Function at 0x180008c68
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x18005a960]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r15, rcx
xor edi, edi
mov r12, rdi
mov r13, rdi
mov rbp, rdi
mov dword [rsp + 0x30], edi
mov r14, rdi
mov rbx, rdi
mov qword [rsp + 0x50], rbx
mov qword [r11 - 0x48], rdi
lea rax, [r11 - 0x48]
mov qword [r11 - 0x68], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARE
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r11d, eax
cmp eax, edi
jne 0x180008cf6
mov r11d, edi
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rbx
movzx eax, r11w
mov esi, 0x80070000
or eax, esi
cmp r11d, edi
cmovle eax, r11d
cmp eax, edi
jl 0x18000900b
mov dword [rsp + 0x38], edi
lea r9, [rsp + 0x38]
xor r8d, r8d
lea edx, [r8 + 4]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
cmp eax, 0x7a
je 0x180008d3a
movzx ecx, ax
or ecx, esi
cmp eax, edi
cmovle ecx, eax
jmp 0x180008d7e
mov ecx, dword [rsp + 0x38]
call fcn.18001cc60
mov r13, rax
cmp rax, rdi
je 0x180008fe3
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov rcx, rax
call fcn.180026a20
lea r9, [rsp + 0x38]
mov r8, r13
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
movzx ecx, ax
or ecx, esi
cmp eax, edi
cmovle ecx, eax
cmp ecx, edi
jl 0x180008fe3
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x50]
lea rdx, str.SECURITYSAMDomainsAccount
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov r11d, eax
movzx eax, ax
or eax, esi
cmp r11d, edi
cmovle eax, r11d
cmp eax, edi
jl 0x180008fe3
cmp rbx, rdi
je 0x180008dc9
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x34], edi
lea r9, [rsp + 0x34]
xor r8d, r8d
lea edx, [r8 + 4]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
cmp eax, 0x7a
je 0x180008dfd
movzx ecx, ax
or ecx, esi
cmp eax, edi
cmovle ecx, eax
jmp 0x180008e41
mov ecx, dword [rsp + 0x34]
call fcn.18001cc60
mov r12, rax
cmp rax, rdi
je 0x180008fe3
mov r8d, dword [rsp + 0x34]
xor edx, edx
mov rcx, rax
call fcn.180026a20
lea r9, [rsp + 0x34]
mov r8, r12
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
movzx ecx, ax
or ecx, esi
cmp eax, edi
cmovle ecx, eax
cmp ecx, edi
jl 0x180008fe3
mov r8, r13
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
movzx edx, ax
or edx, esi
cmp eax, edi
cmovle edx, eax
cmp edx, edi
jl 0x180008fe3
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x50]
lea rdx, str.SECURITYSAMDomainsAccount
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movzx esi, ax
or esi, 0x80070000
cmp eax, edi
cmovle esi, eax
cmp esi, edi
jl 0x180008f51
cmp rbx, rdi
je 0x180008eae
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x40], edi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x180041e90]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
cmp eax, edi
cmovle esi, eax
cmp esi, edi
jl 0x180008f51
mov ecx, dword [rsp + 0x30]
call fcn.18001cc60
mov rbp, rax
cmp rax, rdi
jne 0x180008f0d
mov esi, 0x8007000e
jmp 0x180008f51
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call fcn.180026a20
lea r11, [rsp + 0x30]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x180041e90]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
cmp eax, edi
cmovle esi, eax
mov r8, r12
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
cmp esi, edi
jl 0x180008fe3
test byte [rsp + 0x30], 3
jne 0x180008fcf
mov byte [rsp + 0x50], dil
mov byte [rsp + 0x51], dil
mov byte [rsp + 0x52], dil
mov byte [rsp + 0x53], dil
mov byte [rsp + 0x54], dil
mov byte [rsp + 0x55], 5
mov eax, dword [rsp + 0x30]
lea rdi, [rax + rbp - 0x14]
cmp rdi, rbp
jb 0x180008fc9
cmp dword [rdi + 8], 0x15
jne 0x180008fb7
lea rcx, [rdi + 2]
mov r8d, 6
lea rdx, [rsp + 0x50]
call fcn.1800265c0
test eax, eax
je 0x180008fc2
sub rdi, 4
cmp rdi, rbp
jb 0x180008fcd
jmp 0x180008f99
mov r14, rdi
xor edi, edi
jmp 0x180008fd4
xor edi, edi
jmp 0x180008fcf
xor edi, edi
mov esi, 0x80004005
cmp esi, edi
jl 0x180008fe3
mov rdx, r15
mov rcx, r14
call sub.ADVAPI32.dll_ConvertSidToStringSidW
cmp r13, rdi
je 0x180008ff0
mov rcx, r13
call fcn.180026690
cmp r12, rdi
je 0x180008ffd
mov rcx, r12
call fcn.180026690
cmp rbp, rdi
je 0x18000900b
mov rcx, rbp
call fcn.180026690
nop
cmp rbx, rdi
je 0x180009019
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180026960
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret