Function at 0x18002ac00
Capabilities:
Query or enumerate registry value

Disassembly:
test rdx, rdx
je 0x18002b8c3
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x310
mov qword [rsp + 0xe0], 0xfffffffffffffffe
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov r14d, r9d
mov rbp, r8
mov r13, rdx
mov r12d, ecx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xfa
jg 0x18002b8a2
mov dword [rsp + 0x88], 4
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x8c]
lea r8, [0x1800cfa18]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18002acb1
cmp dword [rsp + 0x8c], 4
jne 0x18002acb1
cmp dword [rsp + 0x58], eax
jne 0x18002ad1e
mov dword [rsp + 0x58], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x8c]
lea r8, [0x1800cfa58]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18002ad0a
cmp dword [rsp + 0x8c], 4
jne 0x18002ad0a
cmp dword [rsp + 0x88], eax
jne 0x18002ad1e
lea rcx, [0x1800cfaf8]
call fcn.180003e10
test al, al
je 0x18002b8a2
mov rdx, r13
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor ebx, ebx
mov esi, ebx
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x18002ad7e
lea rdi, [rsp + 0xf0]
nop dword [rax]
movzx eax, word [rdi]
cmp ax, 0x41
jb 0x18002ad66
cmp ax, 0x5a
ja 0x18002ad66
add ax, 0x20
mov word [rdi], ax
inc esi
add rdi, 2
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, eax
jl 0x18002ad50
mov edi, ebx
test r14d, r14d
jne 0x18002adea
cmp r12d, 2
je 0x18002ad91
cmp r12d, 3
jne 0x18002adc3
test rbp, rbp
je 0x18002adc3
cmp word [rbp + 2], 0x3a
jne 0x18002adc3
lea rcx, [0x1800cfaf8]
call fcn.180003e10
test al, al
je 0x18002adc3
movzx ecx, word [rbp]
call fcn.180026e30
cmp eax, 3
jne 0x18002adc3
lea edi, [rax - 2]
jmp 0x18002ae44
lea rcx, [rsp + 0xf0]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test rax, rax
je 0x18002b8a2
mov rcx, rax
call fcn.18002a8c0
test al, al
je 0x18002b8a2
lea rdx, str.AppData
lea rcx, [rsp + 0xf0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x18002b8a2
lea rdx, [0x1800d0ce0]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x18002b8a2
lea rdx, [0x1800d0c3c]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x18002b8a2
lea rcx, [rsp + 0xf0]
call fcn.18002a9e0
test al, al
je 0x18002b8a2
cmp r12d, 2
je 0x18002ae6b
cmp r12d, 3
je 0x18002ae6b
cmp r12d, 4
jne 0x18002ae74
test rbp, rbp
je 0x18002b8a2
test edi, edi
je 0x18002b348
and dword [rsp + 0x98], 0xfffffe00
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rbx
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180108f60]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x180108f60]
lea rcx, [rsp + 0x30]
call fcn.18000f510
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.180001590
nop
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.18006601c
mov rdi, rax
lea r8, [0x1800d0d42]
lea rdx, str.bl_process
lea rcx, [rsp + 0x90]
call fcn.1800671b4
mov rcx, rax
mov rdx, rdi
call fcn.1800662a8
nop
cmp qword [rsp + 0x80], 0x10
jb 0x18002af47
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
mov qword [rsp + 0x80], socket
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x68], 0
cmp qword [rsp + 0x50], 8
jb 0x18002af6f
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r13
lea rcx, [rsp + 0x30]
call fcn.18000f510
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.180001590
nop
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.18006601c
mov rdi, rax
lea r8, [0x1800d0d51]
lea rdx, str.bl_source
lea rcx, [rsp + 0x90]
call fcn.1800671b4
mov rcx, rax
mov rdx, rdi
call fcn.1800662a8
nop
cmp qword [rsp + 0x80], 0x10
jb 0x18002b00f
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
mov qword [rsp + 0x80], socket
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x68], 0
cmp qword [rsp + 0x50], 8
jb 0x18002b037
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.18000f510
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.180001590
nop
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.18006601c
mov rdi, rax
lea r8, [0x1800d0d61]
lea rdx, str.bl_target
lea rcx, [rsp + 0x90]
call fcn.1800671b4
mov rcx, rax
mov rdx, rdi
call fcn.1800662a8
nop
cmp qword [rsp + 0x80], 0x10
jb 0x18002b0d7
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
mov qword [rsp + 0x80], socket
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x68], 0
cmp qword [rsp + 0x50], 8
jb 0x18002b0ff
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x58], rax
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdx, rax
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x30]
call fcn.18000f510
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.180001590
nop
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.18006601c
mov rdi, rax
lea r8, [0x1800d0d74]
lea rdx, str.bl_file_name
lea rcx, [rsp + 0x90]
call fcn.1800671b4
mov rcx, rax
mov rdx, rdi
call fcn.1800662a8
nop
cmp qword [rsp + 0x80], 0x10
jb 0x18002b1a8
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
mov qword [rsp + 0x80], socket
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x68], 0
cmp qword [rsp + 0x50], 8
jb 0x18002b1d0
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x58], rax
lea rax, [0x1800ce250]
lea rdx, [0x1800ce258]
test r14d, r14d
cmovne rdx, rax
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x30]
call fcn.18000f510
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.180001590
nop
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.18006601c
mov rdi, rax
lea r8, [0x1800d0d84]
lea rdx, str.bl_file_type
lea rcx, [rsp + 0x90]
call fcn.1800671b4
mov rcx, rax
mov rdx, rdi
call fcn.1800662a8
nop
cmp qword [rsp + 0x80], 0x10
jb 0x18002b282
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
mov qword [rsp + 0x80], socket
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x68], 0
cmp qword [rsp + 0x50], 8
jb 0x18002b2aa
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
test r14d, r14d
je 0x18002b2c5
xor edx, edx
mov rcx, rbp
call fcn.180050c10
jmp 0x18002b2cd
mov rcx, rbp
call fcn.1800504b4
mov byte [rsp + 0x38], 2
btr dword [rsp + 0x38], 8
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
lea r8, [0x1800d0d8f]
lea rdx, str.bl_size
lea rcx, [rsp + 0x90]
call fcn.1800671b4
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.1800662a8
test r14d, r14d
cmove rbx, rbp
xor r9d, r9d
mov r8, rbx
lea rdx, [rsp + 0x90]
lea rcx, str.t_burn_log
call fcn.18005e25c
nop
lea rcx, [rsp + 0x90]
call fcn.180066210
jmp 0x18002b8a2
cmp dword [0x180108d38], ebx
je 0x18002b8a2
and dword [rsp + 0x98], 0xfffffe00
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rbx
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x58], rax
mov ecx, r12d
call fcn.18002ab70
mov rdx, rax
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x30]
call fcn.18000f510
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.180001590
nop
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.18006601c
mov rdi, rax
lea r8, [0x1800d0be6]
lea rdx, str.action
lea rcx, [rsp + 0x90]
call fcn.1800671b4
mov rcx, rax
mov rdx, rdi
call fcn.1800662a8
nop
cmp qword [rsp + 0x80], 0x10
jb 0x18002b41f
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
mov qword [rsp + 0x80], socket
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x68], 0
cmp qword [rsp + 0x50], 8
jb 0x18002b447
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r13
lea rcx, [rsp + 0x30]
call fcn.18000f510
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.180001590
nop
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.18006601c
mov rdi, rax
lea r8, [0x1800d0da9]
lea rdx, str.path_from
lea rcx, [rsp + 0x90]
call fcn.1800671b4
mov rcx, rax
mov rdx, rdi
call fcn.1800662a8
nop
cmp qword [rsp + 0x80], 0x10
jb 0x18002b4e7
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
mov qword [rsp + 0x80], socket
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x68], 0
cmp qword [rsp + 0x50], 8
jb 0x18002b50f
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
test rbp, rbp
je 0x18002b5e0
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.18000f510
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.180001590
nop
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.18006601c
mov rdi, rax
lea r8, [0x1800d0db7]
lea rdx, str.path_to
lea rcx, [rsp + 0x90]
call fcn.1800671b4
mov rcx, rax
mov rdx, rdi
call fcn.1800662a8
nop
cmp qword [rsp + 0x80], 0x10
jb 0x18002b5b8
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
mov qword [rsp + 0x80], socket
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x68], 0
cmp qword [rsp + 0x50], 8
jb 0x18002b5e0
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180108f60]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x180108f60]
lea rcx, [rsp + 0x30]
call fcn.18000f510
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.180001590
nop
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.18006601c
mov rdi, rax
lea r8, [0x1800d0dc1]
lea rdx, str.proc_name
lea rcx, [rsp + 0x90]
call fcn.1800671b4
mov rcx, rax
mov rdx, rdi
call fcn.1800662a8
nop
cmp qword [rsp + 0x80], 0x10
jb 0x18002b688
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
mov qword [rsp + 0x80], socket
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x68], 0
cmp qword [rsp + 0x50], 8
jb 0x18002b6b0
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x58], rax
lea rax, [0x1800ce250]
lea rdx, [0x1800ce258]
test r14d, r14d
cmovne rdx, rax
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x30]
call fcn.18000f510
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.180001590
nop
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.18006601c
mov rdi, rax
lea r8, [0x1800d0dd1]
lea rdx, str.file_type
lea rcx, [rsp + 0x90]
call fcn.1800671b4
mov rcx, rax
mov rdx, rdi
call fcn.1800662a8
nop
cmp qword [rsp + 0x80], 0x10
jb 0x18002b762
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
mov qword [rsp + 0x80], socket
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x68], 0
cmp qword [rsp + 0x50], 8
jb 0x18002b78a
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
test r14d, r14d
jne 0x18002b804
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x370]
test rax, rax
jne 0x18002b7bd
test rbp, rbp
je 0x18002b7b5
mov rcx, rbp
call fcn.1800504b4
jmp 0x18002b7bd
mov rcx, r13
call fcn.1800504b4
mov byte [rsp + 0x38], 2
btr dword [rsp + 0x38], 8
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
lea r8, [0x1800d0de1]
lea rdx, str.file_size
lea rcx, [rsp + 0x90]
call fcn.1800671b4
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.1800662a8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x38], 4
bts dword [rsp + 0x38], 8
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
lea rcx, [0x1801039e0]
cmp qword [0x1801039f8], 0x10
cmovae rcx, qword [0x1801039e0]
mov edx, dword [0x1801039f0]
call fcn.18006587c
mov qword [rsp + 0x30], rax
lea r8, [0x1800d0172]
lea rdx, str.hash4k
lea rcx, [rsp + 0x90]
call fcn.1800671b4
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.1800662a8
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x90]
lea rcx, str.t_fileop_log
call fcn.18005e25c
nop
lea rcx, [rsp + 0x90]
call fcn.180066210
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.180099fe0
add rsp, 0x310
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
repz ret