Function at 0x180001d60
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x4b0
mov rax, qword [0x180018018]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 0x11c
xor ebx, ebx
call fcn.180002b80
mov rax, qword [str.ntdll.dll]
lea r11, [rsp + 0x1e0]
lea edx, [rbx + 0xd]
lea rcx, section..data
mov qword [r11], rax
movzx eax, word [0x1800135b0]
mov dword [rsp + 0xc0], 0x11c
mov word [r11 + 8], ax
call fcn.180001ba0
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, section..data
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x18000212b
mov ecx, 0xfffffff5
mov qword [rsp + 0x4c0], rdi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rsp + 0xa8]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x180001e44
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetConsoleScreenBufferInfo___d__n
mov edx, eax
call fcn.1800029fc
movzx eax, bx
mov word [rsp + 0xb4], bx
jmp 0x180001e4c
mov ax, word [rsp + 0xb4]
cmp ax, 1
jl 0x180001e93
or eax, 0xffffffff
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, rdi
mov word [rsp + 0x70], bx
mov word [rsp + 0x74], bx
mov word [rsp + 0x72], ax
mov word [rsp + 0x76], ax
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
test eax, eax
jne 0x180001e9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.SetConsoleWindowInfo___d__n
mov edx, eax
call fcn.1800029fc
jmp 0x180001e9f
lea rcx, str._nCannot_scroll__the_window_is_too_close_to_the_top._n
call fcn.1800029fc
lea rcx, [rsp + 0xc0]
call rsi
test eax, eax
jne 0x1800020fa
lea esi, [rax + 1]
mov eax, dword [rsp + 0xc4]
cmp eax, 6
jb 0x1800020a1
lea rax, [rsp + 0x80]
lea rdx, str.SOFTWAREMicrosoft
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180002082
lea rcx, [rsp + 0x1f1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x1f0], bl
call fcn.180002b80
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x98]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x1f0]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xa4]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x78], 0x104
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov dword [rsp + 0x64], 0xc8
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov r11d, dword [rsp + 0x60]
test r11d, r11d
je 0x180002019
mov edi, ebx
test r11d, r11d
je 0x180002019
nop word [rax + rax]
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x98]
lea r9, [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x3d0]
mov edx, edi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x88], 0xc8
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x180002011
inc dword [0x180019c7c]
inc edi
cmp edi, dword [rsp + 0x60]
jb 0x180001fc0
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x180002082
mov edi, ebx
test eax, eax
je 0x180002082
nop word [rax + rax]
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x64]
lea r8, [rsp + 0x300]
mov edx, edi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x64], 0xc8
mov byte [rsp + 0x300], bl
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x18000207a
inc dword [0x180019c78]
inc edi
cmp edi, dword [rsp + 0x68]
jb 0x180002030
mov eax, dword [0x180019a8c]
mov ebx, esi
cmp dword [rsp + 0xc8], ebx
cmova eax, esi
mov dword [0x180019a8c], eax
mov eax, dword [rsp + 0xc4]
cmp eax, 6
jbe 0x1800020fa
pxor xmm0, xmm0
lea rcx, [0x180019c70]
mov ecx, ecx
cvtsi2sd xmm0, rcx
call fcn.180003ae8
lea rcx, [0x180013588]
movsd qword [0x180019c68], xmm0
call fcn.180003ae0
movsd xmm1, qword [0x180019c70]
movsd qword [0x180019c60], xmm0
call fcn.180003d74
mov dword [0x180019a8c], esi
mov dword [0x180019b94], esi
movsd qword [0x180019c68], xmm0
mov rdi, qword [rsp + 0x4c0]
mov dword [0x180019b98], ebx
mov eax, ebx
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.180002890
mov rbx, qword [rsp + 0x4c8]
add rsp, 0x4b0
pop rsi
ret
mov dword [0x180019b98], ebx
mov eax, ebx
jmp 0x18000210a