Function at 0x1800ad900
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10a0]
mov eax, 0x11a0
call fcn.1800d61b0
sub rsp, rax
mov rax, qword [0x1801483c0]
xor rax, rsp
mov qword [rbp + 0x1090], rax
mov rdi, rdx
mov qword [rsp + 0x78], rdx
xor esi, esi
mov r14d, esi
mov dword [rsp + 0x64], esi
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x1800ad9fc
lea rdx, [0x1801491d8]
mov rcx, qword [0x1801491d8]
cmp rcx, rdx
je 0x1800ad9cc
test byte [rcx + 0x1c], 4
je 0x1800ad9cc
cmp byte [rcx + 0x19], 5
jb 0x1800ad9cc
mov edx, 0x1f2
mov r9d, eax
lea r8, [0x180126448]
mov rcx, qword [rcx + 0x10]
call fcn.18001fa80
mov rcx, qword [rbp + 0x1090]
xor rcx, rsp
call fcn.1800d5000
lea r11, [rsp + 0x11a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r15d, esi
mov dword [rsp + 0x70], esi
cmp dword [rsp + 0x68], esi
jbe 0x1800ad9cc
lea rbx, [0x1801491d8]
movabs r12, 0x7fffffffffffffff
mov r13d, 0x37
mov dword [rsp + 0x6c], 0xc8
mov dword [rsp + 0x60], 0x1000
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x6c]
lea r8, [rbp - 0x40]
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x1800ae065
cmp dword [rsp + 0x6c], eax
je 0x1800ae065
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
lea rax, [rbp - 0x40]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x1800ada91
cmp rdi, r12
ja 0x1800ae0b3
cmp rdi, 0xf
ja 0x1800adacc
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 0xf
mov r8, rdi
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x80]
call fcn.180100680
mov byte [rbp + rdi - 0x80], 0
jmp 0x1800adb17
mov rsi, rdi
or rsi, 0xf
cmp rsi, r12
jbe 0x1800adadd
mov rsi, r12
jmp 0x1800adaea
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
call fcn.180011160
mov rbx, rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rsi
mov r8, rdi
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.180100680
mov byte [rbx + rdi], 0
xor esi, esi
mov r8d, 2
lea rdx, [0x180122260]
lea rcx, [rbp - 0x80]
call fcn.18001eb30
mov ebx, dword [rsp + 0x60]
lea rdi, [rbp + 0x90]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
or r14d, 1
mov dword [rsp + 0x64], r14d
lea rdx, [rbx + rbx]
test rdx, rdx
jne 0x1800adb73
mov qword [rbp - 0x50], rdx
mov byte [rbp + rdx - 0x60], dl
jmp 0x1800adb87
lfence
xor r8d, r8d
lea rcx, [rbp - 0x60]
call fcn.18001bec0
mov r14d, dword [rsp + 0x64]
lea rdx, [rbp - 0x60]
mov rax, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x48]
cmp rcx, 0xf
cmova rdx, rax
test rbx, rbx
je 0x1800adbe3
movzx ecx, byte [rdi]
shr ecx, 4
mov eax, 0x30
cmp ecx, 0xa
cmovae eax, r13d
add al, cl
mov byte [rdx], al
movzx ecx, byte [rdi]
and ecx, 0xf
mov eax, 0x30
cmp ecx, 0xa
cmovae eax, r13d
add al, cl
mov byte [rdx + 1], al
lea rdx, [rdx + 2]
lea rdi, [rdi + 1]
sub rbx, 1
jne 0x1800adba0
mov rcx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x60]
lea rdx, [rbp - 0x60]
cmp rcx, 0xf
cmova rdx, rax
mov r8, qword [rbp - 0x50]
lea rcx, [rbp - 0x80]
call fcn.18001eb30
and r14d, 0xfffffffe
mov dword [rsp + 0x64], r14d
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x1800adc40
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800adc3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800ae0b9
call fcn.1800d504c
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
mov r8d, 3
lea rdx, [0x180126340]
lea rcx, [rbp - 0x80]
call fcn.18001eb30
mov r13d, esi
cmp dword [rsp + 0x60], 0
jbe 0x1800adfb8
nop dword [rax]
nop dword [rax + rax]
mov eax, r13d
movzx r15d, byte [rbp + rax + 0x90]
test r15b, r15b
jne 0x1800addc0
test r13d, r13d
je 0x1800adf9e
lea edx, [r13 + 1]
cmp edx, dword [rsp + 0x60]
jae 0x1800adf9e
lea eax, [r13 - 1]
cmp byte [rbp + rax + 0x90], r15b
jne 0x1800adf9e
cmp byte [rbp + rdx + 0x90], r15b
jne 0x1800adf9e
mov rdi, qword [rbp - 0x70]
mov rsi, qword [rbp - 0x68]
cmp rdi, rsi
jae 0x1800adcf9
lea rax, [rdi + 1]
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x80]
cmp rsi, 0xf
cmova rax, qword [rbp - 0x80]
mov word [rax + rdi], 0x7c
jmp 0x1800adf9e
mov rax, r12
sub rax, rdi
cmp rax, 1
jb 0x1800ae0bf
lea r15, [rdi + 1]
mov rbx, r15
or rbx, 0xf
cmp rbx, r12
jbe 0x1800add1e
mov rbx, r12
jmp 0x1800add3f
mov rcx, rsi
shr rcx, 1
mov rax, r12
sub rax, rcx
cmp rsi, rax
jbe 0x1800add34
mov rbx, r12
jmp 0x1800add3f
lea rax, [rsi + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.180011160
mov r14, rax
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], rbx
mov r8, rdi
mov rcx, rax
cmp rsi, 0xf
jbe 0x1800addab
mov rbx, qword [rbp - 0x80]
mov rdx, rbx
call fcn.180100680
mov word [r14 + rdi], 0x7c
lea rdx, [rsi + 1]
cmp rdx, 0x1000
jb 0x1800add9b
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1800ae0b9
mov rbx, rcx
lfence
mov rcx, rbx
call fcn.1800d504c
jmp 0x1800adf9a
lea rdx, [rbp - 0x80]
call fcn.180100680
mov word [r14 + rdi], 0x7c
jmp 0x1800adf9a
lea eax, [r15 - 0x20]
mov rdi, qword [rbp - 0x70]
mov rsi, qword [rbp - 0x68]
cmp al, 0x5e
ja 0x1800adee7
cmp rdi, rsi
jae 0x1800addfc
lea rax, [rdi + 1]
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x80]
cmp rsi, 0xf
cmova rax, qword [rbp - 0x80]
mov byte [rax + rdi], r15b
mov byte [rax + rdi + 1], 0
jmp 0x1800adf9e
mov rax, r12
sub rax, rdi
cmp rax, 1
jb 0x1800ae0bf
lea r12, [rdi + 1]
mov rbx, r12
or rbx, 0xf
movabs rdx, 0x7fffffffffffffff
cmp rbx, rdx
jbe 0x1800ade2b
mov rbx, rdx
jmp 0x1800ade4c
mov rcx, rsi
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp rsi, rax
jbe 0x1800ade41
mov rbx, rdx
jmp 0x1800ade4c
lea rax, [rsi + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.180011160
mov r14, rax
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], rbx
mov r8, rdi
mov rcx, rax
cmp rsi, 0xf
jbe 0x1800adec5
mov rbx, qword [rbp - 0x80]
mov rdx, rbx
call fcn.180100680
mov byte [rdi + r14], r15b
mov byte [rdi + r14 + 1], 0
lea rdx, [rsi + 1]
cmp rdx, 0x1000
jb 0x1800adeab
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1800ae0b9
mov rbx, rcx
lfence
mov rcx, rbx
call fcn.1800d504c
movabs r12, 0x7fffffffffffffff
jmp 0x1800adf9a
lea rdx, [rbp - 0x80]
call fcn.180100680
mov byte [rdi + r14], r15b
mov byte [rdi + r14 + 1], 0
movabs r12, 0x7fffffffffffffff
jmp 0x1800adf9a
cmp rdi, rsi
jae 0x1800adf0c
lea rax, [rdi + 1]
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x80]
cmp rsi, 0xf
cmova rax, qword [rbp - 0x80]
mov word [rax + rdi], 0x2e
jmp 0x1800adf9e
mov rax, r12
sub rax, rdi
cmp rax, 1
jb 0x1800ae0bf
lea r15, [rdi + 1]
mov rbx, r15
or rbx, 0xf
cmp rbx, r12
jbe 0x1800adf31
mov rbx, r12
jmp 0x1800adf52
mov rcx, rsi
shr rcx, 1
mov rax, r12
sub rax, rcx
cmp rsi, rax
jbe 0x1800adf47
mov rbx, r12
jmp 0x1800adf52
lea rax, [rcx + rsi]
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.180011160
mov r14, rax
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], rbx
mov r8, rdi
mov rcx, rax
cmp rsi, 0xf
jbe 0x1800adf8a
mov rbx, qword [rbp - 0x80]
mov rdx, rbx
call fcn.180100680
mov word [r14 + rdi], 0x2e
jmp 0x1800add72
lea rdx, [rbp - 0x80]
call fcn.180100680
mov word [r14 + rdi], 0x2e
mov qword [rbp - 0x80], r14
inc r13d
cmp r13d, dword [rsp + 0x60]
jb 0x1800adc80
mov r14d, dword [rsp + 0x64]
mov r15d, dword [rsp + 0x70]
xor esi, esi
mov r8d, 1
lea rdx, [0x180123490]
lea rcx, [rbp - 0x80]
call fcn.18001eb30
mov rcx, qword [0x1801491d8]
lea rbx, [0x1801491d8]
cmp rcx, rbx
je 0x1800ae011
test byte [rcx + 0x1c], 4
je 0x1800ae011
cmp byte [rcx + 0x19], 4
jb 0x1800ae011
lea r9, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r9, qword [rbp - 0x80]
mov edx, 0x1f4
lea r8, [0x180126448]
mov rcx, qword [rcx + 0x10]
call fcn.18002b820
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x1800ae048
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ae043
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800ae0ad
call fcn.1800d504c
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rdi, qword [rsp + 0x78]
mov r13d, 0x37
jmp 0x1800ae095
mov rcx, qword [0x1801491d8]
cmp rcx, rbx
je 0x1800ae095
test byte [rcx + 0x1c], 4
je 0x1800ae095
cmp byte [rcx + 0x19], 5
jb 0x1800ae095
mov edx, 0x1f3
mov r9d, eax
lea r8, [0x180126448]
mov rcx, qword [rcx + 0x10]
call fcn.18001fa80
inc r15d
mov dword [rsp + 0x70], r15d
cmp r15d, dword [rsp + 0x68]
jb 0x1800ada20
jmp 0x1800ad9cc
call fcn.1800dbd50
int3
call fcn.180014060
nop
call fcn.1800dbd50
int3
call fcn.180014060
int3