Function at 0x140018780
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x14007f080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
add rcx, 0x31b0
call fcn.140002ef0
xor ecx, ecx
mov dword [rbx + 0x3229], 0
lea rax, [rsp + 0x64]
mov word [rbx + 0x3161], cx
mov qword [rsp + 0x40], rax
lea rdx, str.SoftwareProcessLasso
lea rax, [rsp + 0x50]
mov byte [rbx + 0x3163], cl
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov word [rbx + 0x3167], cx
mov byte [rbx + 0x3189], cl
mov word [rbx + 0x3182], cx
mov byte [rbx + 0x31a4], cl
mov byte [rbx + 0x319c], cl
mov byte [rbx + 0x317e], cl
mov qword [rbx + 0x3190], rcx
mov dword [rsp + 0x5c], ecx
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000001
mov byte [rbx + 0x322d], 1
mov dword [rbx + 0x3230], 0x400
mov qword [rbx + 0x3234], 0xf
mov byte [rbx + 0x36b8], 1
mov dword [rbx + 0x31c0], 0x1388
mov byte [rbx + 0x3240], 1
mov word [rbx + 0x31a2], 0x100
mov word [rbx + 0x3164], 1
mov word [rbx + 0x31d0], 0x100
mov dword [rbx + 0x319d], 0x1000000
mov dword [rbx + 0x313c], 0x3e8
mov dword [rbx + 0x3140], 0x3e8
mov dword [rbx + 0x316a], 0x1000100
mov dword [rbx + 0x3174], 0x10000
mov dword [rbx + 0x316e], 0x1000101
mov byte [rbx + 0x3172], 1
mov byte [rbx + 0x3169], 1
mov dword [rbx + 0x3158], 0x1fa4
mov word [rbx + 0x317c], 1
mov byte [rbx + 0x317a], 1
mov dword [rbx + 0x3144], 0x2710
mov word [rbx + 0x317f], 1
mov dword [rbx + 0x3184], 1
mov dword [rbx + 0x31a5], 0x1010101
mov byte [rbx + 0x31a1], 1
mov byte [rbx + 0x31cd], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140018982
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x5c]
mov dword [rsp + 0x58], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ThemeLocked
mov dword [rsp + 0x60], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140018977
cmp dword [rsp + 0x58], 4
jne 0x140018977
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x5c], 0
setne cl
jmp 0x140018984
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor cl, cl
mov eax, 0x31c4
mov rdx, rbx
mov byte [rbx + rax], cl
mov rcx, rbx
mov dword [rbx + 0x31c5], 0x1010101
mov dword [rbx + 0x31c9], 0x1010101
mov byte [rbx + 0x31ce], 1
mov word [rbx + 0x31d3], 0x101
mov byte [rbx + 0x3179], 0
mov dword [rbx + 0x315c], 0x7530
mov byte [rbx + 0x3160], 0
call fcn.1400281a0
xorps xmm0, xmm0
mov word [rbx + 0x31f8], 0x100
mov byte [rbx + 0x31fa], 1
lea rcx, [rbx + 0x3288]
mov byte [rbx + 0x31d2], 0
lea rdx, str.Bitsum_Highest_Performance
mov dword [rbx + 0x31fc], 0x12c
mov r8, 0xffffffffffffffff
movups xmmword [rbx + 0x3200], xmm0
mov byte [rbx + 0x3228], 1
mov byte [rbx + 0x31cf], 1
inc r8
cmp word [rdx + r8*2], 0
jne 0x140018a21
call fcn.140002da0
lea rcx, [rbx + 0x31e0]
mov dword [rbx + 0x31b8], 0x41
mov dword [rbx + 0x31bc], 0xc4
mov byte [rbx + 0x31d5], 0
mov dword [rbx + 0x31d8], 0x384
call fcn.140002ef0
mov rcx, rbx
mov dword [rbx + 0x323c], 0x8000
mov byte [rbx + 0x3173], 0
mov byte [rbx + 0x3178], 1
call fcn.14002a170
mov rcx, rbx
call fcn.140018aa0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14003f1d0
add rsp, 0x70
pop rbx
ret