Function at 0x1800f1a70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], r12
mov rax, qword [0x18021dd90]
xor rax, rbp
mov qword [rbp + 8], rax
mov r12, r8
mov rsi, rcx
test rdx, rdx
je 0x1800f1ab8
or r9d, 0x20019
mov r8d, r9d
call fcn.1800f15b0
mov rbx, rax
jmp 0x1800f1abb
mov rbx, rcx
test rbx, rbx
je 0x1800f1cdd
call fcn.180127c90
test eax, eax
je 0x1800f1b90
lea rax, [rbp]
lea r9, [rbp + 4]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r12
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800f1cd0
mov eax, dword [rbp + 4]
cmp eax, 1
je 0x1800f1b19
cmp eax, 2
je 0x1800f1b19
cmp eax, 6
je 0x1800f1b19
cmp eax, 7
jne 0x1800f1cd0
mov ecx, dword [rbp]
add ecx, 2
call fcn.1800f8d24
mov r8d, dword [rbp]
xor edx, edx
add r8d, 2
mov rcx, rax
mov rdi, rax
call fcn.1800f8b90
lea r11, [rbp]
xor r9d, r9d
mov qword [rsp + 0x28], r11
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800f1b88
mov rcx, qword [rbp + 0x40]
mov rdx, rdi
call fcn.1800e5dc0
cmp rbx, rsi
je 0x1800f1b76
mov rcx, rbx
call fcn.1800f1630
mov rcx, rdi
call fcn.1800f8dc8
mov eax, 1
jmp 0x1800f1cdf
mov rcx, rdi
jmp 0x1800f1cbb
test r12, r12
je 0x1800f1c02
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [rax + rax + 2]
movsxd rax, edx
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800f1bb8
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1800fb440
sub rsp, rcx
lea rdi, [rsp + 0x40]
test rdi, rdi
je 0x1800f1c02
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], edx
xor edx, edx
or r9d, 0xffffffff
mov r8, r12
xor ecx, ecx
mov byte [rdi], 0
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x1800f1c04
xor edi, edi
lea rax, [rbp]
lea r9, [rbp + 4]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800f1cd0
mov eax, dword [rbp + 4]
cmp eax, 1
je 0x1800f1c4c
cmp eax, 2
je 0x1800f1c4c
cmp eax, 6
je 0x1800f1c4c
cmp eax, 7
jne 0x1800f1cd0
mov ecx, dword [rbp]
add ecx, 2
call fcn.1800f8d24
mov r8d, dword [rbp]
xor edx, edx
add r8d, 2
mov rcx, rax
mov r12, rax
call fcn.1800f8b90
lea r11, [rbp]
xor r9d, r9d
mov qword [rsp + 0x28], r11
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800f1cb8
mov rcx, qword [rbp + 0x40]
mov rdx, r12
call fcn.1800e9860
cmp rbx, rsi
je 0x1800f1ca9
mov rcx, rbx
call fcn.1800f1630
mov rcx, r12
call fcn.1800f8dc8
mov eax, 1
jmp 0x1800f1cdf
mov rcx, r12
call fcn.1800f8dc8
mov rcx, qword [rbp + 0x40]
lea rdx, [0x1801a6e60]
call fcn.1800e5dc0
cmp rbx, rsi
je 0x1800f1cdd
mov rcx, rbx
call fcn.1800f1630
xor eax, eax
mov rcx, qword [rbp + 8]
xor rcx, rbp
call fcn.1800f98f0
mov rbx, qword [rbp + 0x20]
mov rsi, qword [rbp + 0x28]
mov rdi, qword [rbp + 0x30]
mov r12, qword [rbp + 0x38]
lea rsp, [rbp + 0x10]
pop rbp
ret