Function at 0x1800108d0
Capabilities:
Query or enumerate registry key
Set registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x650
mov qword [rsp + 0x140], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x18002fa78]
xor rax, rsp
mov qword [rsp + 0x640], rax
mov r14, rcx
mov qword [r11 - 0x530], rcx
xor r15d, r15d
mov qword [r11 - 0x5c8], r15
mov dword [r11 - 0x5c0], r15d
mov qword [r11 - 0x5d8], r15
mov dword [r11 - 0x5d0], r15d
lea rcx, [0x18002f9d0]
mov rax, qword [0x18002f9d0]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExtSettings_
or rbp, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x180010987
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.1800010c0
test rax, rax
je 0x1800109a4
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.180002540
jmp 0x1800109a4
xor eax, eax
mov rcx, rbp
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x70]
call fcn.1800020b0
nop
mov rdx, qword [r14]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x70]
call fcn.180002440
mov qword [rsp + 0xc0], r15
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, [0x18002545c]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180010a03
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], r15d
mov word [rsp + 0x430], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x432]
call fcn.180012c40
mov dword [rsp + 0x98], 0x104
mov dword [rsp + 0x60], r15d
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xcc]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xd4]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x430]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [rsp + 0x60], 0
je 0x180010ebc
lea rcx, [rsp + 0x150]
call fcn.180004530
nop
mov r13d, r15d
cmp dword [rsp + 0x60], r15d
jbe 0x180010eae
nop
mov dword [rsp + 0x88], 0xff
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x230]
mov edx, r13d
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180010e89
lea rcx, [0x18002f9d0]
mov rax, qword [0x18002f9d0]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
lea rcx, [rsp + 0x230]
lea rax, [rsp + 0x230]
test rax, 0xffffffffffff0000
jne 0x180010b91
movzx edi, cx
xor edx, edx
mov ecx, edi
call fcn.1800010c0
test rax, rax
je 0x180010c98
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.180002540
mov rbx, qword [rsp + 0x68]
jmp 0x180010c98
xor eax, eax
mov rcx, rbp
lea rdi, [rsp + 0x230]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x180010c06
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x180010c98
cmp dword [rdx + 0x10], eax
jge 0x180010bd9
cmp dword [rbx - 0xc], eax
jl 0x180010e98
mov dword [rbx - 0x10], r15d
mov word [rbx], r15w
jmp 0x180010c98
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180010bef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
jmp 0x180010c98
mov r12d, dword [rbx - 0x10]
lea rsi, [rsp + 0x230]
sub rsi, rbx
sar rsi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x180010c3a
mov edx, edi
lea rcx, [rsp + 0x68]
call fcn.180001770
mov rbx, qword [rsp + 0x68]
cmp rsi, r12
ja 0x180010c5e
movsxd rax, edi
lea r12, [rax + rax]
lea r8, [rbx + rsi*2]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r12
mov rcx, rbx
call fcn.180012768
jmp 0x180010c7f
movsxd rax, edi
lea r12, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r12
lea r8, [rsp + 0x230]
mov rcx, rbx
call fcn.1800126d0
test edi, edi
js 0x180010ea3
cmp edi, dword [rbx - 0xc]
jg 0x180010ea3
mov dword [rbx - 0x10], edi
mov word [r12 + rbx], r15w
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x108], r15
mov word [rsp + 0xf8], r15w
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0xf0]
call fcn.1800022d0
nop
mov rdx, qword [r14]
mov qword [rsp + 0x138], 7
mov qword [rsp + 0x130], r15
mov word [rsp + 0x120], r15w
xor eax, eax
mov rcx, rbp
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x118]
call fcn.1800022d0
nop
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x150]
call fcn.180005a80
lea rsi, [rbx - 0x18]
mov rcx, rsi
call fcn.180001380
add rax, 0x18
mov qword [rsp + 0x78], rax
xor eax, eax
mov rcx, rbp
lea rdi, [0x180024a78]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x180024a78]
lea rcx, [rsp + 0x78]
call fcn.180002440
mov rdx, qword [rsp + 0x70]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x78]
call fcn.180002440
mov qword [rsp + 0x80], r15
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdi, qword [rsp + 0x78]
mov rdx, rdi
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180010e55
mov eax, r15d
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x180010de5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0xa0], rbx
mov dword [rsp + 0xa8], r15d
test eax, eax
jne 0x180010e55
mov dword [rsp + 0x90], r15d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Flags
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x180010e4d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], r15d
lea rdx, [rdi - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180010e70
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, ebp
lock xadd dword [rsi + 0x10], eax
dec eax
test eax, eax
jg 0x180010e89
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc r13d
cmp r13d, dword [rsp + 0x60]
jae 0x180010eae
jmp 0x180010ae0
mov ecx, 0x80070057
call fcn.180001000
int3
mov ecx, 0x80070057
call fcn.180001000
nop
lea rcx, [rsp + 0x150]
call fcn.1800046a0
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180010edc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x180010ef0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x180010f04
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebp
dec ebp
test ebp, ebp
jg 0x180010f1f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x640]
xor rcx, rsp
call fcn.1800134f0
lea r11, [rsp + 0x650]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret