Function at 0x1800056b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1c0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1801bc080]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rsi, rdx
mov r15, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdx
xor r12d, r12d
mov dword [rsp + 0x34], r12d
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r12w
xor r8d, r8d
lea rdx, [0x180163940]
lea rcx, [rsp + 0x78]
call fcn.180004a10
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rsp + 0x68], xmm1
mov word [rsp + 0x58], r12w
lea r8d, [r12 + 6]
lea rdx, str.CLSID_
lea rcx, [rsp + 0x58]
call fcn.180004a10
nop
mov r9, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005773
mov r9, qword [rsi]
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1800057bb
lea rdi, [rdx + rcx]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp r8, 8
cmovae rbx, qword [rsp + 0x58]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.18010e270
mov word [rbx + rdi*2], r12w
jmp 0x1800057ca
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x58]
call fcn.18000d6d0
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x48]
call fcn.18000cd00
nop
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov rax, rdx
sub rax, rcx
cmp rax, 0xf
jb 0x18000581f
lea rdi, [rcx + 0xf]
mov qword [rbp - 0x38], rdi
lea rbx, [rbp - 0x48]
cmp rdx, 8
cmovae rbx, qword [rbp - 0x48]
lea rcx, [rbx + rcx*2]
mov r8d, 0x1e
lea rdx, str.InProcServer32
call fcn.18010e270
mov word [rbx + rdi*2], r12w
jmp 0x18000583d
mov qword [rsp + 0x20], 0xf
lea r9, str.InProcServer32
mov edx, 0xf
lea rcx, [rbp - 0x48]
call fcn.18000d6d0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x180005888
lea rdi, [rcx + 6]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
mov r8d, 0xc
lea rdx, str.Shell
call fcn.18010e270
mov word [rbx + rdi*2], r12w
jmp 0x1800058a7
mov qword [rsp + 0x20], 6
lea r9, str.Shell
mov edx, 6
lea rcx, [rsp + 0x58]
call fcn.18000d6d0
cmp qword [rsi + 0x10], 0
jne 0x1800059cd
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], 7
mov word [r15], r12w
xor r8d, r8d
lea rdx, [0x180163940]
mov rcx, r15
call fcn.180004a10
mov dword [rsp + 0x34], 1
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x18000591c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005917
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800061bc
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r12w
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x180005970
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000596b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800061c2
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x180006168
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006163
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800061b6
jmp 0x180006163
mov qword [rsp + 0x38], r12
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov r14, 0xffffffffffffffff
test eax, eax
jne 0x180005ce6
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp - 0x20]
call fcn.18010e6d0
mov dword [rsp + 0x30], 0xc6
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x180005b16
cmp word [rbp - 0x20], ax
je 0x180005b16
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180005a8e
lea rdi, [rcx + 1]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
lea r8d, [r14 + 3]
lea rdx, [0x180163a20]
call fcn.18010e270
mov word [rbx + rdi*2], r12w
jmp 0x180005aad
mov qword [rsp + 0x20], 1
lea r9, [0x180163a20]
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.18000d6d0
lea rax, [rbp - 0x20]
mov rdx, r14
inc rdx
cmp word [rax + rdx*2], 0
jne 0x180005ab4
mov rcx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x180005b03
lea rdi, [rdx + rcx]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp r8, 8
cmovae rbx, qword [rsp + 0x58]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
lea rdx, [rbp - 0x20]
call fcn.18010e270
mov word [rbx + rdi*2], r12w
jmp 0x180005b16
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x20]
lea rcx, [rsp + 0x58]
call fcn.18000d6d0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
lea rax, [rbp - 0x20]
mov r8, r14
inc r8
cmp word [rax + r8*2], 0
jne 0x180005b41
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x68]
call fcn.180004a10
nop
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp qword [rbp - 0x58], 0
ja 0x180005bc3
cmp rax, 0xd
jb 0x180005bac
lea rdi, [rcx + 0xd]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
mov r8d, 0x1a
lea rdx, str.opencommand
call fcn.18010e270
mov word [rbx + rdi*2], r12w
jmp 0x180005c1d
mov qword [rsp + 0x20], 0xd
lea r9, str.opencommand
mov edx, 0xd
jmp 0x180005c13
cmp rax, 8
jb 0x180005bfe
lea rdi, [rcx + 8]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
mov r8d, 0x10
lea rdx, str.command
call fcn.18010e270
mov word [rbx + rdi*2], r12w
jmp 0x180005c1d
mov qword [rsp + 0x20], 8
lea r9, str.command
mov edx, 8
lea rcx, [rsp + 0x58]
call fcn.18000d6d0
mov ecx, 0x802
call fcn.1800efc54
mov rbx, rax
mov dword [rsp + 0x30], 0x800
test rax, rax
je 0x180005c95
xor edx, edx
mov r8d, 0x802
mov rcx, rax
call fcn.18010e6d0
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
lea r9, [rsp + 0x30]
mov r8, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x180005c8c
mov r8, r14
inc r8
cmp word [rbx + r8*2], 0
jne 0x180005c74
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.180004a10
mov rcx, rbx
call fcn.1800ef5a0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x180005cd5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005cd0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800061c8
call fcn.1800ef5a0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
cmp qword [rbp - 0x78], 0
ja 0x180005d70
mov ecx, 0x802
call fcn.1800efc54
mov rbx, rax
mov dword [rsp + 0x30], 0x800
test rax, rax
je 0x180005d65
xor edx, edx
mov r8d, 0x802
mov rcx, rax
call fcn.18010e6d0
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
lea r9, [rsp + 0x30]
mov r8, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x180005d5d
mov r8, r14
inc r8
cmp word [rbx + r8*2], 0
jne 0x180005d45
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.180004a10
mov rcx, rbx
call fcn.1800ef5a0
cmp qword [rbp - 0x78], 0
jbe 0x180005f24
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005d7d
mov rcx, qword [rsi]
lea rdx, str.2559A1F0_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005f10
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005da0
mov rcx, qword [rsi]
lea rdx, str.2559A1F1_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005f10
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005dc3
mov rcx, qword [rsi]
lea rdx, str.2559A1F2_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005f10
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005de6
mov rcx, qword [rsi]
lea rdx, str.2559A1F3_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005f10
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005e09
mov rcx, qword [rsi]
lea rdx, str.2559A1F5_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005f10
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005e2c
mov rcx, qword [rsi]
lea rdx, str.2559A1F6_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005f10
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005e4f
mov rcx, qword [rsi]
lea rdx, str.2559A1F7_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005f10
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005e72
mov rcx, qword [rsi]
lea rdx, str.871C5380_42A0_1069_A2EA_08002B30309D
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005f10
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str.http:
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005f10
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str.https:
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005f10
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str.www.
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180005f10
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, str..com
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180005f24
xor r8d, r8d
lea rdx, [0x180163940]
lea rcx, [rsp + 0x78]
call fcn.180004a10
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180005f31
mov rcx, qword [rsi]
lea rdx, str.2559A1F4_21D7_11D4_BDAF_00C04F60B9F0
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180006057
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp - 0x58], xmm1
mov word [rbp - 0x68], r12w
mov ecx, 0x802
call fcn.1800efc54
mov rbx, rax
mov dword [rsp + 0x30], 0x800
test rax, rax
je 0x180005fd2
xor edx, edx
mov r8d, 0x802
mov rcx, rax
call fcn.18010e6d0
lea r9, [rsp + 0x30]
mov r8, rbx
lea rdx, str.SoftwareClientsStartMenuInternet
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x180005fca
nop dword [rax + rax]
inc r14
cmp word [rbx + r14*2], 0
jne 0x180005fb0
mov r8, r14
mov rdx, rbx
lea rcx, [rbp - 0x68]
call fcn.180004a10
mov rcx, rbx
call fcn.1800ef5a0
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
lea rdx, str.2345Explorer.exe
call fcn.180111250
test eax, eax
jne 0x180006005
xor r8d, r8d
lea rdx, [0x180163940]
lea rcx, [rsp + 0x78]
call fcn.180004a10
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x180006045
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006040
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800061ce
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rbp - 0x58], xmm0
mov word [rbp - 0x68], r12w
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [r15 + 0x10], xmm1
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r12w
mov dword [rsp + 0x34], 1
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x1800060c3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800060be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800061d4
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r12w
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x180006117
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006112
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800061da
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x180006168
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006163
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800061b0
call fcn.1800ef5a0
mov word [rsp + 0x78], r12w
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r12
mov rcx, rsi
call fcn.180004980
mov rax, r15
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.1800ef540
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.180111064
int3
call fcn.180111064
nop
call fcn.180111064
nop
call fcn.180111064
nop
call fcn.180111064
int3
call fcn.180111064
nop
call fcn.180111064
nop
call fcn.180111064
int3