Function at 0x1800bf350
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x180121650]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov edi, dword [rbp + 0x1b8]
mov r11, r9
mov r12, qword [rbp + 0x1b0]
xor r13d, r13d
mov qword [rbp - 0x70], r9
mov rbx, rcx
mov r9, r8
mov qword [rbp - 0x60], r8
mov r8, qword [rbp + 0x1c0]
lea r15d, [rdi + 0x10]
mov qword [rsp + 0x78], rcx
mov r10, qword [rsp + 0x78]
mov qword [rbp - 0x78], rdx
mov qword [rbp - 0x68], r12
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], r10
cmp edi, r15d
jae 0x1800bf927
mov eax, dword [rbp - 0x80]
lea esi, [rdi - 1]
mov r12, qword [rsp + 0x78]
mov r13d, dword [rbp - 0x7c]
mov r14, qword [rsp + 0x78]
mov dword [rsp + 0x60], eax
lea r9, [0x180000000]
cmp esi, 0x50
ja case.0x1800bf40d.16
movzx eax, byte [r9 + rsi + 0xbfcbc]
mov ecx, dword [r9 + rax*4 + 0xbfc78]
add rcx, r9
jmp rcx
cmp dword [rdx + 8], 1
jne 0x1800bf470
cmp dword [r8 + 0x30], 0
jbe 0x1800bf44e
xor eax, eax
add r8, 0x20
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x28], rax
mov ecx, 0xb4
mov qword [rsp + 0x20], rax
call fcn.18002fc30
mov rdx, qword [rbp - 0x78]
mov r8, qword [rsp + 0x70]
mov rax, qword [rdx + 0x10]
mov r10, qword [rsp + 0x68]
mov qword [r8 + 8], rax
mov eax, dword [r8 + 0x10]
and eax, 0xfffffe12
or eax, 2
mov dword [r8 + 0x10], eax
jmp case.0x1800bf40d.16
lea rbx, [r8 + 0x20]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rbx
lea rcx, [rbp - 0x58]
lea r8d, [r9 + 0x79]
call fcn.1800d9350
mov rcx, qword [rbp - 0x78]
lea rdx, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov eax, dword [rcx + 0x20]
mov r8, qword [rcx + 0x18]
lea ecx, [r9 + 0x64]
mov dword [rsp + 0x58], eax
call fcn.1800db850
mov r8, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov r10, qword [rsp + 0x68]
mov eax, dword [r8 + 0x10]
and eax, 0xfffffe11
or eax, 1
mov dword [r8 + 0x10], eax
jmp case.0x1800bf40d.16
movsx r13d, byte [r12]
jmp case.0x1800bf40d.16
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xde
call fcn.18009c830
test al, al
je 0x1800bf546
xor r9d, r9d
xor r8d, r8d
mov edx, 0x111
xor ecx, ecx
call fcn.18005f2c0
xor r14d, r14d
lea r9, [rsp + 0x58]
lea r8, [0x18010646e]
mov dword [rsp + 0x58], r14d
lea rcx, [0x18010646e]
lea edx, [r14 + 0x77]
call fcn.1800b78f0
xor r9d, r9d
mov dword [rsp + 0x28], 0xd2
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
xor ecx, ecx
call fcn.1800e5fa0
cmp qword [rsp + 0x70], 0
je 0x1800bf841
mov rax, qword [rbp - 0x68]
cmp dword [rax], 0
je 0x1800bf841
cmp qword [rbp - 0x70], 0
je 0x1800bf841
mov eax, dword [section..data]
cmp dword [rbx], eax
jae 0x1800bf81c
mov edx, 1
lea ecx, [rdx + 0x2f]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
test rax, rax
je 0x1800bf7fc
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xde
call fcn.18009c830
test al, al
je 0x1800bf5f8
lea rax, [rsp + 0x58]
mov byte [rsp + 0x48], 1
mov qword [rsp + 0x30], rax
lea r9, [0x18010646e]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 0x34
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [0x18010646e]
mov byte [rsp + 0x50], 2
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x58], 0
call fcn.180096080
mov r10, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
jmp case.0x1800bf40d.16
cmp dword [r8], 1
jl 0x1800bf87b
mov rax, qword [r11]
lea r8, [rbp - 0x80]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xac
call fcn.180093140
cmp dword [rbp - 0x80], 1
mov r12, rax
jl 0x1800bf850
mov r10, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
jmp case.0x1800bf40d.16
mov r9d, 0xaa
mov dword [rsp + 0x40], r13d
lea r8, [rsp + 0x40]
xor ecx, ecx
call fcn.1800e4c20
mov r10, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
jmp case.0x1800bf40d.16
mov ecx, dword [r11]
mov edx, 1
shl rcx, 2
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
test rax, rax
je 0x1800bf8a2
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xde
call fcn.18009c830
test al, al
je 0x1800bf5f8
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x30], rax
lea r9, [0x18010646e]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x34
lea r8, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea rdx, [0x18010646e]
mov byte [rsp + 0x48], 2
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x40], 0
call fcn.180096080
mov r10, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
jmp case.0x1800bf40d.16
xor r8d, r8d
mov qword [rsp + 0x70], r8
jmp case.0x1800bf40d.16
mov dword [rbp - 0x28], 0x436461
jmp case.0x1800bf40d.16
mov rax, qword [rbp - 0x68]
mov qword [r10], r14
mov eax, dword [rax]
cmp eax, 1
jbe 0x1800bf764
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
lea r8, [rsp + 0x58]
mov dword [rsp + 0x58], 1
mov edx, 0x110
mov qword [rsp + 0x20], r14
mov rcx, r11
call fcn.180051f00
mov rcx, qword [rbp - 0x68]
mov r10, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov eax, dword [rcx]
mov dword [r10 + 0x28], eax
jmp case.0x1800bf40d.16
mov r9, rdx
mov dword [rsp + 0x40], 3
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0xfe
call fcn.1800dee70
mov r10, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
jmp case.0x1800bf40d.16
mov r10, r14
mov qword [rsp + 0x68], r14
jmp case.0x1800bf40d.16
mov eax, 0x5f
mov word [rbp - 0x30], ax
mov eax, 0x61
mov word [rbp - 0x2f], ax
jmp case.0x1800bf40d.16
mov eax, 0x6c
mov word [rbp - 0x2e], ax
mov eax, 0x74
mov word [rbp - 0x2d], ax
mov eax, 0x4e
mov word [rbp - 0x2c], ax
jmp case.0x1800bf40d.16
mov dword [rbp - 0x2b], 0x706d75
jmp case.0x1800bf40d.16
mov eax, dword [0x18012172c]
mov dword [rsp + 0x60], eax
mov r11, qword [rbp - 0x70]
inc esi
lea eax, [rsi + 1]
cmp eax, r15d
jae 0x1800bf92d
mov rdx, qword [rbp - 0x78]
jmp 0x1800bf3e9
mov r8d, 0xe
lea rdx, str.alignment__1
lea ecx, [r8 - 0xd]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__write]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8d, 0x1c
lea rdx, str.r_de_svenska_tv_fruarna_PLUS
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__write]
mov dword [rsp + 0x60], 0xffffffff
jmp 0x1800bfc46
mov r8d, 0x18
lea rdx, str.componentDownload.server
jmp 0x1800bf829
mov rdx, qword [rbp - 0x78]
lea r8, [rsp + 0x40]
mov r9d, 0xaa
mov dword [rsp + 0x40], 0xffffffff
xor ecx, ecx
call fcn.1800e4c20
mov dword [rsp + 0x60], 0
jmp 0x1800bfc46
mov r9d, 0xaa
mov dword [rsp + 0x40], 0xffffffff
lea r8, [rsp + 0x40]
xor ecx, ecx
call fcn.1800e4c20
mov dword [rsp + 0x60], 0
jmp 0x1800bfc46
mov r8d, 0xe
lea rdx, str.ThreadsProcess
lea ecx, [r8 - 0xd]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__write]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r9d, 0xa5
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18002a070
xor r9d, r9d
test eax, eax
mov rax, qword [rbp - 0x78]
je 0x1800bf8fe
mov eax, dword [rax]
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x40], eax
mov edx, 0xc3
call fcn.180023ef0
mov eax, eax
jmp 0x1800bfc4b
mov rax, qword [rax]
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x78], rax
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r8d, [rax + 0x73]
call fcn.1800acbb0
jmp 0x1800bfc4b
mov r15d, dword [rbp - 0x80]
jmp 0x1800bf93d
mov r15d, dword [rsp + 0x60]
xor r13d, r13d
mov r9, qword [rbp - 0x60]
mov r12, qword [rbp - 0x68]
lea r14d, [rdi + 0x570]
cmp edi, r14d
jae 0x1800bfc46
mov esi, dword [rbp - 0x7c]
mov ecx, 0x33
mov rbx, qword [rsp + 0x78]
mov edx, 0x4d6e
lea eax, [rcx - 5]
cmp edi, 0x1d4
ja 0x1800bfa3d
je 0x1800bfa34
cmp edi, 0x98
ja 0x1800bf9db
je 0x1800bfb56
mov eax, edi
sub eax, 1
je 0x1800bfc41
sub eax, 0x20
je 0x1800bf9bf
sub eax, 0x20
je 0x1800bf9ae
cmp eax, 0x37
mov eax, 0x2e
jne 0x1800bfb38
mov word [rbp - 0x1d], dx
jmp 0x1800bfb38
mov qword [r10 + 0x18], r11
mov qword [r10 + 0x20], r9
mov qword [r10 + 0x10], r8
jmp 0x1800bfb33
mov eax, 0x6f
mov dword [rbp - 0x21], 0x697372
mov word [rbp - 0x1e], ax
mov dword [rbp - 0x25], 0x65766e6f
jmp 0x1800bfb33
mov eax, edi
sub eax, 0xcf
je 0x1800bfa28
sub eax, 0x57
je 0x1800bfa03
cmp eax, 0x57
mov eax, 0x2e
jne 0x1800bfb38
mov dword [rbp - 4], 0x320033
jmp 0x1800bfb38
mov eax, 0x6c
mov dword [rbp - 0x10], 0x730073
mov word [rbp - 0xc], ax
mov eax, 0x79
mov word [rbp - 6], ax
mov dword [rbp - 0xa], 0x610065
jmp 0x1800bfb33
mov dword [rbp - 0x1b], 0x65646f
jmp 0x1800bfb33
mov word [rbp], ax
jmp 0x1800bfb38
cmp edi, 0x330
ja 0x1800bfad2
je 0x1800bfaa8
mov eax, edi
sub eax, 0x22b
je 0x1800bfa9c
sub eax, 0x57
je 0x1800bfa6f
cmp eax, 0x57
mov eax, 0x2e
jne 0x1800bfb38
mov esi, r13d
jmp 0x1800bfb38
movups xmm0, xmmword [str.BFD_RELOC_ALPHA_DTPREL_LO16]
mov eax, dword [0x1801099b8]
movsd xmm1, qword [0x1801099b0]
movups xmmword [rbp + 0x10], xmm0
mov dword [rbp + 6], 0x6c
movsd qword [rbp + 0x20], xmm1
mov dword [rbp + 0x28], eax
jmp 0x1800bfb33
mov dword [rbp + 2], 0x6c0064
jmp 0x1800bfb33
mov r9d, ecx
mov qword [rsp + 0x28], r13
lea rcx, [rbp - 0x10]
mov dword [rbp - 0x7c], 0x104
xor edx, edx
mov qword [rsp + 0x20], r13
mov r8d, 0xb7
call fcn.18000cad0
mov rbx, rax
jmp 0x1800bfb24
mov eax, edi
sub eax, 0x387
je 0x1800bfaf7
sub eax, 0x57
je 0x1800bfaeb
cmp eax, 0x57
je 0x1800bfc46
jmp 0x1800bfb33
call rbx
cmp eax, 1
sete byte [rsp + 0x60]
jmp 0x1800bfb24
mov r9d, 0x10000000
lea r8, [rbp - 0x7c]
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x30]
call qword [sym.imp.SHLWAPI.dll_UrlCanonicalizeA]
mov r9d, 1
lea rcx, [rbp + 0x10]
mov r8d, esi
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_SHRegGetBoolUSValueA]
mov r10, qword [rsp + 0x68]
mov edx, 0x4d6e
mov ecx, 0x33
mov eax, 0x2e
add edi, 0x57
cmp edi, r14d
jae 0x1800bfc46
mov r8, qword [rsp + 0x70]
mov r11, qword [rbp - 0x70]
mov r9, qword [rbp - 0x60]
jmp 0x1800bf962
mov r9, qword [rbp - 0x78]
mov r8d, 0x20
mov rdx, qword [0x180121778]
mov rcx, r10
call fcn.1800cff60
mov eax, dword [r12]
lea r9, [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x58]
mov dword [rsp + 0x58], eax
xor ecx, ecx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x70]
mov rdx, qword [rdx]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x118
mov dword [rsp + 0x40], 1
call fcn.1800a4ce0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xde
call fcn.18009c830
test al, al
je 0x1800bfc41
xor r9d, r9d
mov dword [rsp + 0x20], 0xc3
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800c13c0
mov r8d, dword [0x18012172c]
cmp r15d, r8d
je 0x1800bfc1f
mov edx, r15d
lea rcx, str.OtYkTOmWehisEyMiG3zoMRGzXwmqMHBxRiVrSXGAK5UBsh8CAwEAAaOCBEowggRGMB0GA1UdDgQW
call fcn.1800fcfa0
xor r9d, r9d
lea r8, [0x18010646e]
lea rdx, [0x18010646e]
lea rcx, str.EventStartForRequiredActivation
call fcn.1800fcfa0
mov dword [0x18012172c], r15d
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], r13d
lea r8, [0x18010646e]
mov edx, 0x77
lea rcx, [0x18010646e]
call fcn.1800b78f0
mov dword [rsp + 0x60], r13d
mov rax, qword [rsp + 0x60]
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1800fd9d0
mov rbx, qword [rsp + 0x290]
add rsp, 0x250
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret