + 0x52], r15w
jmp 0x180040761
movabs rax, 0x2e003400200073
mov dword [rbp + 0x42], 0x320020
mov qword [rbp + 0x34], rax
mov eax, dword [0x180056ca8]
mov dword [rbp + 0x3c], eax
movzx eax, word [0x180056cac]
mov word [rbp + 0x40], ax
jmp case.default.0x180040629
mov word [rbp + 0x54], r9w
lea rcx, [rbp + 0x20]
mov r12d, r9d
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x180040710
mov dword [rbp - 0x5c], eax
jmp case.default.0x180040629
mov dword [rbp - 0x60], r9d
jmp case.default.0x180040629
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x60]
mov dword [rsp + 0x38], r9d
lea r8, [rbp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], r9
lea r9, [rbp - 0x5c]
movzx edx, r12w
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHRegEnumUSValueW]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.SHLWAPI.dll_SHRegCloseUSKey]
lea rdx, [0x180000000]
xor r9d, r9d
dec edi
sub rsi, 1
jne 0x180040614
mov r15d, dword [rbp - 0x70]
jmp case.default.0x18004051e
mov dword [rbp + 8], 0x430078
mov dword [rbp + 0xc], 0x610068
jmp case.default.0x18004051e
mov r15d, 0xf003f
mov qword [rbp - 0x40], r9
lea r8, [rbp - 0x40]
mov dword [rbp - 0x70], r15d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
inc r14d
mov r9d, 0
sub r13, 1
jne 0x180040500
mov r15d, dword [rsp + 0x40]
mov r13d, 0xb0
mov rsi, qword [rbp - 0x28]
mov r14, qword [rbp - 0x68]
mov edi, dword [rsp + 0x64]
mov byte [rsp + 0x50], bl
movzx ebx, word [rsp + 0x68]
jmp 0x180040989
lea rcx, [rbp + 0x160]
mov qword [rbp - 0x80], rcx
jmp 0x18004098e
movzx eax, word [r8]
lea rdx, [rsp + 0x40]
mov dil, 1
mov word [rsp + 0x40], ax
mov r8d, 0x7a
mov dword [rsp + 0x64], edi
mov rcx, rsi
call fcn.18001d2b0
xor r9d, r9d
mov qword [rbp - 0x38], r9
jmp 0x180040989
mov r14d, dword [r8]
sar r14d, 1
mov dword [rbp - 0x58], r14d
mov dword [rsp + 0x58], r14d
mov r14, qword [rbp - 0x68]
mov word [rsp + 0x54], r9w
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x78], rax
jmp 0x180040993
lea r14, [rbp + 0x250]
mov qword [rbp - 0x78], r14
mov r14, qword [rbp - 0x68]
jmp 0x180040993
cmp r15d, 0x1ee2
je 0x180040993
cmp r15d, 0x2580
je 0x1800408df
cmp r15d, 0x2e18
je 0x1800408b7
cmp r15d, 0x31e0
jne 0x180040993
lea r14, [rbp + 0x60]
mov dword [rsp + 0x60], 1
lea rdx, [rbp + 0x160]
mov qword [rbp - 0x78], r14
mov r14, qword [rbp - 0x68]
lea rcx, [rbp + 0xe0]
mov qword [rsp + 0x78], rdx
mov qword [rbp - 0x80], rcx
jmp 0x18004098e
lea rcx, [rsi + 0xa]
cmp rcx, rax
je 0x18004098e
cmp qword [rax + 0x18], 0x10
mov rdx, rax
jb 0x1800408d1
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
call fcn.1800423a0
jmp 0x180040986
mov eax, dword [r8]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov r8d, 0xae
movsxd rax, dword [rsp + 0x60]
lea rcx, [rax + 0x159]
add rax, 0x154
lea rcx, [rsi + rcx*2]
lea rdx, [rsi + rax*2]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x78]
call fcn.180029550
jmp 0x180040986
movsxd rax, dword [rsp + 0x60]
lea r9, [rsp + 0x58]
mov edi, dword [rsp + 0x58]
mov dword [rsp + 0x58], edi
lea rcx, [rax + 0x159]
add rax, 0x154
lea rcx, [rsi + rcx*2]
lea rdx, [rsi + rax*2]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x78]
mov r8d, 0xae
call fcn.180029550
sar edi, 1
mov dword [rsp + 0x58], edi
mov edi, dword [rsp + 0x64]
xor r9d, r9d
mov r8, qword [rsp + 0x70]
mov ecx, 0x170
imul eax, dword [rbp - 0x54], 0x21
add r15d, eax
mov dword [rsp + 0x40], r15d
cmp r15d, dword [rbp - 0x50]
ja 0x180040bf9
mov rax, qword [rbp - 0x20]
jmp 0x180040460
cmp r15d, 0x7c20
ja 0x180040bc9
je 0x180040bb0
cmp r15d, 0x4aa0
je 0x180040b1f
cmp r15d, 0x5700
je 0x180040ab4
cmp r15d, 0x6360
je 0x180040a88
cmp r15d, 0x6fc0
jne 0x180040993
movsxd rax, dword [rsp + 0x60]
lea r9, [rsp + 0x58]
mov edi, dword [rsp + 0x58]
mov r8d, 0xae
mov dword [rsp + 0x58], edi
lea rcx, [rax + 0x159]
add rax, 0x154
lea rcx, [rsi + rcx*2]
lea rdx, [rsi + rax*2]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x78]
call fcn.180029550
mov eax, 0x110
lea rdx, [r14 + 4]
mov word [rsp + 0x40], ax
lea r9, [rbp + 0x160]
sar edi, 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x54]
mov dword [rsp + 0x20], 0xb4
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x58], edi
call fcn.1800471f0
jmp 0x180040982
lea rdx, [rbp + 0x60]
mov dword [rsp + 0x60], 3
lea rcx, [rbp + 0x160]
mov qword [rsp + 0x78], rdx
lea rax, [rbp + 0x250]
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], rax
jmp 0x18004098e
mov edi, dword [rbp - 0x58]
lea rax, [rbp + 0x60]
mov qword [rbp - 0x78], rax
lea r9, [rsp + 0x48]
movsxd rax, dword [rsp + 0x60]
mov r8d, 0xae
mov dword [rsp + 0x48], edi
lea rcx, [rax + 0x159]
add rax, 0x154
lea rcx, [rsi + rcx*2]
lea rdx, [rsi + rax*2]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x60]
call fcn.180029550
lea rdx, [r14 + 6]
mov word [rsp + 0x40], r13w
lea r9, [rbp + 0xe0]
jmp 0x180040a58
mov edi, dword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, [r14 + 0xa]
lea r9, [rbp + 0xe0]
mov dword [rsp + 0x20], 0xb4
lea r8, [rsp + 0x40]
mov word [rsp + 0x40], r13w
lea rcx, [rsp + 0x54]
mov dword [rsp + 0x48], edi
call fcn.1800471f0
lea rax, [rsp + 0x48]
mov word [rsp + 0x40], r13w
mov qword [rsp + 0x28], rax
lea rdx, [r14 + 8]
lea r9, [rbp + 0x60]
mov dword [rsp + 0x20], 0xb4
lea r8, [rsp + 0x40]
mov dword [rsp + 0x48], edi
lea rcx, [rsp + 0x54]
call fcn.1800471f0
lea rdx, [rbp + 0x250]
mov dword [rsp + 0x60], 2
lea rcx, [rbp + 0xe0]
mov qword [rsp + 0x78], rdx
mov qword [rbp - 0x80], rcx
jmp 0x180040982
lea rax, [rbp + 0x250]
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x78], rax
jmp 0x180040993
cmp r15d, 0x8880
je 0x180040d2b
cmp r15d, 0x94e0
je 0x180040cdb
cmp r15d, 0xa140
je 0x180040c26
cmp r15d, 0xada0
jne 0x180040993
movzx eax, bx
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.18004c9e0
mov rbx, qword [rsp + 0x490]
add rsp, 0x450
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edi, dword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov word [rsp + 0x40], cx
lea rdx, [r14 + 2]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xe0]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x20], 0xb4
lea rcx, [rsp + 0x54]
mov dword [rsp + 0x48], edi
call fcn.1800471f0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], 0
lea r8, [rsi + 0x2bc]
mov qword [rsp + 0x20], rax
mov r9d, 0xa3
mov dword [rsp + 0x48], edi
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x160]
call fcn.180023a20
mov eax, 0x170
mov dword [rsp + 0x48], edi
mov word [rsp + 0x40], ax
lea r9, [rbp + 0x160]
lea rax, [rsp + 0x48]
mov rdx, r14
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x54]
mov dword [rsp + 0x20], 0xb4
call fcn.1800471f0
movzx ebx, word [rsp + 0x54]
mov word [rsp + 0x68], bx
jmp 0x180040982
mov edi, dword [rsp + 0x58]
lea rax, [rbp + 0x60]
mov qword [rbp - 0x78], rax
lea r9, [rsp + 0x48]
movsxd rax, dword [rsp + 0x60]
mov dword [rsp + 0x48], edi
lea rcx, [rax + 0x159]
add rax, 0x154
lea rcx, [rsi + rcx*2]
lea rdx, [rsi + rax*2]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x60]
jmp 0x180040971
lea rax, [rbp + 0xe0]
mov qword [rbp - 0x80], rax
jmp 0x180040993