Function at 0x180019870
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x18006e218]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
lea r9d, [r8 + 0x30c]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rcx
mov eax, r8d
mov dword [rsp + 0x38], eax
mov r14, rdx
mov dword [rsp + 0x34], r9d
mov r15, rcx
cmp r8d, r9d
jae 0x180019c39
mov rsi, qword [rsp + 0x40]
xor r10d, r10d
mov edi, dword [rsp + 0x34]
mov r12, qword [rsp + 0x40]
mov r13d, dword [rsp + 0x34]
mov ecx, 0x62
sub eax, 0x29
je 0x180019c15
sub eax, 0x42
je 0x180019b88
sub eax, 0x47
je 0x18001992d
sub eax, 0x13
je 0x180019923
cmp eax, 0x9c
jne 0x180019c23
cmp qword [r14 + 0x20], 0
setne al
jmp 0x180019c3e
cmp qword [r14 + 0x38], 0
jmp 0x180019c21
cmp byte [0x180071521], 0
je 0x180019c23
mov ebx, 0x63
lea r14d, [rbx - 0xc]
cmp ebx, 0x5955
ja 0x180019aea
je 0x180019ac2
cmp ebx, 0x63
je 0x180019a8e
cmp ebx, 0x122d
je 0x180019a2e
cmp ebx, 0x23f7
je 0x180019a02
cmp ebx, 0x35c1
je 0x1800199bb
cmp ebx, 0x478b
jne 0x180019b62
mov r8d, 3
mov word [rbp - 0x76], r10w
lea rdx, [0x1800639ba]
lea rcx, [rbp - 0x76]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov ecx, 0x73
xor r10d, r10d
mov word [rbp - 0x70], cx
lea ecx, [r10 + 0x62]
jmp 0x180019b62
movsd xmm0, qword [0x180063a36]
lea rdx, [0x180063a8e]
movzx eax, word [0x180063a3e]
lea rcx, [rsp + 0x78]
mov r8d, 3
movsd qword [rsp + 0x78], xmm0
mov word [rbp - 0x80], ax
mov word [rbp - 0x7e], r10w
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
xor r10d, r10d
mov word [rbp - 0x78], r14w
lea ecx, [r10 + 0x62]
jmp 0x180019b62
mov r8d, 1
mov dword [rsp + 0x72], 0x25
lea rdx, [0x1800633ac]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
xor r10d, r10d
lea ecx, [r10 + 0x62]
jmp 0x180019b62
mov eax, dword [0x180063978]
mov dword [rsp + 0x60], eax
movzx eax, word [0x18006397c]
mov word [rsp + 0x64], ax
lea rax, [rsp + 0x50]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x180019a50
movzx ecx, word [0x180063988]
movsd xmm0, qword [str.]
movsd qword [rax], xmm0
mov word [rax + 8], cx
mov ecx, 0x62
mov eax, dword [0x18006398c]
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x70], 0x20
jmp 0x180019b62
lea rax, [rsp + 0x50]
mov word [rsp + 0x50], r10w
sub rax, 2
nop dword [rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x180019aa0
movups xmm0, xmmword [str.CRL_Num]
movups xmmword [rax], xmm0
mov dword [rsp + 0x5e], 0x62
jmp 0x180019b62
mov r8d, 5
mov dword [rbp - 0x6e], 0x61
lea rdx, [0x180063aa4]
lea rcx, [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
xor r10d, r10d
lea ecx, [r10 + 0x62]
jmp 0x180019b62
cmp ebx, 0x6b1f
je 0x180019b58
cmp ebx, 0x7ce9
je 0x180019b33
cmp ebx, 0x8eb3
je 0x180019b19
cmp ebx, 0xa07d
jne 0x180019b62
call qword [0x180071508]
xor r10d, r10d
lea ecx, [r10 + 0x62]
jmp 0x180019b62
mov edx, 0x7f
xor ecx, ecx
lea r8d, [rdx - 0x7e]
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
xor r10d, r10d
lea ecx, [r10 + 0x62]
jmp 0x180019b62
lea r9, [rbp - 0x60]
mov dword [rsp + 0x20], r13d
lea r8, [rsp + 0x78]
mov rcx, r12
lea rdx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_SHRegGetPathW]
xor r10d, r10d
lea ecx, [r10 + 0x62]
jmp 0x180019b62
mov r12, 0xffffffff80000001
mov r13d, r10d
add ebx, 0x11ca
cmp ebx, 0xb1e4
jbe 0x180019943
mov r14, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
mov r9d, dword [rsp + 0x34]
jmp 0x180019c23
mov eax, dword [r15]
test eax, eax
jle 0x180019c39
cmp dword [r14], eax
jle 0x180019c6e
mov r8d, 0xe4
mov eax, r8d
sub eax, 0xe3
je 0x180019bea
cmp eax, 1
jne 0x180019bfe
movsxd rcx, dword [r15]
mov edi, r10d
mov rsi, qword [r14 + 0x10]
mov eax, dword [r14]
sub eax, ecx
lea rdx, [rsi + rcx*4]
test eax, eax
jle 0x180019bfe
nop dword [rax + rax]
mov eax, dword [rdx]
lea rdx, [rdx + 4]
mov dword [rsi], eax
inc edi
mov eax, dword [r14]
add rsi, 4
sub eax, dword [r15]
cmp edi, eax
jl 0x180019bd0
jmp 0x180019bfe
cmp edi, dword [r14]
jge 0x180019bfe
nop
mov dword [rsi], r10d
inc edi
add rsi, 4
cmp edi, dword [r14]
jl 0x180019bf0
dec r8d
cmp r8d, 0xe2
ja 0x180019ba2
mov eax, dword [r14]
sub eax, dword [r15]
mov dword [r14], eax
jmp 0x180019c23
cmp qword [r14 + 0x28], 0
je 0x180019c8d
cmp qword [r14 + 0x30], 0
je 0x180019c8d
mov eax, dword [rsp + 0x38]
add eax, 0x9c
mov dword [rsp + 0x38], eax
cmp eax, r9d
jb 0x1800198ea
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.18005b930
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x28], r10
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0xd8
mov rdx, r14
xor ecx, ecx
call fcn.18000a150
jmp 0x180019c39
xor al, al
jmp 0x180019c3e