Function at 0x18001fba0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x508]
sub rsp, 0x5e0
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180066180]
xor rax, rsp
mov qword [rbp + 0x4d0], rax
mov r15, rcx
mov qword [rbp - 0x78], rcx
xor r14d, r14d
mov dword [rsp + 0x78], r14d
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x68], r14d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x50], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r13d, 1
mov r9d, r13d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_firefox.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18001fe41
mov rdi, qword [rsp + 0x50]
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], r14d
mov byte [rbp + 0xd0], al
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rbp + 0xd1]
call fcn.18002c930
call fcn.18001d950
lea rcx, [0x180066048]
mov rax, qword [0x180066048]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x38], 0x400
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, [0x180055e66]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
or rsi, 0xffffffffffffffff
test eax, eax
jne 0x18001fde4
mov eax, dword [rsp + 0x58]
dec eax
cmp eax, r13d
ja 0x18001fde4
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x18001fce4
cmp byte [rbp + rax + 0xcf], r14b
je 0x18001fceb
jmp 0x18001fde4
mov byte [rbp + 0xd0], 0
lea rax, [rbp + 0xd0]
mov rdi, rsi
inc rdi
cmp byte [rax + rdi], 0
jne 0x18001fcf5
test edi, edi
jne 0x18001fd5d
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x18001fde4
cmp dword [rdx + 0x10], 0
jge 0x18001fd36
cmp dword [rbx - 0xc], 0
jge 0x18001fd2a
mov ecx, 0x80070057
call fcn.180002bd0
int3
mov dword [rbx - 0x10], r14d
mov byte [rbx], 0
jmp 0x18001fde4
lock add dword [rdx + 0x10], 0xffffffff
jg 0x18001fd46
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
jmp 0x18001fde4
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x30], eax
lea r12, [rbp + 0xd0]
sub r12, rbx
test edi, edi
jns 0x18001fd7d
mov ecx, 0x80070057
call fcn.180002bd0
int3
sub r13d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, r13d
jge 0x18001fd9c
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.180002c50
mov rbx, qword [rsp + 0x48]
mov eax, dword [rsp + 0x30]
movsxd r13, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
mov r9, r13
cmp r12, rax
ja 0x18001fdbd
lea r8, [r12 + rbx]
call fcn.180029ae8
jmp 0x18001fdc9
lea r8, [rbp + 0xd0]
call fcn.180028f24
cmp edi, dword [rbx - 0xc]
jg 0x18001fdd9
mov dword [rbx - 0x10], edi
mov byte [r13 + rbx], 0
jmp 0x18001fde4
mov ecx, 0x80070057
call fcn.180002bd0
int3
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x18001fdfc
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x68], r14d
lea rcx, [rbx - 0x18]
call fcn.180002110
add rax, 0x18
mov qword [r15], rax
lock add dword [rbx - 8], 0xffffffff
jg 0x18001fe28
mov rcx, qword [rbx - 0x18]
mov r8, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rVariantCopy + 8]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18001ffee
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18001ffee
lea rcx, [rsp + 0x30]
call fcn.18000b0c0
nop
mov ecx, dword [0x180069c80]
imul ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 7
jne 0x18001feab
mov ecx, 0x28
call fcn.1800289f0
mov rdi, rax
mov rbx, r14
call fcn.1800289f8
add eax, dword [0x180069c80]
mov dword [rdi + rbx*4], eax
inc rbx
cmp rbx, 0xa
jl 0x18001fe83
mov ecx, dword [rdi + 0x24]
mov dword [0x180069c80], ecx
mov rcx, rdi
call fcn.180028a24
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax - 0x10]
test ecx, ecx
je 0x18001ff81
lea edx, [rcx - 1]
test edx, edx
js 0x18001ff76
cmp edx, ecx
jg 0x18001ff76
movsxd rcx, edx
cmp byte [rcx + rax], 0x5c
je 0x18001feeb
mov r8d, r13d
lea rdx, [0x180055dd0]
lea rcx, [rsp + 0x30]
call fcn.1800022e0
lea r8, str.Mozilla_Firefox_firefox.exe
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180001c40
nop
lea rdx, [rbp - 0x70]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
setne r14b
test r14d, r14d
je 0x18001ff5b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
call fcn.180002110
add rax, 0x18
mov qword [r15], rax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x18001ffd4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x18001ffd4
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x18001ff81
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x18001ff81
mov ecx, 0x80070057
call fcn.180002bd0
int3
lea rcx, [0x180066048]
mov rax, qword [0x180066048]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r15], rax
lea rdx, [0x180055e66]
test rdx, 0xffffffffffff0000
jne 0x18001ffc8
movzx ebx, dx
mov ecx, ebx
call fcn.180002840
test rax, rax
je 0x18001ffd4
mov r8d, ebx
mov rdx, rax
mov rcx, r15
call fcn.1800023e0
jmp 0x18001ffd4
xor r8d, r8d
mov rcx, r15
call fcn.180002020
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x18001ffee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rax, r15
mov rcx, qword [rbp + 0x4d0]
xor rcx, rsp
call fcn.1800289d0
lea r11, [rsp + 0x5e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret