Function at 0x180177970
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x310
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov dword [rsp + 0x30], 0
lea rax, str.AppData
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xf0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov qword [rsp + 0x48], 0
mov eax, 0x53
mov word [rsp + 0x60], ax
mov eax, 0x4f
mov word [rsp + 0x62], ax
mov eax, 0x46
mov word [rsp + 0x64], ax
mov eax, 0x54
mov word [rsp + 0x66], ax
mov eax, 0x57
mov word [rsp + 0x68], ax
mov eax, 0x41
mov word [rsp + 0x6a], ax
mov eax, 0x52
mov word [rsp + 0x6c], ax
mov eax, 0x45
mov word [rsp + 0x6e], ax
mov eax, 0x5c
mov word [rsp + 0x70], ax
mov eax, 0x4d
mov word [rsp + 0x72], ax
mov eax, 0x69
mov word [rsp + 0x74], ax
mov eax, 0x63
mov word [rsp + 0x76], ax
mov eax, 0x72
mov word [rsp + 0x78], ax
mov eax, 0x6f
mov word [rsp + 0x7a], ax
mov eax, 0x73
mov word [rsp + 0x7c], ax
mov eax, 0x6f
mov word [rsp + 0x7e], ax
mov eax, 0x66
mov word [rsp + 0x80], ax
mov eax, 0x74
mov word [rsp + 0x82], ax
mov eax, 0x5c
mov word [rsp + 0x84], ax
mov eax, 0x57
mov word [rsp + 0x86], ax
mov eax, 0x69
mov word [rsp + 0x88], ax
mov eax, 0x6e
mov word [rsp + 0x8a], ax
mov eax, 0x64
mov word [rsp + 0x8c], ax
mov eax, 0x6f
mov word [rsp + 0x8e], ax
mov eax, 0x77
mov word [rsp + 0x90], ax
mov eax, 0x73
mov word [rsp + 0x92], ax
mov eax, 0x5c
mov word [rsp + 0x94], ax
mov eax, 0x43
mov word [rsp + 0x96], ax
mov eax, 0x75
mov word [rsp + 0x98], ax
mov eax, 0x72
mov word [rsp + 0x9a], ax
mov eax, 0x72
mov word [rsp + 0x9c], ax
mov eax, 0x65
mov word [rsp + 0x9e], ax
mov eax, 0x6e
mov word [rsp + 0xa0], ax
mov eax, 0x74
mov word [rsp + 0xa2], ax
mov eax, 0x56
mov word [rsp + 0xa4], ax
mov eax, 0x65
mov word [rsp + 0xa6], ax
mov eax, 0x72
mov word [rsp + 0xa8], ax
mov eax, 0x73
mov word [rsp + 0xaa], ax
mov eax, 0x69
mov word [rsp + 0xac], ax
mov eax, 0x6f
mov word [rsp + 0xae], ax
mov eax, 0x6e
mov word [rsp + 0xb0], ax
mov eax, 0x5c
mov word [rsp + 0xb2], ax
mov eax, 0x45
mov word [rsp + 0xb4], ax
mov eax, 0x78
mov word [rsp + 0xb6], ax
mov eax, 0x70
mov word [rsp + 0xb8], ax
mov eax, 0x6c
mov word [rsp + 0xba], ax
mov eax, 0x6f
mov word [rsp + 0xbc], ax
mov eax, 0x72
mov word [rsp + 0xbe], ax
mov eax, 0x65
mov word [rsp + 0xc0], ax
mov eax, 0x72
mov word [rsp + 0xc2], ax
mov eax, 0x5c
mov word [rsp + 0xc4], ax
mov eax, 0x53
mov word [rsp + 0xc6], ax
mov eax, 0x68
mov word [rsp + 0xc8], ax
mov eax, 0x65
mov word [rsp + 0xca], ax
mov eax, 0x6c
mov word [rsp + 0xcc], ax
mov eax, 0x6c
mov word [rsp + 0xce], ax
mov eax, 0x20
mov word [rsp + 0xd0], ax
mov eax, 0x46
mov word [rsp + 0xd2], ax
mov eax, 0x6f
mov word [rsp + 0xd4], ax
mov eax, 0x6c
mov word [rsp + 0xd6], ax
mov eax, 0x64
mov word [rsp + 0xd8], ax
mov eax, 0x65
mov word [rsp + 0xda], ax
mov eax, 0x72
mov word [rsp + 0xdc], ax
mov eax, 0x73
mov word [rsp + 0xde], ax
xor eax, eax
mov word [rsp + 0xe0], ax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180177d4c
mov dword [rsp + 0x50], 0x208
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x320]
call fcn.180033860
nop
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x320]
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x310
pop rdi
ret