Function at 0x18000ae74
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov rax, qword [0x180066008]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rdi, r8
mov r14, rdx
mov rsi, qword [rsp + 0x310]
mov r15d, 1
mov dword [rsp + 0x78], r15d
mov r13, 0xffffffff80000002
mov qword [rsp + 0x60], r13
xor ebx, ebx
mov qword [rsp + 0x68], rbx
mov r12d, 0x104
mov r8d, r12d
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.18001d0d0
mov r8d, r12d
xor edx, edx
lea rcx, [rsp + 0x1a0]
call fcn.18001d0d0
nop
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18000af22
or ebx, 0xffffffff
jmp 0x18000b14e
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x18000b14e
cmp eax, 2
jbe 0x18000b104
cmp eax, 3
je 0x18000b0c5
cmp eax, 4
je 0x18000b06b
cmp eax, 7
jne 0x18000b14e
mov dword [rsp + 0x70], r12d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000b14e
lea r8, [rsp + 0x90]
cmp byte [r8], bl
je 0x18000b05e
mov edx, r12d
mov dword [rsp + 0x30], edx
mov r9, r8
mov qword [rsp + 0x50], r8
lea rcx, [rsp + 0x1a0]
mov qword [rsp + 0x40], rcx
cmp byte [rcx], bl
je 0x18000afc7
add rcx, r15
mov qword [rsp + 0x40], rcx
jmp 0x18000afb9
mov eax, edx
sub edx, r15d
mov dword [rsp + 0x30], edx
test eax, eax
je 0x18000afef
mov al, byte [r9]
mov byte [rcx], al
add rcx, r15
mov qword [rsp + 0x40], rcx
add r9, r15
mov qword [rsp + 0x50], r9
test al, al
je 0x18000afef
jmp 0x18000afc7
mov byte [rcx], 0x30
mov edx, r12d
mov dword [rsp + 0x38], edx
lea r9, [0x18005d178]
mov qword [rsp + 0x58], r9
lea rcx, [rsp + 0x1a0]
mov qword [rsp + 0x48], rcx
cmp byte [rcx], bl
je 0x18000b020
add rcx, r15
mov qword [rsp + 0x48], rcx
jmp 0x18000b012
mov eax, edx
sub edx, r15d
mov dword [rsp + 0x38], edx
test eax, eax
je 0x18000b048
mov al, byte [r9]
mov byte [rcx], al
add rcx, r15
mov qword [rsp + 0x48], rcx
add r9, r15
mov qword [rsp + 0x58], r9
test al, al
je 0x18000b048
jmp 0x18000b020
mov byte [rcx], 0x30
xor edx, edx
mov rcx, r8
call fcn.18001ce6c
lea r8, [r15 + rax]
jmp 0x18000af94
lea rdx, [rsp + 0x1a0]
jmp 0x18000b142
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000b14e
mov r8d, dword [rsp + 0x80]
lea rdx, [0x18005c948]
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x18000b14b
mov dword [rsp + 0x70], 0x100
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000b14e
mov r8d, dword [rsp + 0x78]
lea rdx, [0x18005d17c]
jmp 0x18000b0b7
mov dword [rsp + 0x70], r12d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000b14e
lea rdx, [rsp + 0x90]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, r15d
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.18000b240
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret