Function at 0x1800088d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x18010e350]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r15, rcx
xor edi, edi
mov r12, rdi
mov r13, rdi
mov rbp, rdi
mov dword [rsp + 0x30], edi
mov r14, rdi
mov rbx, rdi
mov qword [rsp + 0x50], rbx
mov qword [r11 - 0x48], rdi
lea rax, [r11 - 0x48]
mov qword [r11 - 0x68], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARE
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r11d, eax
cmp eax, edi
jne 0x18000895e
mov r11d, edi
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rbx
movzx eax, r11w
mov esi, 0x80070000
or eax, esi
cmp r11d, edi
cmovle eax, r11d
cmp eax, edi
jl 0x180008c73
mov dword [rsp + 0x38], edi
lea r9, [rsp + 0x38]
xor r8d, r8d
lea edx, [r8 + 4]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
cmp eax, 0x7a
je 0x1800089a2
movzx ecx, ax
or ecx, esi
cmp eax, edi
cmovle ecx, eax
jmp 0x1800089e6
mov ecx, dword [rsp + 0x38]
call fcn.1800605e0
mov r13, rax
cmp rax, rdi
je 0x180008c4b
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov rcx, rax
call fcn.180086e90
lea r9, [rsp + 0x38]
mov r8, r13
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
movzx ecx, ax
or ecx, esi
cmp eax, edi
cmovle ecx, eax
cmp ecx, edi
jl 0x180008c4b
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x50]
lea rdx, str.SECURITYSAMDomainsAccount
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov r11d, eax
movzx eax, ax
or eax, esi
cmp r11d, edi
cmovle eax, r11d
cmp eax, edi
jl 0x180008c4b
cmp rbx, rdi
je 0x180008a31
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x34], edi
lea r9, [rsp + 0x34]
xor r8d, r8d
lea edx, [r8 + 4]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
cmp eax, 0x7a
je 0x180008a65
movzx ecx, ax
or ecx, esi
cmp eax, edi
cmovle ecx, eax
jmp 0x180008aa9
mov ecx, dword [rsp + 0x34]
call fcn.1800605e0
mov r12, rax
cmp rax, rdi
je 0x180008c4b
mov r8d, dword [rsp + 0x34]
xor edx, edx
mov rcx, rax
call fcn.180086e90
lea r9, [rsp + 0x34]
mov r8, r12
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
movzx ecx, ax
or ecx, esi
cmp eax, edi
cmovle ecx, eax
cmp ecx, edi
jl 0x180008c4b
mov r8, r13
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
movzx edx, ax
or edx, esi
cmp eax, edi
cmovle edx, eax
cmp edx, edi
jl 0x180008c4b
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x50]
lea rdx, str.SECURITYSAMDomainsAccount
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movzx esi, ax
or esi, 0x80070000
cmp eax, edi
cmovle esi, eax
cmp esi, edi
jl 0x180008bb9
cmp rbx, rdi
je 0x180008b16
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x40], edi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x1800d7d38]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
cmp eax, edi
cmovle esi, eax
cmp esi, edi
jl 0x180008bb9
mov ecx, dword [rsp + 0x30]
call fcn.1800605e0
mov rbp, rax
cmp rax, rdi
jne 0x180008b75
mov esi, 0x8007000e
jmp 0x180008bb9
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call fcn.180086e90
lea r11, [rsp + 0x30]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x1800d7d38]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
cmp eax, edi
cmovle esi, eax
mov r8, r12
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
cmp esi, edi
jl 0x180008c4b
test byte [rsp + 0x30], 3
jne 0x180008c37
mov byte [rsp + 0x50], dil
mov byte [rsp + 0x51], dil
mov byte [rsp + 0x52], dil
mov byte [rsp + 0x53], dil
mov byte [rsp + 0x54], dil
mov byte [rsp + 0x55], 5
mov eax, dword [rsp + 0x30]
lea rdi, [rax + rbp - 0x14]
cmp rdi, rbp
jb 0x180008c31
cmp dword [rdi + 8], 0x15
jne 0x180008c1f
lea rcx, [rdi + 2]
mov r8d, 6
lea rdx, [rsp + 0x50]
call fcn.180086f90
test eax, eax
je 0x180008c2a
sub rdi, 4
cmp rdi, rbp
jb 0x180008c35
jmp 0x180008c01
mov r14, rdi
xor edi, edi
jmp 0x180008c3c
xor edi, edi
jmp 0x180008c37
xor edi, edi
mov esi, 0x80004005
cmp esi, edi
jl 0x180008c4b
mov rdx, r15
mov rcx, r14
call sub.ADVAPI32.dll_ConvertSidToStringSidW
cmp r13, rdi
je 0x180008c58
mov rcx, r13
call fcn.180088170
cmp r12, rdi
je 0x180008c65
mov rcx, r12
call fcn.180088170
cmp rbp, rdi
je 0x180008c73
mov rcx, rbp
call fcn.180088170
nop
cmp rbx, rdi
je 0x180008c81
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180086e60
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret