Function at 0x18000d5d8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
xor ebx, ebx
mov ebp, edx
mov edx, 0x104
mov rsi, rcx
mov qword [rax - 0x80], rcx
mov rcx, qword [0x180052eb0]
mov r14, r8
mov dword [rsp + 0x44], edx
mov dword [rax - 0x68], edx
mov dword [rax - 0x64], edx
mov r8, rdx
xor edx, edx
mov rdi, r9
mov r13d, ebx
mov r12, rbx
mov qword [rsp + 0x60], rbx
mov r15, rbx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rbx
mov qword [rsp + 0x68], rax
je 0x18000dbdc
mov rcx, qword [0x180052eb0]
xor edx, edx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor ecx, ecx
cmp rax, rcx
mov rbx, rax
mov qword [rsp + 0x78], rax
je 0x18000db97
cmp qword [0x180052ef8], rcx
je 0x18000db97
mov rdx, qword [0x180053020]
lea r8, [rsp + 0x80]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
xor edi, edi
cmp eax, edi
jne 0x18000d82c
mov r12d, r13d
mov rax, qword [rsp + 0x68]
xor edx, edx
lea rcx, [rsp + 0x74]
lea r9, [rsp + 0x70]
mov r8, rbx
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0xea
mov r14d, eax
jne 0x18000d785
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x180052eb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x180052eb0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rsp + 0x44]
mov rcx, qword [0x180052eb0]
add eax, 0x104
xor edx, edx
mov r8d, eax
mov dword [rsp + 0x44], eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [0x180052eb0]
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edx, edx
mov rbx, rax
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x68]
cmp rax, rdx
je 0x18000d817
cmp rbx, rdx
jne 0x18000d6b9
jmp 0x18000d787
xor edx, edx
cmp r14d, edx
jne 0x18000d817
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, ebp
ja 0x18000d7cf
mov r9, qword [rsp + 0x68]
lea rax, [rsp + 0x40]
mov r8, rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov edx, ebp
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.18000d27c
mov r15, qword [rsp + 0x50]
mov r12d, dword [rsp + 0x40]
jmp 0x18000d7d4
mov eax, 0x57
xor ecx, ecx
cmp eax, ecx
jne 0x18000d80f
cmp rsi, qword [rsp + 0xe0]
je 0x18000d7f6
mov rcx, qword [0x180052eb0]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, r15
mov qword [rsp + 0x58], r15
mov ebp, r12d
mov dword [rsp + 0xe8], r12d
mov r13d, 1
add edi, 1
jmp 0x18000d6b2
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, qword [rsp + 0x60]
xor edi, edi
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x58]
call fcn.18000d010
mov ebp, dword [rsp + 0xe8]
mov rsi, qword [rsp + 0x58]
or r13d, eax
lea r9, [rsp + 0x50]
lea r8, [0x1800573b9]
mov edx, ebp
mov rcx, rsi
mov dword [rsp + 0x40], r13d
call fcn.18001a828
mov r14d, dword [rsp + 0xe0]
mov dword [rsp + 0x44], r14d
jmp 0x18000d9dc
mov edi, dword [rsp + 0x50]
xor r15d, r15d
cmp r12, r15
je 0x18000d8a5
cmp r14d, edi
jae 0x18000d8a0
mov rcx, qword [0x180052eb0]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, r15
cmp r12, r15
jne 0x18000d8ca
mov rcx, qword [0x180052eb0]
mov r8, rdi
xor edx, edx
mov r14d, edi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r15
mov r12, rax
je 0x18000d9ea
lea eax, [rdi - 6]
lea rdx, [r13 + 5]
mov rcx, r12
mov r8d, eax
mov ebx, eax
call sub.ntdll.dll_memcpy
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov rcx, r12
mov byte [rbx + r12], r15b
call fcn.180004abc
mov rcx, qword [0x180052eb0]
cmp eax, r15d
mov eax, dword [rsp + 0x48]
cmovne eax, r15d
xor edx, edx
mov dword [rsp + 0x48], eax
sub eax, edi
add eax, ebp
mov r8d, eax
mov dword [rsp + 0x58], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r15
mov rbx, rax
je 0x18000d9a5
mov r15d, r13d
mov rdx, rsi
mov rcx, rax
sub r15d, esi
mov r8d, r15d
call sub.ntdll.dll_memcpy
mov eax, dword [rsp + 0x48]
xor ecx, ecx
cmp eax, ecx
je 0x18000d95d
mov rdx, qword [rsp + 0x60]
mov ecx, r15d
mov r8, rax
add rcx, rbx
call sub.ntdll.dll_memcpy
mov eax, dword [rsp + 0x48]
mov ecx, eax
mov eax, r15d
sub ebp, r15d
add rcx, rax
sub ebp, edi
lea rdx, [r13 + rdi]
add rcx, rbx
mov r8d, ebp
call sub.ntdll.dll_memcpy
cmp rsi, qword [rsp + 0xe0]
je 0x18000d996
mov rcx, qword [0x180052eb0]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebp, dword [rsp + 0x58]
mov rsi, rbx
mov dword [rsp + 0x40], 1
xor edi, edi
cmp dword [rsp + 0x48], edi
je 0x18000d9c1
mov r8, qword [rsp + 0x60]
mov rcx, qword [0x180052eb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rbx, rdi
je 0x18000d9ec
lea r9, [rsp + 0x50]
lea r8, [0x1800573b9]
mov edx, ebp
mov rcx, rsi
call fcn.18001a828
cmp rax, rdi
mov r13, rax
jne 0x18000d87a
jmp 0x18000d9ec
xor edi, edi
lea r9, [rsp + 0x50]
lea r8, [0x1800573c1]
mov edx, ebp
mov rcx, rsi
call fcn.18001a828
cmp rax, rdi
mov r15, rax
je 0x18000db5f
cmp r12, rdi
mov r13d, dword [rsp + 0x50]
je 0x18000da37
cmp r14d, r13d
jae 0x18000da32
mov rcx, qword [0x180052eb0]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, rdi
cmp r12, rdi
jne 0x18000da5a
mov rcx, qword [0x180052eb0]
mov r8, r13
xor edx, edx
mov dword [rsp + 0x44], r13d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rdi
mov r12, rax
je 0x18000db7d
lea eax, [r13 - 9]
lea rdx, [r15 + 8]
mov rcx, r12
mov r8d, eax
mov ebx, eax
call sub.ntdll.dll_memcpy
mov dx, 0x3b
mov rcx, r12
mov byte [rbx + r12], dil
call qword [sym.imp.SHLWAPI.dll_StrChrA]
cmp rax, rdi
je 0x18000dab1
lea rcx, [rax + 1]
lea r8, [rsp + 0x58]
xor edx, edx
mov byte [rax], dil
call qword [sym.imp.SHLWAPI.dll_StrToIntExA]
cmp eax, edi
je 0x18000dab1
mov r8d, dword [rsp + 0x58]
lea rcx, [0x180053c60]
mov rdx, r12
call fcn.180007c08
mov rcx, qword [0x180052eb0]
mov r14d, ebp
xor edx, edx
sub r14d, r13d
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rdi
mov qword [rsp + 0x60], rax
je 0x18000db5f
mov ebx, r15d
mov rdx, rsi
mov rcx, rax
sub ebx, esi
mov r8d, ebx
mov edi, ebx
call sub.ntdll.dll_memcpy
sub ebp, ebx
mov rbx, qword [rsp + 0x60]
sub ebp, r13d
lea rdx, [r15 + r13]
lea rcx, [rdi + rbx]
mov r8d, ebp
call sub.ntdll.dll_memcpy
cmp rsi, qword [rsp + 0xe0]
je 0x18000db22
mov rcx, qword [0x180052eb0]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r9, [rsp + 0x50]
lea r8, [0x1800573c1]
mov r13d, 1
mov edx, r14d
mov rcx, rbx
mov rsi, rbx
mov ebp, r14d
mov dword [rsp + 0x40], r13d
call fcn.18001a828
mov r14d, dword [rsp + 0x44]
xor edi, edi
mov r15, rax
cmp rax, rdi
jne 0x18000da0e
jmp 0x18000db64
mov r13d, dword [rsp + 0x40]
cmp r12, rdi
je 0x18000db82
mov rcx, qword [0x180052eb0]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18000db82
mov r13d, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0xf8]
mov r14, qword [rsp + 0xf0]
mov rax, qword [rsp + 0x68]
xor r12d, r12d
cmp rax, r12
je 0x18000dbb6
mov rcx, qword [0x180052eb0]
mov r8, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rbx, r12
je 0x18000dbcd
mov rcx, qword [0x180052eb0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13d, r12d
je 0x18000dbdc
cmp rdi, r12
mov qword [r14], rsi
je 0x18000dbdc
mov dword [rdi], ebp
mov eax, r13d
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret