Function at 0x18000e810
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x1800312f8]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
lea edi, [r8 - 0xe]
mov qword [rsp + 0x48], rcx
mov r13, r9
mov r14d, r8d
mov r15, rdx
mov rax, rcx
cmp r8d, edi
jbe 0x18000eb1c
mov r12d, 0x63
lea ebx, [r8 - 0x4e]
lea rsi, [0x180000000]
mov edx, 0x6d6f
lea r8d, [r12 + 0xa]
nop dword [rax]
cmp ebx, 0x21
ja case.0x18000e89b.14
movzx eax, byte [rsi + rbx + 0xf0ac]
mov ecx, dword [rsi + rax*4 + 0xf070]
add rcx, rsi
jmp rcx
mov r8d, 0xa
lea rdx, [0x1800314f2]
mov ecx, 0x166
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltoa]
mov r8d, 0xa
lea rdx, [0x1800314f5]
lea ecx, [r8 - 1]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltoa]
jmp 0x18000eaff
mov r8d, 1
lea rdx, [0x18002cb9b]
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp - 0x43], 0
jmp 0x18000eaff
movzx eax, word [0x18002cbaf]
mov word [rbp - 0x1d], ax
movzx eax, byte [0x18002cbb1]
mov byte [rbp - 0x1b], al
mov byte [rbp - 0x1e], 0x46
mov byte [rbp - 0x1a], 0
jmp case.0x18000e89b.14
mov r8d, 1
lea rdx, str.wxArrayVideoModes::RemoveAt
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 5
mov byte [rbp - 0x4f], 0
lea rdx, [0x18002cc01]
lea rcx, [rbp - 0x4f]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp - 0x4a], 0
jmp 0x18000eaff
mov r8d, 1
lea rdx, [0x18002cc16]
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 4
lea rdx, [0x18002cc36]
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 1
mov byte [rbp - 0x45], 0
lea rdx, [0x18002cc6a]
lea rcx, [rbp - 0x45]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp - 0x44], 0
jmp 0x18000eaff
mov word [rbp - 0x40], r12w
jmp case.0x18000e89b.14
mov word [rbp - 0x43], 0x6d
jmp case.0x18000e89b.14
mov dword [rbp - 0x3f], 0x6d6d6f
jmp case.0x18000e89b.14
mov dword [rbp - 0x23], 0x544c5f34
mov word [rbp - 0x1f], 0x4f
jmp case.0x18000e89b.14
movzx eax, word [0x18002cc70]
lea rdx, [0x1800314ea]
mov r8d, 0xa
mov word [0x1800314e8], ax
movzx eax, byte [0x18002cc72]
mov byte [0x1800314ea], al
lea ecx, [r8 - 9]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
mov r8d, 0xa
lea rdx, [0x1800314eb]
lea ecx, [r8 + 0x1f]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
mov r8d, 0xa
lea rdx, [0x1800314ed]
lea ecx, [r8 - 5]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
mov r8d, 0xa
lea rdx, [0x1800314ee]
mov ecx, 0x2431
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
jmp 0x18000eaff
mov r8d, 3
mov byte [rbp - 0x30], 0
lea rdx, str.BFD_RELOC_390_TLS_IE32
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x18002cc93]
lea rcx, [rbp - 0x2d]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp - 0x2b], 0
jmp 0x18000eaff
movsd xmm0, qword [str.79323846]
lea rdx, [0x1800314fe]
movzx eax, byte [0x18002ccb0]
mov r8d, 0xa
movsd qword [0x1800314f6], xmm0
mov byte [0x1800314fe], al
lea ecx, [r8 + 0x10]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
jmp 0x18000eaff
mov r8d, 2
lea rdx, str.EL_disc_no_est
lea rcx, [rbp - 0x2b]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
movzx eax, word [0x18002cccf]
mov word [rbp - 0x29], ax
movzx eax, byte [0x18002ccd1]
mov byte [rbp - 0x27], al
movzx eax, word [0x18002ccfa]
mov word [rbp - 0x26], ax
movzx eax, byte [0x18002ccfc]
mov byte [rbp - 0x24], al
mov r8d, 0x6d
mov edx, 0x6d6f
dec ebx
lea eax, [rbx + 0x4e]
cmp eax, edi
ja 0x18000e880
mov rax, qword [rsp + 0x48]
imul r8d, r14d, 0xac6
mov dword [rsp + 0x34], r8d
cmp r14d, r8d
ja 0x18000f03e
mov r12, qword [rsp + 0x50]
lea rcx, [0x18001fba0]
imul r9d, r14d, 0xc5
mov ebx, 0x6e
mov edi, 0x544e
xor esi, esi
lea edx, [rbx - 9]
mov dword [rsp + 0x38], r9d
nop dword [rax + rax]
cmp r14d, 0xe050
ja 0x18000ef06
je 0x18000eec2
cmp r14d, 0x4b06
ja 0x18000ec91
je 0x18000ec30
cmp r14d, 0x53
je 0x18000ec19
cmp r14d, 0x61
je 0x18000ec07
cmp r14d, 0x4032
jne 0x18000f028
mov word [rbp - 0x55], bx
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x18000ebb2
lea rdx, [rbp - 0x50]
mov rcx, r13
call fcn.1800206c0
jmp 0x18000f012
mov r8d, 0xa
lea rdx, [0x180031500]
lea ecx, [r8 - 6]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
mov r8d, 0xa
lea rdx, [0x180031501]
lea ecx, [r8 - 7]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltoa]
lea rax, [0x1800314e8]
jmp 0x18000f043
mov word [rbp - 0x1a], 0x49
mov byte [rbp + 0xe0], 0
jmp 0x18000f028
mov word [rbp - 0x3c], dx
mov dword [rbp - 0x3b], 0x73746e
mov dword [rbp - 0x58], 0x6f736a
jmp 0x18000f028
mov r8d, 4
lea rdx, [0x18002cd8b]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 5
mov word [rbp + 0xe4], di
lea rdx, [0x18002cdab]
mov byte [rbp + 0xe6], 0
lea rcx, [rbp + 0xe0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 1
lea rdx, [0x18002cdc4]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18000f012
cmp r14d, 0x8011
je 0x18000ed75
cmp r14d, 0x95ab
je 0x18000ed43
cmp r14d, 0xbff0
jne 0x18000f028
lea rcx, [r13 + 0x20]
mov rdi, 0xffffffffffffffff
lea rax, [rbp - 0x58]
inc rdi
cmp byte [rax + rdi], 0
jne 0x18000ecc7
mov r8, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x10]
mov rax, r8
sub rax, rdx
cmp rdi, rax
ja 0x18000ed0d
lea rax, [rdx + rdi]
mov qword [rcx + 0x10], rax
cmp r8, 0x10
jb 0x18000ecf4
mov rcx, qword [rcx]
lea rbx, [rcx + rdx]
mov r8, rdi
mov rcx, rbx
lea rdx, [rbp - 0x58]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
jmp 0x18000ed21
lea r9, [rbp - 0x58]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
call fcn.180007d20
mov eax, 0x1bb
lea rdx, [r13 + 0x40]
mov ecx, 0x48
mov word [r13 + 0x60], ax
call fcn.18001aad0
mov edi, 0x544e
jmp 0x18000f012
mov r8d, 1
lea rdx, [0x18002cd17]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov byte [rsp + 0x30], 1
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x50], 0xffffffff80000001
jmp 0x18000f012
mov rcx, qword [r13 + 0x30]
lea rdi, [r13 + 0x20]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x18000eda2
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18000ed9a
mov rax, qword [rdi]
mov word [rax + rcx], 0x2f
jmp 0x18000edb4
xor r8d, r8d
mov r9b, 0x2f
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180007bc0
lea rax, [rbp - 0x40]
mov rsi, 0xffffffffffffffff
nop
inc rsi
cmp byte [rax + rsi], 0
jne 0x18000edc0
mov rcx, qword [rdi + 0x18]
mov rdx, qword [rdi + 0x10]
mov rax, rcx
sub rax, rdx
cmp rsi, rax
ja 0x18000ee09
lea rax, [rdx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rcx, 0x10
jb 0x18000edf0
mov rax, qword [rdi]
lea rbx, [rax + rdx]
mov r8, rsi
mov rcx, rbx
lea rdx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
jmp 0x18000ee20
lea r9, [rbp - 0x40]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.180007d20
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x18000ee49
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18000ee41
mov rax, qword [rdi]
mov word [rax + rcx], 0x2f
jmp 0x18000ee5b
xor r8d, r8d
mov r9b, 0x2f
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180007bc0
cmp qword [r15 + 0x18], 0x10
mov rdx, r15
jb 0x18000ee68
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
mov rcx, rdi
call fcn.180020330
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x18000eea4
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
cmp rdx, 0x10
jb 0x18000ee92
mov rdi, qword [rdi]
mov word [rdi + rcx], 0x2e
xor esi, esi
mov edi, 0x544e
jmp 0x18000f012
xor r8d, r8d
mov r9b, 0x2e
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180007bc0
xor esi, esi
mov edi, 0x544e
jmp 0x18000f012
movzx edi, word [rax]
mov ebx, 0x8b
nop word [rax + rax]
mov eax, ebx
sub eax, 0x8b
je 0x18000eee9
cmp eax, 0x3e
jne 0x18000eeee
mov rcx, qword [r15 + 0x10]
call fcn.180023e38
jmp 0x18000eeee
mov word [r15 + 8], di
add ebx, 0x37
cmp ebx, 0xf9
jb 0x18000eed0
mov r12, rsi
mov edi, 0x544e
jmp 0x18000f012
cmp r14d, 0x20ae4
ja 0x18000efb4
je 0x18000ef8e
cmp r14d, 0x12af5
je 0x18000ef74
cmp r14d, 0x1759a
je 0x18000ef68
cmp r14d, 0x1c03f
jne 0x18000f028
mov rax, qword [rsp + 0x60]
lea r9, [rsp + 0x70]
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x28], esi
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.GDI32.dll_CreateDIBSection]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x40], esi
jmp 0x18000f012
mov qword [r15], rcx
mov dword [rsp + 0x3c], esi
jmp 0x18000f028
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x68], rax
movups xmmword [rbp - 0x78], xmm0
mov dword [rbp - 0x60], eax
jmp 0x18000f028
movzx eax, byte [rsp + 0x30]
mov ecx, esi
mov rdx, qword [rsp + 0x68]
test rdx, rdx
cmovne ecx, eax
mov byte [rsp + 0x30], cl
cmp cl, 0
je 0x18000f01c
mov rcx, rdx
call qword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x18000f012
cmp r14d, 0x25589
je 0x18000efe8
cmp r14d, 0x2a02e
jne 0x18000f028
lea rcx, [r15 + 0xa]
cmp rcx, r13
je 0x18000f021
cmp qword [r13 + 0x18], 0x10
mov rdx, r13
jb 0x18000efdd
mov rdx, qword [r13]
mov r8, qword [r13 + 0x10]
call fcn.1800206c0
jmp 0x18000f012
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea r8, [rbp + 0xe0]
mov qword [rsp + 0x20], rsi
lea rdx, [rbp - 0x30]
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov r8d, dword [rsp + 0x34]
mov r9d, dword [rsp + 0x38]
mov edx, 0x65
lea rcx, [0x18001fba0]
mov rax, qword [rsp + 0x48]
add r14d, r9d
mov ebx, 0x6e
cmp r14d, r8d
jbe 0x18000eb60
mov rax, qword [rsp + 0x70]
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.1800245e0
mov rbx, qword [rsp + 0x340]
add rsp, 0x300
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret