Function at 0x180089670
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x18019bca8]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
movups xmm0, xmmword [0x18016a2c8]
mov rdx, qword [rdx]
lea r8, str.Schemas
xor r12d, r12d
mov qword [rbp - 0x78], rcx
mov r14, rcx
mov qword [rsp + 0x78], r12
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x60], r12
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x80], r12
mov dword [rsp + 0x54], r12d
mov dword [rsp + 0x58], r12d
call fcn.18005f30c
test eax, eax
jg 0x1800d5054
js 0x1800d5063
mov rbx, qword [rsp + 0x78]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], r12
lea r8, [rbp - 0x50]
mov qword [rsp + 0x28], r12
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x40], 0x80
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
je 0x1800d507d
lea rcx, [rsp + 0x48]
call fcn.18005f368
lea rcx, [rsp + 0x78]
call fcn.18005f368
xor eax, eax
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.18008b970
mov rbx, qword [rsp + 0x310]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0x1800896ea
cmp dword [0x18019cca4], r12d
je 0x180089740
mov ecx, eax
call fcn.180096ba4
nop
jmp 0x180089740
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x50]
lea r15, [r14 + 0x188]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_IIDFromString]
mov edi, eax
test eax, eax
jns 0x1800d50a8
cmp dword [0x18019cca4], r12d
je 0x1800d50a8
mov ecx, eax
call fcn.180096ba4
test edi, edi
js 0x180089736
mov r8d, dword [r14 + 0x1a0]
mov edx, r12d
mov qword [rsp + 0x70], r12
mov rsi, r12
test r8d, r8d
je 0x1800d510a
mov r9, qword [r15]
mov eax, edx
lea rdi, [rax + rax*2]
shl rdi, 4
add rdi, r9
mov rax, qword [rdi]
sub rax, qword [rbp - 0x68]
jne 0x1800d50e8
mov rax, qword [rdi + 8]
sub rax, qword [rbp - 0x60]
test rax, rax
je 0x1800d50fb
inc edx
cmp edx, r8d
jb 0x1800d50ca
mov qword [rsp + 0x70], r12
jmp 0x1800d510a
mov esi, 1
mov qword [rsp + 0x70], rsi
test rdi, rdi
jne 0x1800d514c
mov rcx, r15
call fcn.1800620c4
mov edi, eax
test eax, eax
jns 0x1800d5128
cmp dword [0x18019cca4], r12d
je 0x1800d5128
mov ecx, eax
call fcn.180096ba4
test edi, edi
js 0x180089736
mov eax, dword [r14 + 0x1a0]
movups xmm0, xmmword [rbp - 0x68]
dec eax
lea rdi, [rax + rax*2]
shl rdi, 4
add rdi, qword [r15]
movdqu xmmword [rdi], xmm0
lea r8, [rbp - 0x50]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.18005f30c
test eax, eax
jle 0x1800d516b
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x1800d53c6
mov r13d, r12d
lea rax, [rsp + 0x54]
mov dword [rsp + 0x50], 0x80
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x80
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0xb0]
lea rax, [rbp - 0x50]
mov edx, r13d
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.18005d300
test eax, eax
jne 0x1800d536b
cmp dword [rsp + 0x54], 1
jne 0x1800d535e
test rsi, rsi
je 0x1800d5218
mov esi, r12d
cmp dword [rdi + 0x28], r12d
jbe 0x1800d5218
mov rcx, qword [rdi + 0x10]
mov eax, esi
cmp dword [rcx + rax*8], 0xffffffff
je 0x1800d5211
cmp dword [rcx + rax*8 + 4], 0xffffffff
je 0x1800d5211
mov ecx, dword [rcx + rax*8]
lea rdx, [rbp + 0xb0]
mov rax, qword [r14 + 0x1a8]
lea rcx, [rax + rcx*2]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
je 0x1800d535e
inc esi
cmp esi, dword [rdi + 0x28]
jb 0x1800d51db
mov edx, 8
lea rcx, [rdi + 0x10]
lea r9, [rbp - 0x80]
lea r8d, [rdx - 7]
call fcn.18004c450
mov esi, eax
test eax, eax
jns 0x1800d5244
cmp dword [0x18019cca4], r12d
je 0x1800d5244
mov ecx, eax
call fcn.180096ba4
test esi, esi
js 0x180089736
mov r15, qword [rbp - 0x80]
lea r12, [r14 + 0x1a8]
or eax, 0xffffffff
lea r9, [rsp + 0x60]
mov edx, 2
mov rcx, r12
mov dword [r15], eax
mov dword [r15 + 4], eax
mov r8d, dword [rsp + 0x50]
mov eax, dword [r14 + 0x1c0]
inc r8d
shr dword [rsp + 0x40], 1
mov dword [rsp + 0x50], r8d
mov dword [rsp + 0x68], eax
call fcn.18004c450
mov esi, eax
test eax, eax
jns 0x1800d52a5
cmp dword [0x18019cca4], 0
je 0x1800d52a5
mov ecx, eax
call fcn.180096ba4
test esi, esi
js 0x180089736
mov edx, dword [rsp + 0x50]
lea r8, [rbp + 0xb0]
mov rcx, qword [rsp + 0x60]
call fcn.18002f10c
mov esi, eax
test eax, eax
jns 0x1800d52d8
cmp dword [0x18019cca4], 0
je 0x1800d52d8
mov ecx, eax
call fcn.180096ba4
test esi, esi
js 0x180089736
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x60]
mov r14d, dword [r14 + 0x1c0]
mov edx, 2
mov rcx, r12
call fcn.18004c450
xor r12d, r12d
mov esi, eax
test eax, eax
jns 0x1800d5317
cmp dword [0x18019cca4], r12d
je 0x1800d5317
mov ecx, eax
call fcn.180096ba4
test esi, esi
js 0x180089736
mov edx, dword [rsp + 0x40]
lea r8, [rbp - 0x50]
mov rcx, qword [rsp + 0x60]
call fcn.18002f10c
mov esi, eax
test eax, eax
jns 0x1800d5347
cmp dword [0x18019cca4], r12d
je 0x1800d5347
mov ecx, eax
call fcn.180096ba4
test esi, esi
js 0x180089736
mov eax, dword [rsp + 0x68]
mov dword [r15], eax
mov dword [r15 + 4], r14d
mov r14, qword [rbp - 0x78]
mov rsi, qword [rsp + 0x70]
inc r13d
jmp 0x1800d5174
mov r12d, dword [rsp + 0x58]
lea rcx, [rsp + 0x48]
inc r12d
mov dword [rsp + 0x58], r12d
call fcn.18005f368
xor ecx, ecx
mov dword [rsp + 0x40], 0x80
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea r8, [rbp - 0x50]
mov qword [rsp + 0x28], rcx
mov edx, r12d
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
xor r12d, r12d
jmp 0x18008972e
cmp dword [0x18019cca4], r12d
je 0x180089736
mov ecx, eax
call fcn.180096ba4
nop
jmp 0x180089736