Function at 0x18005c300
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x18008a300]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov ebx, dword [rsp + 0x54]
lea r14d, [rdx - 0xf]
mov r13, r9
mov r12, r8
mov r15, rcx
cmp edx, r14d
jbe case.0x18005c38d.11
lea ebp, [rdx - 0x23]
lea rdi, [0x18008ac58]
xor r9d, r9d
lea rsi, [0x18008ac5c]
lea r11, [0x18008ac60]
movabs r8, 0x3bc79ca10c924223
lea rdx, [0x180000000]
mov r10d, reloc.SHELL32.dll_SHTestTokenMembership
cmp ebp, 0x2d
ja case.0x18005c38d.15
movzx eax, byte [rdx + rbp + 0x5c718]
mov ecx, dword [rdx + rax*4 + 0x5c6d8]
add rcx, rdx
jmp rcx
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.FaceName
xor r9d, r9d
mov qword [rsp + 0x20], r11
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp case.0x18005c38d.15
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov dword [0x18008ad04], eax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Console
lea rax, [rsp + 0x58]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp case.0x18005c38d.15
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x18005c38d.15
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.IIsMimeMap
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp case.0x18005c38d.15
mov eax, dword [rsp + 0x54]
shr eax, 6
and eax, 1
mov dword [0x18008aca8], eax
jmp case.0x18005c38d.15
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str..site.com
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x50], 0x40
jmp case.0x18005c38d.15
mov word [0x18008acb6], r10w
mov dword [0x18008acb8], r9d
mov dword [0x18008acbc], 0x32
mov dword [0x18008acc0], 4
jmp case.0x18005c38d.15
mov ebx, r9d
jmp case.0x18005c38d.15
mov eax, dword [r15 + 0xc]
mov edi, dword [r15 + 0x501c]
test eax, eax
je 0x18005c524
mov r10, r13
lea r11, [r12 + 0x80]
mov esi, eax
test edi, edi
je 0x18005c506
mov r8, r10
mov rdx, r11
mov r9, rdi
mov ecx, dword [rdx]
lea r8, [r8 + 8]
cmp dword [rdx - 0x80], ecx
mov eax, dword [rdx + 0x80]
cmovbe ecx, dword [rdx - 0x80]
lea rdx, [rdx + 4]
cmp ecx, eax
cmovbe eax, ecx
lea rcx, [0x180000000]
mov rax, qword [rcx + rax*8 + 0x787f0]
mov qword [r8 - 8], rax
sub r9, 1
jne 0x18005c4d1
add r10, 0x100
add r11, 0x180
sub rsi, 1
jne 0x18005c4c4
movabs r8, 0x3bc79ca10c924223
cmp edi, 0x20
jae 0x18005c692
lea rcx, [rdi*8]
mov edx, 0x20
add rcx, r13
sub edx, edi
nop
mov qword [rcx + 0x100], r8
mov qword [rcx], r8
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x18005c540
jmp 0x18005c692
cmp dword [r12], 0
je 0x18005c56d
mov dword [r15 + 0x68], 1
jmp case.0x18005c38d.15
mov dword [r12], r9d
jmp case.0x18005c38d.15
mov eax, dword [rsp + 0x54]
shr eax, 5
and eax, 1
mov dword [0x18008aca4], r9d
mov dword [0x18008acb0], eax
mov rax, qword [0x18008a548]
mov dword [0x18008acac], 0x10000
movzx ecx, word [rax + 0xc]
shl cx, 4
or cx, word [rax + 0xa]
mov word [0x18008acb4], cx
jmp case.0x18005c38d.15
mov qword [rsp + 0x48], r9
xor r8d, r8d
mov dword [rsp + 0x40], 0x85
xor edx, edx
mov qword [rsp + 0x38], r9
xor ecx, ecx
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r9
xor r9d, r9d
call fcn.180019f50
mov rcx, qword [0x180089208]
lea rdx, [rsp + 0x54]
mov qword [0x18008ad08], rax
mov dword [0x18008ac40], 0x2d0
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
jmp case.0x18005c38d.15
mov dword [rsp + 0x50], 4
lea rsi, [0x18008acc4]
mov edi, r9d
mov r8d, edi
lea rdx, str.imageStartSize
lea rcx, [rsp + 0x60]
call fcn.18006a870
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
inc edi
add rsi, 4
cmp edi, 0x10
jl 0x18005c620
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.FontSize
lea rax, [0x18008ac54]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdi, [0x18008ac58]
dec ebp
lea eax, [rbp + 0x23]
cmp eax, r14d
ja 0x18005c34a
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18006b180
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [r15 + 0x5c]
jmp 0x18005c6a9