Function at 0x18005e2ec
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x18019bca8]
xor rax, rsp
mov qword [rbp + 0x380], rax
xor r12d, r12d
mov r15d, edx
mov qword [rsp + 0x50], r12
mov rsi, rcx
mov qword [rsp + 0x48], r12
call sub.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.18005f4c4
mov edi, 0x80070005
mov ebx, eax
lea r13d, [rdi - 5]
cmp eax, edi
je 0x1800c5274
test ebx, ebx
js 0x1800c533d
mov rdx, qword [rsp + 0x48]
test rdx, rdx
jne 0x1800c5357
test ebx, ebx
js 0x1800c5382
cmp byte [rsp + 0x40], 1
je 0x18005e4d7
mov r8d, 0x200
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.18005e6e0
mov edi, eax
test eax, eax
js 0x1800c539f
mov ebx, edi
test edi, edi
js 0x18005e3c9
lea r8, [rbp - 0x80]
mov rdx, 0xffffffff80000000
lea rcx, [rsp + 0x50]
call fcn.18005f30c
mov ebx, eax
test eax, eax
jle 0x18005e3c2
movzx ebx, ax
or ebx, r13d
test ebx, ebx
jns 0x18005e400
mov ebx, r12d
lea rcx, [rsp + 0x50]
call fcn.18005f368
mov eax, ebx
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.18008b970
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret
mov edi, r12d
mov r13d, 0x103
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], r12
lea r8, [rbp - 0x80]
mov qword [rsp + 0x28], r12
mov edx, edi
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x58], 0x200
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
mov esi, eax
test eax, eax
jne 0x18005e4cd
mov rdx, qword [rsp + 0x50]
lea r8, [rbp - 0x80]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x5c], 0x400
call fcn.18005f30c
test eax, eax
jne 0x18005e4b3
lea r9, [rsp + 0x5c]
lea r8, str.CLSID
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.18005dbf8
test eax, eax
jne 0x18005e4b3
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_IIDFromString]
test eax, eax
js 0x18005e4b3
cmp byte [rsp + 0x40], r12b
jne 0x18005e4e6
lea rdx, [rsp + 0x68]
mov ecx, r15d
call fcn.18005d538
lea rcx, [rsp + 0x48]
call fcn.18005f368
inc edi
cmp esi, r13d
jne 0x18005e409
jmp 0x18005e3c9
cmp esi, r13d
je 0x18005e4bd
jmp 0x1800c53b9
cmp r15d, 1
jne 0x18005e3c6
jmp 0x18005e37f
mov rax, qword [rsp + 0x68]
sub rax, qword [0x1801686e8]
jne 0x18005e500
mov rax, qword [rsp + 0x70]
sub rax, qword [0x1801686f0]
test rax, rax
jne 0x18005e4b3
jmp 0x18005e4a6
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThread]
mov edx, 4
lea r9, [rsp + 0x48]
mov rcx, rax
lea r8d, [rdx - 3]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThreadToken]
test eax, eax
jne 0x1800c52ca
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1800c52a7
movzx ebx, ax
or ebx, r13d
cmp ebx, 0x800703f0
jne 0x1800c52c6
cmp dword [0x18019cca4], r12d
je 0x1800c52bf
mov ecx, edi
call fcn.180096ba4
mov ebx, edi
jmp 0x18005e35e
test ebx, ebx
js 0x1800c533d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadToken]
test eax, eax
jne 0x1800c5306
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1800c52ea
movzx ebx, ax
or ebx, r13d
test ebx, ebx
jns 0x1800c5306
cmp dword [0x18019cca4], r12d
je 0x1800c52fe
mov ecx, ebx
call fcn.180096ba4
test ebx, ebx
js 0x18005e35e
call sub.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.18005f4c4
mov edi, eax
test eax, eax
jns 0x1800c532e
cmp dword [0x18019cca4], r12d
je 0x1800c532e
mov ecx, eax
call fcn.180096ba4
mov ebx, edi
test edi, edi
js 0x18005e35e
jmp 0x18005e356
cmp dword [0x18019cca4], r12d
je 0x18005e35e
mov ecx, ebx
call fcn.180096ba4
nop
jmp 0x18005e35e
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadToken]
test eax, eax
jne 0x18005e36c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x18005e36c
movzx ebx, ax
or ebx, r13d
jmp 0x18005e36c
cmp dword [0x18019cca4], r12d
je 0x1800c5392
mov ecx, ebx
call fcn.180096ba4
test ebx, ebx
js 0x18005e3c9
jmp 0x18005e374
cmp dword [0x18019cca4], r12d
je 0x18005e39b
mov ecx, edi
call fcn.180096ba4
nop
jmp 0x18005e39b
cmp dword [0x18019cca4], r12d
mov ebx, 0x88982f8a
je 0x18005e3c9
mov ecx, ebx
call fcn.180096ba4
nop
jmp 0x18005e3c9