Function at 0x1800088f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x2e0
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x18006afd8]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov r13, rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov bl, 1
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x40], r14d
lea rcx, [0x18006af50]
mov rax, qword [0x18006af50]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
or rsi, 0xffffffffffffffff
test r13, r13
je 0x1800089a2
test r13, 0xffffffffffff0000
jne 0x18000898f
movzx edi, r13w
xor edx, edx
mov ecx, edi
call fcn.180005550
test rax, rax
je 0x1800089b6
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.180005780
jmp 0x1800089b6
xor eax, eax
mov rcx, rsi
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x1800089a5
mov ecx, r14d
mov r8d, ecx
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.180005a60
nop
lea r8, [rsp + 0x58]
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerExtensions_
lea rcx, [rsp + 0xb8]
call fcn.180001a70
mov qword [rsp + 0x90], r14
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, eax
test eax, eax
jne 0x180008a18
mov edx, r14d
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], r14d
test edx, edx
sete dil
mov rdx, qword [rsp + 0xb8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180008a41
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180008a60
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x180008c15
mov dword [rsp + 0x50], 0x200
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.ButtonText
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180008beb
mov eax, dword [rsp + 0x68]
cmp eax, 1
je 0x180008abf
cmp eax, 2
jne 0x180008beb
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x180008ae2
test al, 1
jne 0x180008beb
shr rax, 1
cmp word [rsp + rax*2 + 0xce], 0
je 0x180008aeb
jmp 0x180008beb
mov word [rsp + 0xd0], r14w
mov dword [rsp + 0x4c], 0x200
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.CLSID
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180008b5b
mov eax, dword [rsp + 0x70]
cmp eax, 1
je 0x180008b34
cmp eax, 2
jne 0x180008b5b
mov eax, dword [rsp + 0x4c]
test eax, eax
je 0x180008b50
test al, 1
jne 0x180008b5b
shr rax, 1
cmp word [rsp + rax*2 + 0xce], 0
je 0x180008b77
jmp 0x180008b5b
mov word [rsp + 0xd0], r14w
jmp 0x180008b77
lea rdx, str.1FBA04EE_3024_11d2_8F1F_0000F87ABD16
lea rcx, [rsp + 0xd0]
call fcn.180038958
test eax, eax
je 0x180008b77
xor bl, bl
jmp 0x180008bed
mov dword [rsp + 0x54], 0x200
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x74]
xor r8d, r8d
lea rdx, str.Icon
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180008be7
mov eax, dword [rsp + 0x74]
cmp eax, 1
je 0x180008bc0
cmp eax, 2
jne 0x180008be7
mov eax, dword [rsp + 0x54]
test eax, eax
je 0x180008bdc
test al, 1
jne 0x180008be7
shr rax, 1
cmp word [rsp + rax*2 + 0xce], 0
je 0x180008bed
jmp 0x180008be7
mov word [rsp + 0xd0], r14w
jmp 0x180008bed
xor bl, bl
jmp 0x180008bed
xor bl, bl
test rdi, rdi
je 0x180008c03
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x40], r14d
test bl, bl
jne 0x180008c1a
mov ebp, dword [rsp + 0x30]
jmp 0x180008cb1
mov rdi, qword [rsp + 0x38]
mov rdx, r13
lea rcx, [rsp + 0xa8]
call fcn.180005ba0
nop
mov dword [rsp + 0x30], 1
mov r8, rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExtSettings_
lea rcx, [rsp + 0xb0]
call fcn.180001a70
mov ebp, 3
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x88], r14
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180008cb1
mov eax, r14d
test rdi, rdi
je 0x180008c96
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x88]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x40], r14d
test eax, eax
jne 0x180008cb1
mov r12b, 1
jmp 0x180008cb4
xor r12b, r12b
test bpl, 2
je 0x180008cf7
and ebp, 0xfffffffd
mov dword [rsp + 0x30], ebp
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180008cee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x38]
mov ebp, dword [rsp + 0x30]
jmp 0x180008cf7
mov rdi, qword [rsp + 0x38]
mov ebp, dword [rsp + 0x30]
test bpl, 1
je 0x180008d2b
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180008d26
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x38]
jmp 0x180008d2b
mov rdi, qword [rsp + 0x38]
test r12b, r12b
je 0x180008d9d
mov dword [rsp + 0x78], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6c]
xor r8d, r8d
lea rdx, str.Flags
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180008d83
cmp dword [rsp + 0x6c], 4
jne 0x180008d83
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x180008d83
movzx ebx, bl
cmp eax, 0x400
cmovne ebx, r14d
test rdi, rdi
je 0x180008ee1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r14
jmp 0x180008ee1
test bl, bl
je 0x180008ee1
mov rdx, r13
lea rcx, [rsp + 0xa0]
call fcn.180005ba0
nop
mov r8, rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExtSettings_
lea rcx, [rsp + 0x98]
call fcn.180001a70
mov qword [rsp + 0x80], r14
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r11d, eax
test eax, eax
jne 0x180008e28
mov r11d, r14d
test rdi, rdi
je 0x180008e16
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, eax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], r14d
test r11d, r11d
sete dil
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180008e52
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0xa0]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x180008e72
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x180008edc
mov dword [rsp + 0x64], 4
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.Flags
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180008ec9
cmp dword [rsp + 0x60], 4
jne 0x180008ec9
movzx eax, bl
cmp dword [rsp + 0x48], 0
cmovne eax, r14d
mov bl, al
test rdi, rdi
je 0x180008ee1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r14
jmp 0x180008ee1
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x180008ef3
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x180008ef5
mov al, bl
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.180036e70
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret