Function at 0x180166040
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp + 0x130], rax
mov r14, r8
mov rdi, rdx
mov r15, rcx
mov ecx, pe_nt_image_headers64
call fcn.1801e6100
mov rsi, rax
mov rbx, rax
mov qword [rsp + 0x58], rax
xor r12d, r12d
mov dword [rbp + 0x44], r12d
mov dword [rbp + 0x40], pe_nt_image_headers64
add rdi, 8
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1801660a8
mov rdx, qword [rdi]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x44]
xor r8d, r8d
mov rcx, qword [r15 + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
jne 0x18016611c
mov ecx, dword [rbp + 0x40]
inc ecx
call fcn.1801e6100
mov rbx, rax
mov qword [rsp + 0x58], rax
test rsi, rsi
je 0x1801660ed
mov rcx, rsi
call fcn.1801e60f0
cmp qword [rdi + 0x18], 0x10
jb 0x1801660f7
mov rdi, qword [rdi]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x44]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r15 + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rsi, rbx
cmp eax, 2
je 0x1801662b2
mov eax, dword [rbp + 0x44]
cmp eax, 1
jne 0x1801661f4
call fcn.1800f2320
mov rdx, rax
mov rcx, r14
call fcn.1800f11e0
movzx eax, byte [rbx]
test al, al
je 0x180166219
lea rdi, [0x1800567d8]
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], sendto
mov byte [rsp + 0x38], 0
movzx r8d, al
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.1800998d0
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
lea rcx, [r14 + 8]
call fcn.180099630
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x1801661e5
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801661df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180166242
call fcn.1801e60f0
nop
inc rsi
movzx eax, byte [rsi]
test al, al
je 0x180166219
jmp 0x180166160
cmp eax, 4
jne 0x180166248
lea rax, [r14 + 8]
mov qword [rax + 0x10], r12
cmp qword [rax + 0x18], 0x10
jb 0x18016620b
mov rax, qword [rax]
mov byte [rax], r12b
mov edx, dword [rbx]
mov rcx, r14
call fcn.1800b8f60
nop
mov rcx, rbx
call fcn.1801e60f0
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x240
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18010f960
nop
mov edx, 0xd8
lea rcx, [rbp + 0x50]
call fcn.180099460
call fcn.1800f2320
mov rsi, rax
call fcn.1800f2320
mov rdi, rax
call fcn.1800f2320
mov rbx, rax
call fcn.1800f2320
mov r8, rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov edx, 0x47a
lea rcx, [rbp + 0x50]
call fcn.1800f8aa0
nop
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.1800f88a0
lea rdx, [0x18027f0a8]
lea rcx, [rsp + 0x60]
call fcn.18020a9f0
nop
call fcn.1800f2320
mov rsi, rax
call fcn.1800f2320
mov rdi, rax
call fcn.1800f2320
mov rbx, rax
call fcn.1800f2320
mov r8, rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov edx, 0x47b
lea rcx, [rbp + 0x50]
call fcn.1800f8aa0
lea rdx, [0x18027f0a8]
lea rcx, [rbp + 0x50]
call fcn.18020a9f0
int3