Function at 0x18003a400
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push r12
push r13
push r14
sub rsp, 0x1f0
mov qword [rsp + 0x168], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
xor r12d, r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [r11 - 0x150]
mov qword [rsp + 0x20], rax
lea r9, [r11 - 0x158]
lea r8, str.__docwmServState
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smpcache_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18003ae1b
cmp dword [rsp + 0xb0], 4
jne 0x18003ae1b
cmp dword [rsp + 0xb8], r12d
jne 0x18003ae1b
mov qword [rsp + 0x80], socket
mov qword [rsp + 0x78], r12
mov byte [rsp + 0x68], r12b
lea r8d, [r12 + 0xc]
lea rdx, [0x1800cf9b0]
lea rcx, [rsp + 0x60]
call fcn.18000f0f0
nop
mov r8b, 1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x140]
call fcn.180002060
nop
cmp qword [rsp + 0x80], 0x10
jb 0x18003a502
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
lea r14, [0x1801088f0]
mov qword [rsp + 0xb8], r14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [0x18010cc60]
call fcn.18003b620
and dword [rsp + 0xc8], 0xfffffe00
mov rdi, r12
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xd8], r12
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0x58], socket
mov qword [rsp + 0x50], r12
mov byte [rsp + 0x40], 0
mov r8d, 9
lea rdx, str.DocwmMove
lea rcx, [rsp + 0x38]
call fcn.18000f0f0
nop
mov esi, 1
mov dword [rsp + 0x30], esi
and dword [rsp + 0x90], 0xfffffe00
mov qword [rsp + 0x98], r12
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xa8], r12
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x140]
call fcn.180002430
movzx ecx, byte [rsp + 0x90]
test al, al
je 0x18003a6bc
cmp cl, 7
jne 0x18003a6bc
lea r8, [0x1800cda9a]
lea rdx, str.value_bool
lea rcx, [rsp + 0x88]
call fcn.1800671b4
mov rcx, rax
call fcn.18006789c
test al, al
jne 0x18003a610
lea rcx, [rsp + 0x88]
call fcn.180066210
jmp 0x18003a731
lea r8, [0x1800cda9a]
lea rdx, str.value_bool
lea rcx, [rsp + 0x88]
call fcn.1800671b4
mov rcx, rax
call fcn.180066570
cmp eax, 1
sete bl
lea rcx, [rsp + 0x88]
call fcn.180066210
test bl, bl
je 0x18003a731
mov qword [rsp + 0x80], socket
mov qword [rsp + 0x78], r12
mov byte [rsp + 0x68], 0
mov r8d, 0xe
lea rdx, str.DocwmMoveRules
lea rcx, [rsp + 0x60]
call fcn.18000f0f0
nop
mov esi, 3
mov dword [rsp + 0x30], esi
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x140]
call fcn.180002b70
test al, al
je 0x18003a6b2
mov bl, 1
mov rdi, qword [rsp + 0xd0]
jmp 0x18003a733
mov rdi, qword [rsp + 0xd0]
jmp 0x18003a731
movsx eax, cl
cmp eax, 4
je 0x18003a6eb
add eax, 0xfffffffa
cmp eax, 1
ja 0x18003a703
mov rbx, qword [rsp + 0x88]
test rbx, rbx
je 0x18003a703
mov rcx, rbx
call fcn.18006afa0
mov rcx, rbx
call fcn.18009a864
jmp 0x18003a703
bt dword [rsp + 0x90], 8
jae 0x18003a703
mov rcx, qword [rsp + 0x88]
call fcn.18009a9fc
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x18003a731
lea rbx, [rcx - 8]
lea r9, [0x180065be8]
mov r8d, dword [rbx]
mov edx, 8
call fcn.18009ae90
mov rcx, rbx
call fcn.18009af58
nop
xor bl, bl
test sil, 2
je 0x18003a767
and esi, 0xfffffffd
cmp qword [rsp + 0x80], 0x10
jb 0x18003a751
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
mov qword [rsp + 0x80], socket
mov qword [rsp + 0x78], r12
mov byte [rsp + 0x68], 0
test sil, 1
je 0x18003a77f
cmp qword [rsp + 0x58], 0x10
jb 0x18003a77f
mov rcx, qword [rsp + 0x40]
call fcn.18009a864
test bl, bl
je 0x18003ad29
mov esi, r12d
nop word [rax + rax]
movsx ebp, byte [rsp + 0xc8]
mov eax, ebp
mov rbx, qword [rsp + 0xc0]
test bpl, bpl
js 0x18003ac42
cmp eax, 5
jle 0x18003ac42
cmp eax, 6
je 0x18003a7c8
cmp eax, 7
jne 0x18003ac42
mov rax, qword [rbx + 0x38]
jmp 0x18003a83a
cmp qword [rbx + 0x38], 0
je 0x18003ac42
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x138], rax
mov rax, qword [rbx]
mov qword [rsp + 0x130], rax
movaps xmm0, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0xf0], xmm0
lea rcx, [rsp + 0xf0]
call fcn.18006b8d4
mov r11, qword [rsp + 0xf0]
test r11, r11
jne 0x18003a81f
call fcn.18009a80c
mov r11, r12
jmp 0x18003a822
mov r11, qword [r11]
mov rdi, qword [rsp + 0xf8]
cmp rdi, qword [r11 + 0x30]
jne 0x18003a835
call fcn.18009a80c
mov eax, dword [rdi + 0x20]
inc eax
cmp esi, eax
jae 0x18003ac42
mov edx, esi
lea rcx, [rsp + 0xc0]
call fcn.180066df0
mov rbx, rax
mov qword [rsp + 0x198], 7
mov qword [rsp + 0x190], r12
mov word [rsp + 0x180], r12w
mov qword [rsp + 0x1c8], 7
mov qword [rsp + 0x1c0], r12
mov word [rsp + 0x1b0], r12w
mov qword [rsp + 0x58], socket
mov qword [rsp + 0x50], r12
mov byte [rsp + 0x40], 0
mov r8d, 6
lea rdx, str.source
lea rcx, [rsp + 0x38]
call fcn.18000f0f0
nop
mov r8d, 0x64
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.180001870
mov dword [rsp + 0x170], eax
cmp qword [rsp + 0x58], 0x10
jb 0x18003a8e5
mov rcx, qword [rsp + 0x40]
call fcn.18009a864
mov qword [rsp + 0x58], socket
mov qword [rsp + 0x50], r12
mov byte [rsp + 0x40], 0
mov r8d, 4
lea rdx, str.dest
lea rcx, [rsp + 0x38]
call fcn.18000f0f0
nop
mov r8d, 0x64
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.180001870
mov dword [rsp + 0x1a0], eax
cmp qword [rsp + 0x58], 0x10
jb 0x18003a943
mov rcx, qword [rsp + 0x40]
call fcn.18009a864
mov eax, dword [rsp + 0x1a0]
cmp dword [rsp + 0x170], 0x64
je 0x18003abee
cmp eax, 0x64
je 0x18003abee
mov qword [rsp + 0x58], socket
mov qword [rsp + 0x50], r12
mov byte [rsp + 0x40], 0
mov r8d, 7
lea rdx, str.srcPath
lea rcx, [rsp + 0x38]
call fcn.18000f0f0
nop
mov qword [rsp + 0x120], socket
mov qword [rsp + 0x118], r12
mov byte [rsp + 0x108], 0
xor r8d, r8d
lea rdx, [0x1800cda5f]
lea rcx, [rsp + 0x100]
call fcn.18000f0f0
lea r9, [rsp + 0x100]
lea r8, [rsp + 0x38]
mov rdx, rbx
lea rcx, [rsp + 0x88]
call fcn.180001940
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.180001500
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x178]
call fcn.18000db80
nop
cmp qword [rsp + 0x80], 8
jb 0x18003aa11
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
mov qword [rsp + 0x80], 7
mov qword [rsp + 0x78], r12
mov word [rsp + 0x68], r12w
cmp qword [rsp + 0xa8], 0x10
jb 0x18003aa40
mov rcx, qword [rsp + 0x90]
call fcn.18009a864
mov qword [rsp + 0xa8], socket
mov qword [rsp + 0xa0], r12
mov byte [rsp + 0x90], 0
cmp qword [rsp + 0x58], 0x10
jb 0x18003aa6e
mov rcx, qword [rsp + 0x40]
call fcn.18009a864
mov qword [rsp + 0x58], socket
mov qword [rsp + 0x50], r12
mov byte [rsp + 0x40], 0
mov r8d, 7
lea rdx, str.dstPath
lea rcx, [rsp + 0x38]
call fcn.18000f0f0
nop
mov qword [rsp + 0x120], socket
mov qword [rsp + 0x118], r12
mov byte [rsp + 0x108], 0
xor r8d, r8d
lea rdx, [0x1800cda5f]
lea rcx, [rsp + 0x100]
call fcn.18000f0f0
lea r9, [rsp + 0x100]
lea r8, [rsp + 0x38]
mov rdx, rbx
lea rcx, [rsp + 0x88]
call fcn.180001940
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.180001500
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x1a8]
call fcn.18000db80
nop
cmp qword [rsp + 0x80], 8
jb 0x18003ab25
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
mov qword [rsp + 0x80], 7
mov qword [rsp + 0x78], r12
mov word [rsp + 0x68], r12w
cmp qword [rsp + 0xa8], 0x10
jb 0x18003ab54
mov rcx, qword [rsp + 0x90]
call fcn.18009a864
mov qword [rsp + 0xa8], socket
mov qword [rsp + 0xa0], r12
mov byte [rsp + 0x90], 0
cmp qword [rsp + 0x58], 0x10
jb 0x18003ab82
mov rcx, qword [rsp + 0x40]
call fcn.18009a864
mov qword [rsp + 0x58], socket
mov qword [rsp + 0x50], r12
mov byte [rsp + 0x40], 0
mov r8d, 6
lea rdx, str.action
lea rcx, [rsp + 0x38]
call fcn.18000f0f0
nop
mov r8d, 2
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.180001870
mov dword [rsp + 0x1d0], eax
cmp qword [rsp + 0x58], 0x10
jb 0x18003abd9
mov rcx, qword [rsp + 0x40]
call fcn.18009a864
lea rdx, [rsp + 0x170]
lea rcx, [0x18010cc60]
call fcn.18003b520
nop
cmp qword [rsp + 0x1c8], 8
jb 0x18003ac06
mov rcx, qword [rsp + 0x1b0]
call fcn.18009a864
mov qword [rsp + 0x1c8], 7
mov qword [rsp + 0x1c0], r12
mov word [rsp + 0x1b0], r12w
cmp qword [rsp + 0x198], 8
jb 0x18003ac3b
mov rcx, qword [rsp + 0x180]
call fcn.18009a864
inc esi
jmp 0x18003a790
mov r8, qword [0x18010cc80]
mov rcx, r8
mov rdi, qword [0x18010cc78]
sub rcx, rdi
movabs r13, 0x4ec4ec4ec4ec4ec5
mov rax, r13
imul rcx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x18003acf5
mov r12, r8
cmp rdi, r8
jbe 0x18003ac91
call fcn.18009a80c
mov r8, qword [0x18010cc80]
mov rdi, qword [0x18010cc78]
mov rax, qword [0x18010cc60]
mov rsi, rax
cmp rdi, r8
jbe 0x18003acac
call fcn.18009a80c
mov rax, qword [0x18010cc60]
test rsi, rsi
je 0x18003acb6
cmp rsi, rax
je 0x18003acbb
call fcn.18009a80c
mov rcx, r12
sub rcx, rdi
mov rax, r13
imul rcx
sar rdx, 5
mov r8, rdx
shr r8, 0x3f
add r8, rdx
lea r9, [0x18003a390]
mov rdx, r12
mov rcx, rdi
call fcn.18003efe0
mov r8, qword [0x18010cc80]
mov rdi, qword [0x18010cc78]
sub r8, rdi
mov rax, r13
imul r8
sar rdx, 5
mov r8, rdx
shr r8, 0x3f
add r8, rdx
lea rdx, str._d_DocwmMoveRules_loaded
lea rcx, str.athenwDbg
call fcn.18005c640
mov rdi, qword [rsp + 0xd0]
jmp 0x18003ad39
movzx ebp, byte [rsp + 0xc8]
mov rbx, qword [rsp + 0xc0]
movsx eax, bpl
cmp eax, 4
je 0x18003ad61
add eax, 0xfffffffa
cmp eax, 1
ja 0x18003ad74
test rbx, rbx
je 0x18003ad74
mov rcx, rbx
call fcn.18006afa0
mov rcx, rbx
call fcn.18009a864
jmp 0x18003ad74
bt dword [rsp + 0xc8], 8
jae 0x18003ad74
mov rcx, rbx
call fcn.18009a9fc
test rdi, rdi
je 0x18003ad9b
lea r9, [0x180065be8]
mov r8d, dword [rdi - 8]
mov edx, 8
mov rcx, rdi
call fcn.18009ae90
lea rcx, [rdi - 8]
call fcn.18009af58
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov eax, dword [rsp + 0x148]
movsx ecx, al
cmp ecx, 4
je 0x18003addb
lea eax, [rcx - 6]
cmp eax, 1
ja 0x18003adee
mov rbx, qword [rsp + 0x140]
test rbx, rbx
je 0x18003adee
mov rcx, rbx
call fcn.18006afa0
mov rcx, rbx
call fcn.18009a864
jmp 0x18003adee
bt eax, 8
jae 0x18003adee
mov rcx, qword [rsp + 0x140]
call fcn.18009a9fc
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x18003ae1b
lea rbx, [rcx - 8]
lea r9, [0x180065be8]
mov r8d, dword [rbx]
mov edx, 8
call fcn.18009ae90
mov rcx, rbx
call fcn.18009af58
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.180099fe0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret