Function at 0x180166120
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp + 0x130], rax
mov r14, r8
mov rdi, rdx
mov r15, rcx
mov ecx, pe_nt_image_headers64
call fcn.1801e61e0
mov rsi, rax
mov rbx, rax
mov qword [rsp + 0x58], rax
xor r12d, r12d
mov dword [rbp + 0x44], r12d
mov dword [rbp + 0x40], pe_nt_image_headers64
add rdi, 8
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180166188
mov rdx, qword [rdi]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x44]
xor r8d, r8d
mov rcx, qword [r15 + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
jne 0x1801661fc
mov ecx, dword [rbp + 0x40]
inc ecx
call fcn.1801e61e0
mov rbx, rax
mov qword [rsp + 0x58], rax
test rsi, rsi
je 0x1801661cd
mov rcx, rsi
call fcn.1801e61d0
cmp qword [rdi + 0x18], 0x10
jb 0x1801661d7
mov rdi, qword [rdi]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x44]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r15 + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rsi, rbx
cmp eax, 2
je 0x180166392
mov eax, dword [rbp + 0x44]
cmp eax, 1
jne 0x1801662d4
call fcn.1800f2400
mov rdx, rax
mov rcx, r14
call fcn.1800f12c0
movzx eax, byte [rbx]
test al, al
je 0x1801662f9
lea rdi, [0x1800567d8]
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], sendto
mov byte [rsp + 0x38], 0
movzx r8d, al
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.1800998d0
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
lea rcx, [r14 + 8]
call fcn.180099630
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x1801662c5
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801662bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180166322
call fcn.1801e61d0
nop
inc rsi
movzx eax, byte [rsi]
test al, al
je 0x1801662f9
jmp 0x180166240
cmp eax, 4
jne 0x180166328
lea rax, [r14 + 8]
mov qword [rax + 0x10], r12
cmp qword [rax + 0x18], 0x10
jb 0x1801662eb
mov rax, qword [rax]
mov byte [rax], r12b
mov edx, dword [rbx]
mov rcx, r14
call fcn.1800b9040
nop
mov rcx, rbx
call fcn.1801e61d0
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x240
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18010fa40
nop
mov edx, 0xd8
lea rcx, [rbp + 0x50]
call fcn.180099460
call fcn.1800f2400
mov rsi, rax
call fcn.1800f2400
mov rdi, rax
call fcn.1800f2400
mov rbx, rax
call fcn.1800f2400
mov r8, rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov edx, 0x47a
lea rcx, [rbp + 0x50]
call fcn.1800f8b80
nop
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.1800f8980
lea rdx, [0x18027f1c8]
lea rcx, [rsp + 0x60]
call fcn.18020aad0
nop
call fcn.1800f2400
mov rsi, rax
call fcn.1800f2400
mov rdi, rax
call fcn.1800f2400
mov rbx, rax
call fcn.1800f2400
mov r8, rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov edx, 0x47b
lea rcx, [rbp + 0x50]
call fcn.1800f8b80
lea rdx, [0x18027f1c8]
lea rcx, [rbp + 0x50]
call fcn.18020aad0
int3