Function at 0x18003d3c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x180081de0]
xor rax, rsp
mov qword [rbp - 9], rax
lea eax, [r8 - 0xa]
mov dword [rbp - 0x69], r8d
xor esi, esi
mov dword [rbp - 0x51], r8d
mov r13, r9
mov r9, qword [rbp - 0x61]
mov r14d, r8d
mov rbx, rdx
mov r15, rcx
mov edi, r8d
cmp r8d, eax
jbe 0x18003d839
movsd xmm6, qword [rbp - 0x61]
lea rdx, [0x180000000]
mov r12, qword [rbp - 0x61]
xorps xmm7, xmm7
mov r14, qword [rbp - 0x61]
mov ecx, r8d
mov qword [rbp - 0x61], r9
nop dword [rax + rax]
lea eax, [rdi - 0xb5]
cmp eax, 0x29
ja case.default.0x18003d461
movzx eax, byte [rdx + rax + 0x3d9cc]
mov ecx, dword [rdx + rax*4 + 0x3d9a0]
add rcx, rdx
jmp rcx
mov r8d, 2
lea rdx, [0x180078a48]
lea rcx, [rbp - 0x31]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r8d, 3
mov word [rbp - 0x2d], si
lea rdx, [0x180078aa6]
lea rcx, [rbp - 0x2d]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r9, qword [rbp - 0x61]
movabs rax, 0x74006800670069
mov qword [rbp - 0x27], rax
jmp 0x18003d64a
mov r8d, 1
lea rdx, [0x180078aee]
lea rcx, [rbp - 0x39]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r8d, 3
mov word [rbp - 0x37], si
lea rdx, [0x180078b20]
lea rcx, [rbp - 0x37]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r9, qword [rbp - 0x61]
mov word [rbp - 0x31], si
jmp 0x18003d64a
xor r9d, r9d
mov r8, rbx
xor ecx, ecx
lea edx, [r9 + 0x3c]
call fcn.180052fd0
mov r9, qword [rbp - 0x61]
mov qword [rbp - 0x59], rax
jmp 0x18003d64a
mov ecx, dword [r13]
cmp ecx, 0x20
ja case.0x18003d461.183
mov eax, dword [rbx + 0x18]
sub eax, 4
cmp dword [rbx], eax
jl 0x18003d5be
mov edi, reloc.SHLWAPI.dll_StrCmpNICW
nop dword [rax]
cmp edi, 0x9a
je 0x18003d594
cmp edi, 0x135
je 0x18003d573
cmp edi, 0x1d0
je 0x18003d55d
cmp edi, 0x26b
jne 0x18003d59e
movsxd rax, dword [rbx]
add rax, qword [rbx + 8]
mov qword [rbx + 0x10], rax
jmp 0x18003d59e
test r14, r14
je 0x18003d5f5
add dword [rbx + 0x18], 0x100
mov qword [rbx + 8], r14
jmp 0x18003d59e
mov eax, dword [rbx + 0x18]
cmp eax, 0x7ffffeff
jg 0x18003d5f5
mov rcx, qword [rbx + 8]
add eax, 0x100
movsxd rdx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r14, rax
jmp 0x18003d59e
cmp qword [rbx + 0x10], rsi
je case.0x18003d461.188
add edi, 0x9b
cmp edi, 0x306
jb 0x18003d530
mov ecx, dword [r13]
lea rdx, [0x180000000]
mov edi, dword [rbp - 0x51]
mov r9, qword [rbp - 0x61]
movsxd rax, ecx
mov edx, dword [rdx + rax*4 + 0x68390]
mov eax, 0x20
and edx, dword [r15]
sub eax, ecx
movzx ecx, al
shl edx, cl
mov dword [r15], edx
mov eax, dword [rbx + 4]
add dword [r13], eax
mov ecx, dword [rbx + 4]
mov edx, dword [r15]
add ecx, 0x18
mov r8, qword [rbx + 0x10]
shr edx, cl
or byte [r8], dl
jmp 0x18003d64a
mov r9, qword [rbp - 0x61]
lea rdx, [0x180000000]
mov edi, 0xbe
jmp case.0x18003d461.191
cmp dword [rbx + 0x80], 2
mov r12, rsi
movaps xmm6, xmm7
jl 0x18003d783
cmp dword [rbx + 8], esi
jne case.0x18003d461.191
mov dword [rbp - 0x59], 0xffffff76
jmp case.0x18003d461.188
add eax, dword [rax]
invalid
mov r8, rbx
mov dword [rbp - 0x49], 2
lea rdx, [rbp - 0x49]
mov ecx, 0xfb
call fcn.18005d780
mov r9, rax
mov qword [rbp - 0x61], rax
lea rdx, [0x180000000]
mov ecx, dword [rbp - 0x69]
dec edi
lea eax, [rcx - 0xa]
mov dword [rbp - 0x51], edi
cmp edi, eax
ja 0x18003d440
mov r14d, dword [rbp - 0x69]
imul r12d, r14d, 0x6d6
mov edi, r14d
cmp r14d, r12d
ja case.0x18003d461.188
mov r15, qword [rbp - 0x61]
mov r14, qword [rbp - 0x61]
cmp edi, 0xf98a
ja 0x18003d8bc
je 0x18003d8a6
mov eax, edi
sub eax, 0xb6
je 0x18003d89a
sub eax, 0xa
je 0x18003d87a
sub eax, 0x1e
je 0x18003d84b
sub eax, 0x7c42
je 0x18003d842
cmp eax, 0x1b80
jne 0x18003d92e
mov byte [rbp - 0x59], sil
jmp 0x18003d92e
movsd xmm0, qword [r15]
comisd xmm7, xmm0
ja 0x18003d783
cmp esi, dword [rbx + 0x40]
jge 0x18003d736
mov rdi, rsi
nop word [rax + rax]
mov r8d, 0x13f
mov dword [rbp - 0x49], esi
mov rdx, rbx
lea rcx, [rbp - 0x49]
call fcn.1800059f0
movsd xmm0, qword [r15]
movaps xmm1, xmm6
mov qword [rbp - 0x61], rax
addsd xmm1, qword [rbp - 0x61]
comisd xmm1, xmm0
ja 0x18003d733
mov rax, qword [rbx + 0x60]
inc esi
movaps xmm6, xmm1
add r12, qword [rax + rdi + 8]
add rdi, 0x10
cmp esi, dword [rbx + 0x40]
jl 0x18003d6f0
cmp esi, dword [rbx + 0x40]
je 0x18003d783
subsd xmm0, xmm6
movsxd rax, esi
lea r8, [rbp - 0x61]
mov rcx, rbx
lea rdx, [rax + rax*4]
mov rax, qword [rbx + 0x68]
movd xmm1, dword [rax + rdx*8 + 8]
mov edx, 0x6f
cvtdq2pd xmm1, xmm1
mulsd xmm1, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, r12
addsd xmm1, xmm0
cvttsd2si rax, xmm1
mov qword [rbp - 0x61], rax
call fcn.180016bb0
mov dword [rbp - 0x59], eax
jmp case.0x18003d461.188
mov dword [rbp - 0x59], 0xffffff7d
jmp case.0x18003d461.188
cmp dword [r13], 8
jl 0x18003d807
mov ecx, dword [rbx + 4]
mov edx, dword [r15]
add ecx, 0x10
mov rax, qword [rbx + 0x10]
shr edx, cl
mov byte [rax + 1], dl
cmp dword [r13], 0x10
jl 0x18003d807
mov ecx, dword [rbx + 4]
mov edx, dword [r15]
add ecx, 8
mov rax, qword [rbx + 0x10]
shr edx, cl
mov byte [rax + 2], dl
cmp dword [r13], 0x18
jl 0x18003d807
mov edx, dword [r15]
mov ecx, dword [rbx + 4]
mov rax, qword [rbx + 0x10]
shr edx, cl
mov byte [rax + 3], dl
cmp dword [r13], 0x20
jl 0x18003d807
mov ecx, dword [rbx + 4]
test ecx, ecx
je 0x18003d7ff
movzx edx, byte [r15]
mov eax, 8
sub eax, ecx
movzx ecx, al
mov rax, qword [rbx + 0x10]
shl dl, cl
mov byte [rax + 4], dl
jmp 0x18003d807
mov rax, qword [rbx + 0x10]
mov byte [rax + 4], sil
mov eax, dword [r13]
cdq
and edx, 7
add eax, edx
sar eax, 3
add dword [rbx], eax
mov eax, dword [r13]
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd rcx, eax
add qword [rbx + 0x10], rcx
mov eax, dword [r13]
and eax, 7
mov dword [rbx + 4], eax
jmp case.0x18003d461.188
mov qword [rbp - 0x61], r9
jmp 0x18003d668
mov word [rbp - 0x1b], si
jmp 0x18003d92e
test r9, r9
jne 0x18003d956
mov r8, rbx
mov dword [rbp - 0x51], esi
lea rdx, [rbp - 0x51]
mov ecx, 0xfb
call fcn.18005d780
test rax, rax
jne 0x18003d942
mov r9, qword [rbp - 0x61]
jmp 0x18003d92e
mov r9, rbx
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov edx, 0x11b
xor ecx, ecx
call fcn.18003ff60
mov r9, qword [rbp - 0x61]
jmp 0x18003d92e
mov dword [rbp - 0x1f], 0x650056
jmp 0x18003d92e
mov eax, dword [0x180078b6c]
mov dword [rbp - 0x1b], eax
movzx eax, word [0x180078b70]
mov word [rbp - 0x17], ax
jmp 0x18003d92e
cmp edi, 0x13062
je case.0x18003d461.188
cmp edi, 0x175f4
je 0x18003d91c
cmp edi, 0x1f25e
je 0x18003d8ee
cmp edi, 0x26ec8
jne 0x18003d92e
mov eax, 1
xchg dword [r14 + 0x11c], eax
jmp 0x18003d92e
lea rax, [rbp - 0x41]
mov dword [rbp - 0x41], esi
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x3d]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, [rbp - 0x39]
mov rcx, r15
mov r14, rbx
call qword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
mov r9, qword [rbp - 0x61]
jmp 0x18003d92e
mov dword [rbp - 0x15], 0x3b0072
mov r15, 0xffffffff80000001
mov word [rbp - 0x11], si
imul eax, dword [rbp - 0x69], 0xaf
add edi, eax
cmp edi, r12d
jbe 0x18003d683
jmp case.0x18003d461.188
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call fcn.180005d40
mov byte [rbp - 0x59], al
jmp case.0x18003d461.188
xor r8d, r8d
mov rcx, r9
lea edx, [r8 + 0x7f]
call fcn.180016bb0
mov byte [rbp - 0x59], 1
mov rax, qword [rbp - 0x59]
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.18005fed0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret