Function at 0x18004c040
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r13
sub rsp, 0xb0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov dword [r11 + 0x10], 4
lea rax, [r11 + 0x10]
mov qword [rsp + 0x28], rax
lea rax, [r11 + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [r11 + 0x18]
lea r8, [0x1800cee58]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18004c436
cmp dword [rsp + 0xf0], 4
jne 0x18004c436
cmp dword [rsp + 0xf8], eax
je 0x18004c436
lea rdx, str.gxscrncap.exe
lea rcx, [0x180108f60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18004c0e1
lea rcx, [0x1800d2818]
call fcn.180003e10
movzx eax, al
jmp 0x18004c438
mov qword [rsp + 0x70], 7
xor r13d, r13d
mov qword [rsp + 0x68], r13
mov word [rsp + 0x58], r13w
lea rdx, str.pickerhost.exe
lea rcx, [0x180108f60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18004c12b
lea r8d, [r13 + 0x10]
lea rdx, str.snippingtool.exe
lea rcx, [rsp + 0x50]
call fcn.18000f510
lea ebx, [r13 + 1]
jmp 0x18004c12e
mov ebx, r13d
cmp qword [rsp + 0x70], 8
jb 0x18004c140
mov rcx, qword [rsp + 0x58]
call fcn.18009a864
test ebx, ebx
je 0x18004c14e
mov eax, 1
jmp 0x18004c438
mov dword [rsp + 0xf0], 4
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xf8]
lea r8, str.ScrncapWmWorkMode
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_scrncapmgr_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18004c42f
cmp dword [rsp + 0xf8], 4
jne 0x18004c42f
cmp dword [rsp + 0xe8], eax
je 0x18004c42f
lea r9, str.ScrncapWmProcs
lea r8, str.SoftwareWOW6432Nodeprojonepodlp_scrncapmgr_
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.180053c64
nop
cmp qword [rax + 0x20], 8
jb 0x18004c1e6
mov rdx, qword [rax + 8]
jmp 0x18004c1ea
lea rdx, [rax + 8]
lea r8, [0x1800ce180]
lea rcx, [rsp + 0x78]
call fcn.180053294
nop
cmp qword [rsp + 0x70], 8
jb 0x18004c20e
mov rcx, qword [rsp + 0x58]
call fcn.18009a864
mov rbx, qword [rsp + 0x90]
cmp rbx, qword [rsp + 0x98]
jbe 0x18004c225
call fcn.18009a80c
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdi, [rbx + 8]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
nop dword [rax]
mov rsi, qword [rsp + 0x98]
cmp qword [rsp + 0x90], rsi
jbe 0x18004c267
call fcn.18009a80c
test rbx, rbx
je 0x18004c273
cmp rbx, qword [rsp + 0x78]
je 0x18004c278
call fcn.18009a80c
cmp rbp, rsi
je 0x18004c39c
test rbx, rbx
jne 0x18004c290
call fcn.18009a80c
mov r11, r13
jmp 0x18004c293
mov r11, qword [rbx]
cmp rbp, qword [r11 + 0x20]
jb 0x18004c29e
call fcn.18009a80c
cmp qword [rdi + 0x18], 8
jb 0x18004c2aa
mov rax, qword [rdi]
jmp 0x18004c2ad
mov rax, rdi
test rax, rax
je 0x18004c2ef
test rbx, rbx
jne 0x18004c2c1
call fcn.18009a80c
mov r11, r13
jmp 0x18004c2c4
mov r11, qword [rbx]
cmp rbp, qword [r11 + 0x20]
jb 0x18004c2cf
call fcn.18009a80c
cmp qword [rdi + 0x18], 8
jb 0x18004c2db
mov rcx, qword [rdi]
jmp 0x18004c2de
mov rcx, rdi
lea rdx, [0x180108f60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18004c319
test rbx, rbx
jne 0x18004c2fe
call fcn.18009a80c
mov r11, r13
jmp 0x18004c301
mov r11, qword [rbx]
cmp rbp, qword [r11 + 0x20]
jb 0x18004c30c
call fcn.18009a80c
add rbp, 0x28
add rdi, 0x28
jmp 0x18004c250
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x18004c370
mov rdi, qword [rsp + 0x98]
cmp rcx, rdi
je 0x18004c36b
lea rbx, [rcx + 0x20]
cmp qword [rbx], 8
jb 0x18004c346
mov rcx, qword [rbx - 0x18]
call fcn.18009a864
mov qword [rbx], 7
mov qword [rbx - 8], r13
mov word [rbx - 0x18], r13w
add rbx, 0x28
lea rax, [rbx - 0x20]
cmp rax, rdi
jne 0x18004c337
mov rcx, qword [rsp + 0x90]
call fcn.18009a864
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x98], r13
mov qword [rsp + 0xa0], r13
mov rcx, qword [rsp + 0x78]
call fcn.18009a864
mov eax, 1
jmp 0x18004c438
mov edi, r13d
cmp dword [rsp + 0xe8], 1
setne dil
mov rbx, qword [rsp + 0x90]
test rbx, rbx
je 0x18004c409
mov rsi, qword [rsp + 0x98]
cmp rbx, rsi
je 0x18004c3fc
add rbx, 0x20
nop dword [rax]
cmp qword [rbx], 8
jb 0x18004c3df
mov rcx, qword [rbx - 0x18]
call fcn.18009a864
mov qword [rbx], 7
mov qword [rbx - 8], r13
mov word [rbx - 0x18], r13w
add rbx, 0x28
lea rcx, [rbx - 0x20]
cmp rcx, rsi
jne 0x18004c3d0
mov rcx, qword [rsp + 0x90]
call fcn.18009a864
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x98], r13
mov qword [rsp + 0xa0], r13
mov rcx, qword [rsp + 0x78]
call fcn.18009a864
mov eax, edi
jmp 0x18004c438
mov eax, 1
jmp 0x18004c438
xor eax, eax
add rsp, 0xb0
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret