Function at 0x18003d980
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1800ca088]
xor rax, rsp
mov qword [rbp - 8], rax
mov ebx, dword [rbp - 0x58]
lea r14d, [rcx - 7]
mov r15, r8
mov qword [rbp - 0x48], r9
xor r8d, r8d
mov esi, ecx
cmp ecx, r14d
jbe 0x18003da7e
lea edi, [rcx - 0x95]
movabs r13, 0x6200750053
lea r12, [0x180000000]
nop dword [rax + rax]
cmp edi, 0x11
ja case.0x18003d9f4.4
mov ecx, dword [r12 + rdi*4 + 0x3dc7c]
add rcx, r12
jmp rcx
movzx eax, byte [r15]
lea rdx, [rbp - 0x58]
mov dword [rbp - 0x40], eax
lea rcx, [rbp - 0x50]
mov eax, dword [r9]
mov r8d, 0xca
lea r9, [rbp - 0x40]
mov dword [rbp - 0x58], eax
call fcn.18000e720
mov r9, qword [rbp - 0x48]
xor r8d, r8d
jmp case.0x18003d9f4.4
mov r8d, 3
lea rdx, [0x1800b4acc]
lea rcx, [rbp - 0x20]
call fcn.180088aec
mov r9, qword [rbp - 0x48]
xor r8d, r8d
jmp case.0x18003d9f4.4
mov dword [rbp - 0x50], r8d
jmp case.0x18003d9f4.4
mov ebx, dword [rbp - 0x50]
jmp case.0x18003d9f4.4
mov rax, qword [r9]
mov qword [r8], rax
mov rax, qword [r15]
mov qword [8], rax
jmp case.0x18003d9f4.4
mov eax, dword [0x1800b4ad4]
mov dword [rbp - 0x1c], eax
mov qword [rbp - 0x18], r13
dec edi
lea eax, [rdi + 0x95]
cmp eax, r14d
ja 0x18003d9e0
movzx edx, byte [rbp - 0x60]
mov edi, esi
imul r14d, esi, 0x77
mov byte [rbp - 0x60], dl
cmp esi, r14d
ja 0x18003db6b
mov eax, 0x65
imul r15d, esi, 0x11
movabs r12, 0x75006c00610056
lea r13d, [rax - 9]
nop dword [rax + rax]
cmp edi, 0x21b8
ja 0x18003db2d
je 0x18003db26
cmp edi, 0xa6
je 0x18003db07
cmp edi, 0xbac
je 0x18003dadf
cmp edi, 0x16b2
jne 0x18003db5f
mov qword [rbp - 0x30], r12
jmp 0x18003db5f
mov r8d, 4
lea rdx, [0x1800b4af6]
lea rcx, [rbp - 0x38]
call fcn.180088aec
movzx edx, byte [rbp - 0x60]
xor r8d, r8d
mov word [rbp - 0x30], r8w
lea eax, [r8 + 0x65]
jmp 0x18003db5f
movzx eax, word [0x1800b4b78]
movsd xmm0, qword [str.Key_]
mov word [rbp - 0xa], ax
mov eax, 0x65
movsd qword [rbp - 0x12], xmm0
jmp 0x18003db5f
mov word [rbp - 0x28], r8w
jmp 0x18003db5f
cmp edi, 0x2cbe
je 0x18003db58
cmp edi, 0x37c4
je 0x18003db51
cmp edi, 0x42ca
jne 0x18003db5f
mov dl, 1
mov word [rbp - 0x24], r8w
mov byte [rbp - 0x60], dl
jmp 0x18003db5f
mov word [rbp - 0x26], r13w
jmp 0x18003db5f
mov dword [rbp - 0x28], 0x65
add edi, r15d
cmp edi, r14d
jbe 0x18003dab0
lea r13d, [rsi + 0x230]
cmp esi, r13d
jae case.0x18003d9f4.0
mov r14d, dword [rbp - 0x58]
mov rdi, qword [rbp - 0x48]
mov r15d, dword [rbp - 0x58]
mov r12, qword [rbp - 0x48]
nop dword [rax + rax]
cmp esi, 0x1e6
ja 0x18003dc0f
je 0x18003dbfb
mov eax, esi
sub eax, 0xa6
je 0x18003dbf2
sub eax, 0xa0
je 0x18003dbea
cmp eax, 0x50
jne 0x18003dc40
mov rax, qword [rbp - 0x48]
xor edx, edx
xor ecx, ecx
mov r8, qword [rax + 0x160]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, r15d
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x20]
mov rcx, r12
mov r14d, eax
call qword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
mov rdi, rax
jmp 0x18003dc3c
mov r15d, r8d
mov rdi, r8
jmp 0x18003dc40
mov r12, 0xffffffff80000001
jmp 0x18003dc40
movzx eax, dl
test rdi, rdi
mov ecx, r8d
cmovne ecx, eax
movzx edx, cl
mov byte [rbp - 0x60], cl
jmp 0x18003dc40
mov eax, esi
sub eax, 0x236
je 0x18003dc2f
cmp eax, 0x50
jne 0x18003dc40
cmp r14d, 0xb7
jne 0x18003dc40
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test dl, dl
je 0x18003dc40
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
movzx edx, byte [rbp - 0x60]
add esi, 0x50
cmp esi, r13d
jae case.0x18003d9f4.0
xor r8d, r8d
jmp 0x18003db90
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800803f0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret