Function at 0x180048c94
Capabilities:
Query or enumerate registry value
References logon banner

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r13, rcx
mov r14d, r9d
xor ecx, ecx
mov r12, rdx
test r13, r13
je 0x1800492e0
test rdx, rdx
je 0x1800492e0
mov rdi, qword [rbp + 0x60]
test rdi, rdi
je 0x1800492e0
mov eax, dword [rdi + 0x10]
mov esi, ecx
mov dword [rbp - 0x20], eax
lea eax, [rcx + 4]
mov dword [rbp + 0x40], ecx
mov dword [rbp - 0x1c], ecx
mov dword [rbp - 0x10], ecx
mov dword [rbp - 0x18], ecx
cmp r9d, eax
jne 0x180048cf9
mov dword [rdi + 0x14], ecx
lea rax, [rbp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
mov qword [rsp + 0x20], rcx
mov rcx, r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
mov r15d, 5
test eax, eax
jne 0x180048d75
mov eax, dword [rbp - 0x20]
lea ebx, [r15 - 1]
mov rcx, qword [rdi]
lea rdx, str.MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystemLegalNoticeText
cmp eax, r15d
cmove eax, ebx
mov dword [rbp - 0x20], eax
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x180048d63
mov dword [rbp - 0x10], 1
mov dword [rbp - 0x20], 7
jmp 0x180048da9
mov eax, dword [rbp - 0x20]
cmp eax, dword [rdi + 0x10]
je 0x180048da5
cmp r14d, r15d
je 0x180048d9e
mov ebx, 2
xor r13d, r13d
cmp r14d, 2
je 0x180048d8b
cmp r14d, r15d
jne 0x1800492b5
cmp r14d, 2
cmovne r15d, r13d
jne 0x180049298
mov r8d, dword [rdi + 0x10]
jmp 0x18004929c
mov dword [rbp - 0x18], 1
cmp eax, ebx
je 0x180048e20
mov edx, dword [rbp + 0x40]
xor ecx, ecx
add edx, ebx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov ecx, dword [rbp + 0x40]
mov rsi, rax
add ecx, 2
mov dword [rbp + 0x40], ecx
test rax, rax
je 0x180048e16
lea r8d, [rcx + 2]
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
mov rdx, r12
mov qword [rsp + 0x20], rsi
mov rcx, r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
xor r13d, r13d
mov ebx, eax
cmp dword [rbp - 0x10], r13d
je 0x180048e53
lea ecx, [r13 + 7]
mov dword [rbp - 0x20], ecx
jmp 0x180048e56
mov ebx, 8
jmp 0x180048d75
lea rax, [rbp + 0x40]
mov dword [rbp + 0x40], ebx
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
lea rax, [rbp - 0x1c]
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], rax
mov rcx, r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
xor r13d, r13d
mov ecx, dword [rbp - 0x20]
test ebx, ebx
jne 0x180048d78
lea eax, [r14 - 1]
and eax, 0xfffffffb
lea r10d, [rbx + 4]
neg eax
sbb r12d, r12d
and r12d, r10d
cmp ecx, 3
je 0x180049101
jbe 0x180048f5f
cmp ecx, r15d
jbe 0x180049039
cmp ecx, 7
je 0x180048e97
cmp ecx, 0xb
jne 0x180048f5f
test rsi, rsi
je 0x180048f5f
cmp ecx, 7
jne 0x18004901e
mov rcx, qword [rdi]
lea rdx, str.MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystemLegalNoticeText
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x18004901e
mov edx, dword [rbp + 0x40]
mov ecx, r13d
shr edx, 1
je 0x180048ef1
mov r8, rsi
mov r10d, edx
lea r9d, [rax + 0x2c]
cmp word [r8], r9w
lea eax, [rcx + 1]
lea r8, [r8 + 2]
cmovne eax, ecx
mov ecx, eax
sub r10, 1
jne 0x180048edb
lea eax, [rdx + rcx*2]
xor ecx, ecx
lea eax, [rax*2 + 2]
mov edx, eax
mov r13d, eax
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x18004923a
mov r8d, r13d
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov edx, dword [rbp + 0x40]
mov r8, r15
shr edx, 1
mov rcx, rsi
call fcn.180049694
mov rcx, rsi
lea eax, [rax*2 + 2]
mov dword [rbp + 0x40], eax
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
xor r13d, r13d
mov rsi, r15
mov ecx, dword [rbp - 0x20]
mov r10d, 4
mov rax, qword [rdi + 8]
test rax, rax
je 0x1800490e1
cmp r14d, 1
je 0x1800490e1
test rsi, rsi
je 0x1800490ac
cmp dword [rbp - 0x10], r13d
je 0x1800490ac
cmp dword [rdi + 0x10], ecx
je 0x1800490ac
or r15, 0xffffffffffffffff
inc r15
cmp word [rax + r15*2], r13w
jne 0x180048f96
lea edx, [r15 + r15*2]
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x18004923a
mov rcx, qword [rdi + 8]
mov r8, rax
mov edx, r15d
call fcn.180049694
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x18004900a
mov eax, dword [rbp + 0x40]
mov r9, rsi
mov r8d, dword [rbp - 0x20]
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0x50]
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
call fcn.18004b1c0
mov ebx, eax
mov rcx, r14
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
jmp 0x18004928d
mov edx, dword [rbp + 0x40]
mov r9d, 0x2c
shr edx, 1
xor r8d, r8d
mov rcx, rsi
call fcn.180012b44
jmp 0x180048f56
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x18004907f
cmp r14d, 1
je 0x18004907f
cmp dword [rbp - 0x18], r13d
jne 0x180049069
call qword [sym.imp.msvcrt.dll__wtol]
nop dword [rax + rax]
cmp dword [rbp - 0x1c], eax
je 0x18004928d
mov r10d, 4
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r10d
lea r9, [rbp - 0x1c]
mov r8d, r10d
jmp 0x18004927f
cmp r14d, r10d
jne 0x18004909b
mov r8d, r10d
lea rdx, [rbp - 0x1c]
mov ecx, r10d
mov r9, rdi
call fcn.180049768
jmp 0x18004928b
cmp r14d, 3
je 0x18004928d
mov dword [rsp + 0x28], r12d
jmp 0x18004906e
cmp dword [rbp - 0x18], r13d
jne 0x1800490d4
test rsi, rsi
je 0x1800490d4
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x18004928d
mov ecx, dword [rbp - 0x20]
mov dword [rsp + 0x28], r13d
mov r8d, ecx
jmp 0x180049275
cmp r14d, r10d
jne 0x1800490ef
mov r8d, dword [rbp + 0x40]
mov rdx, rsi
jmp 0x18004908e
cmp r14d, 3
je 0x18004928d
mov r8d, ecx
jmp 0x180049270
mov rax, qword [rdi + 8]
test rax, rax
je 0x18004911a
or r15, 0xffffffffffffffff
inc r15
cmp word [rax + r15*2], r13w
jne 0x18004910e
jmp 0x18004911d
mov r15d, r13d
test rax, rax
je 0x18004924e
cmp r14d, 1
je 0x18004924e
test r15d, r15d
je 0x18004924e
cmp dword [rbp - 0x18], r13d
jne 0x180049241
test rsi, rsi
je 0x180049241
mov ecx, r15d
shr ecx, 1
and r15d, 1
lea eax, [rcx + 1]
cmove eax, ecx
xor ecx, ecx
mov r13d, eax
mov edx, eax
mov qword [rbp - 0x10], r13
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r12, rax
test rax, rax
je 0x18004923a
lea r8d, [r13 - 1]
test r8d, r8d
js 0x1800491f0
movsxd rcx, r8d
mov r13d, 0x10
lea r10, [rcx + rax]
shl rcx, 2
mov r11, qword [rdi + 8]
movzx eax, word [rcx + r11]
sub eax, 0x30
cdq
idiv r13d
mov r9d, edx
test r15d, r15d
je 0x1800491c8
cmp r8d, 1
jl 0x1800491dc
movzx eax, word [rcx + r11 - 2]
sub eax, 0x30
cdq
idiv r13d
shl dl, 4
jmp 0x1800491d9
movzx eax, word [rcx + r11 + 2]
sub eax, 0x30
cdq
idiv r13d
shl r9b, 4
add r9b, dl
mov byte [r10], r9b
sub rcx, 4
dec r10
sub r8d, 1
jns 0x180049198
mov r13, qword [rbp - 0x10]
mov r14d, dword [rbp + 0x40]
cmp r14d, r13d
jne 0x180049210
mov r8d, r14d
mov rdx, r12
mov rcx, rsi
call sub.msvcrt.dll_memcmp
xor r13d, r13d
test eax, eax
je 0x180049232
jmp 0x180049213
xor r13d, r13d
mov r8d, dword [rbp - 0x20]
mov r9, rsi
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0x50]
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r14d
call fcn.18004b1c0
mov ebx, eax
mov rcx, r12
jmp 0x18004900d
mov ebx, 8
jmp 0x18004928d
mov dword [rsp + 0x28], r13d
mov r8d, 3
jmp 0x180049275
cmp r14d, r10d
jne 0x180049264
mov r8d, dword [rbp + 0x40]
mov rdx, rsi
mov ecx, 3
jmp 0x18004908e
cmp r14d, 3
je 0x18004928d
mov r8d, 3
mov dword [rsp + 0x28], r12d
mov eax, dword [rbp + 0x40]
mov r9, rsi
mov dword [rsp + 0x20], eax
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0x50]
call fcn.18004b1c0
mov ebx, eax
mov ecx, ebx
call fcn.180011120
mov ebx, eax
jmp 0x1800492c8
or r8d, 0xffffffff
mov rdx, qword [rdi]
xor r9d, r9d
mov rcx, qword [rbp + 0x50]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r13d
call fcn.18004b1c0
lea eax, [rbx - 2]
cmp eax, 1
jbe 0x1800492c5
lea eax, [rbx - 5]
cmp eax, 1
ja 0x1800492c8
mov ebx, r13d
test rsi, rsi
je 0x1800492dc
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov eax, ebx
jmp 0x1800492e5
mov eax, 0x57
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret