Function at 0x180031f00
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x208]
sub rsp, 0x2e0
mov rax, qword [0x180083330]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rsi, rcx
lea rdx, str.ARCM_Initialize
lea rcx, [rsp + 0x70]
call fcn.180003934
nop
lea r13, [rsi + 0x18]
mov rcx, qword [r13]
xor r15d, r15d
test rcx, rcx
je 0x180031f6d
mov qword [r13], r15
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
mov qword [r13], r15
lea rdx, [0x180084288]
mov ecx, 0x38
call fcn.180063efc
mov rbx, rax
test rax, rax
jne 0x180031f94
mov edi, 0x8007000e
jmp 0x18003221d
mov dword [rax + 0xc], 1
lea rax, [0x180069160]
mov qword [rbx], rax
mov rcx, qword [0x180083ce0]
test rcx, rcx
je 0x180031fbe
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x18004bf34.0]
lea rax, [0x180069198]
mov qword [rbx], rax
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
lea r12, [rbx + 0x20]
mov qword [r12], r15
lea r15, [rbx + 0x28]
and qword [r15], 0
and qword [rbx + 0x30], 0
mov ecx, 4
call qword [0x18006a1a0]
nop dword [rax + rax]
mov qword [r12], rax
mov r14d, 0x8007000e
test rax, rax
je 0x1800321e4
mov ecx, 4
call qword [0x18006a1a0]
nop dword [rax + rax]
mov qword [r15], rax
test rax, rax
je 0x1800321e4
xor edi, edi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileAssociation
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1800320df
mov r8, r12
lea rdx, str.AddRemoveApps
mov rcx, qword [rsp + 0x58]
call fcn.1800432b8
mov edi, eax
test eax, eax
js 0x1800320ce
mov r8, r15
lea rdx, str.HostApps
mov rcx, qword [rsp + 0x58]
call fcn.1800432b8
mov edi, eax
test eax, eax
js 0x1800320ce
mov rcx, qword [r12]
test rcx, rcx
je 0x1800320b0
xor r8d, r8d
lea rdx, [0x1800430a0]
call qword [0x18006a1c0]
nop dword [rax + rax]
mov rcx, qword [r15]
test rcx, rcx
je 0x1800320ce
xor r8d, r8d
lea rdx, [0x1800430a0]
call qword [0x18006a1c0]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
xor r15d, r15d
test edi, edi
js 0x180032209
lea ecx, [r15 + 4]
call qword [0x18006a1a0]
nop dword [rax + rax]
mov qword [rbx + 0x18], rax
mov rcx, rax
neg rcx
sbb edi, edi
not edi
and edi, r14d
test rax, rax
je 0x1800321d4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileAssociationNoStartPageAppUserModelIDs
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1800321d4
jmp 0x1800321bc
mov dword [rsp + 0x50], 0x104
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
lea r8, [rbp - 0x40]
mov edx, r15d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
nop dword [rax + rax]
test eax, eax
jne 0x1800321c0
inc r15d
lea rcx, [rbp - 0x40]
call qword [sym.imp.SHLWAPI.dll_StrDupW]
nop dword [rax + rax]
mov rdx, rax
neg rax
sbb edi, edi
not edi
and edi, r14d
test rdx, rdx
je 0x1800321bc
lea rcx, [rbx + 0x18]
call fcn.180043440
mov edi, eax
test edi, edi
jns 0x18003214b
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
xor r15d, r15d
test edi, edi
js 0x180032209
mov rcx, rbx
call fcn.180043498
mov edi, eax
jmp 0x1800321ea
mov edi, r14d
xor r15d, r15d
test edi, edi
js 0x180032209
mov rax, qword [rbx]
mov r8, r13
lea rdx, [0x180071888]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x18004bf34.0]
mov edi, eax
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
test edi, edi
jns 0x18003222a
mov r9d, edi
mov edx, Ordinal_109
jmp 0x180032592
lea rdi, [rsi + 0x10]
mov rcx, qword [rdi]
test rcx, rcx
je 0x180032246
mov qword [rdi], r15
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
mov qword [rdi], r15
lea rdx, [0x180084288]
mov ecx, 0x38
call fcn.180063efc
mov rbx, rax
test rax, rax
jne 0x180032267
mov edi, r14d
jmp 0x1800322e1
mov r13d, 1
mov dword [rax + 0xc], r13d
lea rax, [0x180069128]
mov qword [rbx], rax
mov rcx, qword [0x180083ce0]
test rcx, rcx
je 0x180032294
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x18004bf34.0]
lea rax, [0x180069218]
mov qword [rbx], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x10], rax
mov dword [rbx + 0x18], eax
mov rax, qword [rbx]
mov r8, rdi
lea rdx, [0x180071840]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x18004bf34.0]
mov edi, eax
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
test edi, edi
jns 0x1800322ee
mov r9d, edi
mov edx, reloc.SHCORE.dll_Ordinal_109
jmp 0x180032592
call fcn.180037db0
test eax, eax
je 0x1800325a7
lea rbx, [rsi + 0x1e8]
mov rcx, rbx
call fcn.18003cde4
cmp qword [rbx + 8], r15
jne 0x180032314
mov qword [rbx + 8], rsi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rdx, [r9 - 3]
lea rcx, [0x18003d150]
call qword [sym.imp.SHCORE.dll_Ordinal_188]
nop dword [rax + rax]
mov qword [rbx], rax
mov r14d, 0x80070000
mov r12d, 0x80004005
test rax, rax
je 0x180032354
mov edi, r15d
jmp 0x180032375
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, r14d
test eax, eax
cmovle edi, eax
test edi, edi
cmovns edi, r12d
test edi, edi
js 0x1800323b0
lea rdx, str.AppResolver_NotifyWnd
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SetWindowTextW]
nop dword [rax + rax]
test eax, eax
jne 0x1800323ac
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, r14d
test eax, eax
cmovle edi, eax
test edi, edi
cmovns edi, r12d
test edi, edi
jns 0x1800323c9
mov rcx, rbx
call fcn.18003cde4
test edi, edi
jns 0x1800323c9
mov r9d, edi
mov edx, 0x71
jmp 0x180032592
lea rcx, [rsi + 0x30]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
lea rbx, [0x18006a7dc]
lea rdi, [rsi + 0x118]
lea r14, [rsi + 0x1b0]
mov edx, dword [rbx - 4]
or edx, 0x4100
movsxd rax, r15d
add rax, 0xb
lea rax, [rax + rax*2]
lea r9, [rsi + rax*8]
xor r8d, r8d
mov rcx, qword [rbx - 0xc]
call qword [sym.imp.api_ms_win_storage_exports_internal_l1_1_0.dll_SHGetKnownFolderIDList]
nop dword [rax + rax]
mov eax, 2
mov dword [r14], eax
test byte [rbx], al
je 0x18003243c
lea rcx, [0x180071950]
call qword [sym.imp.SHCORE.dll_Ordinal_190]
nop dword [rax + rax]
test eax, eax
jne 0x180032443
cmp qword [rdi - 0x10], 0
jne 0x18003244a
mov dword [r14], 3
mov eax, dword [rbx]
shr eax, 1
not eax
test r13b, al
je 0x180032473
lea rcx, [0x18006db20]
call qword [sym.imp.SHCORE.dll_Ordinal_190]
nop dword [rax + rax]
test eax, eax
je 0x180032473
mov dword [r14], 3
test byte [rbx], 0x10
je 0x18003247b
or dword [rdi], r13d
mov al, byte [rbx]
not al
and al, r13b
mov byte [rdi + 4], al
mov eax, dword [rbx]
shr eax, 5
and al, r13b
mov byte [rdi + 5], al
mov eax, dword [rbx]
shr eax, 2
and al, r13b
mov byte [rdi + 6], al
add r15d, r13d
add r14, 4
add rbx, 0x10
add rdi, 0x18
cmp r15d, 7
jb 0x1800323ee
lea rdi, [0x18006a7ec]
lea rbx, [rsi + 0x120]
mov r14d, 6
test byte [rdi], 4
je 0x1800324ee
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbx - 0x18]
call qword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_ILIsParent]
nop dword [rax + rax]
test eax, eax
je 0x1800324ee
mov rax, qword [rbx]
mov qword [rbx - 0x10], rax
add rbx, 0x18
add rdi, 0x10
sub r14, r13
jne 0x1800324c8
lea rcx, [rsi + 0x30]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov r8d, dword [0x180084218]
lea ebx, [r14 + 2]
test bl, r8b
jne 0x180032537
lea rdx, [rsp + 0x60]
lea rcx, [0x180084218]
call fcn.1800365dc
mov rcx, qword [rax]
mov qword [rsp + 0x48], rcx
mov r8d, ecx
mov dword [rsp + 0x40], ebx
xor r15d, r15d
mov byte [rsp + 0x44], r15b
mov r9d, r8d
shr r9d, 9
and r9d, r13d
shr r8d, 8
and r8d, r13d
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r15d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0xf33c8f
lea rcx, [0x180084220]
call fcn.180011b40
mov rcx, rsi
call fcn.1800335d8
mov edi, eax
test eax, eax
jns 0x1800325a7
mov r9d, eax
mov edx, Ordinal_170
lea r8, str.pcshell_shell_appresolverlib_appresolvercache.cpp
mov rcx, qword [rbp + 0x208]
call fcn.18000a0f0
jmp 0x1800325aa
mov edi, r15d
cmp dword [rbp - 0x58], r15d
je 0x1800325b9
lea rcx, [rbp - 0x70]
call fcn.18000aa4c
cmp byte [rbp - 0x78], r15b
je 0x1800325e3
mov rbx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.180062960
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret