Function at 0x18008aa70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x78]
sub rsp, 0x178
mov rax, qword [0x1800c37a8]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0xf8]
mov r15, r8
mov r10, qword [rbp + 0xe0]
mov r11, rdx
mov rsi, qword [rbp + 0xe8]
mov qword [rbp - 0x10], rax
mov eax, dword [rbp + 0xf0]
mov ebx, eax
mov qword [rbp - 8], r8
mov r8, rcx
mov qword [rbp - 0x40], r10
mov qword [rbp - 0x68], rcx
mov rcx, qword [rbp - 0x40]
lea r14d, [rax + 0x6d0]
mov qword [rbp - 0x50], r9
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x70], rcx
cmp eax, r14d
jae 0x18008ae80
mov eax, dword [rbp - 0x78]
mov r12d, 0x49
mov edi, dword [rbp - 0x60]
mov r13d, 0x8000
mov dword [rsp + 0x60], eax
mov edx, 0x31
cmp ebx, 0x194
ja 0x18008ad3e
je 0x18008acf0
cmp ebx, 0x11d
ja 0x18008ac0b
je 0x18008ab76
mov eax, ebx
sub eax, 0x43
je 0x18008ab69
sub eax, 0x6d
je 0x18008ab60
sub eax, 0xa
je 0x18008ab57
mov edx, dword [rsp + 0x60]
cmp eax, r12d
jne 0x18008addc
mov word [rbp + 8], r12w
mov dword [rbp + 0xa], 0x42004e
jmp 0x18008addc
xor eax, eax
mov edi, eax
jmp 0x18008add8
or word [r11], r13w
jmp 0x18008add8
xor eax, eax
mov edx, eax
mov dword [rsp + 0x60], eax
jmp 0x18008addc
test rsi, rsi
je 0x18008ab80
mov rcx, rsi
jmp 0x18008abe9
mov eax, dword [r8 + 0x28]
mov rdx, qword [r8 + 0x50]
movzx ecx, word [r15]
imul ecx, eax
mov qword [rsp + 0x30], r8
mov dword [rbp - 0x80], eax
movzx eax, word [r9 + 8]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x80]
add ecx, dword [r8 + 0x1c]
lea r8, [rsp + 0x70]
mov word [rsp + 0x70], ax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], ecx
mov ecx, 0x89
mov byte [rsp + 0x68], 0x16
mov qword [rsp + 0x20], rax
call fcn.1800948f0
mov dword [rsp + 0x60], eax
test eax, eax
js 0x18008b27e
mov rax, qword [rbp - 0x68]
mov rcx, qword [rax + 0x50]
movzx eax, byte [rcx + 4]
mov qword [rbp - 0x70], rcx
test al, 1
jne 0x18008ae6c
test al, al
js 0x18008add8
mov eax, 0xffffd8ec
jmp 0x18008b27e
mov eax, ebx
sub eax, 0x127
je 0x18008ac55
sub eax, r12d
je 0x18008ac40
cmp eax, 0x1a
jne 0x18008add8
movzx eax, byte [rcx + 4]
test al, 2
jne 0x18008ae76
test al, 4
je 0x18008add8
mov eax, 0xffffd8ea
jmp 0x18008b27e
mov eax, 0x5f
mov dword [rbp + 0xe], 0x460055
mov word [rbp + 0x12], ax
jmp 0x18008add8
mov rax, qword [r8 + 0x88]
test rax, rax
je 0x18008ac71
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rax
mov r8, qword [rbp - 0x68]
xor ecx, ecx
lea rax, [0x1800898b0]
mov qword [rsp + 0x50], rcx
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x48], 0x68
mov r9, r8
mov qword [rsp + 0x40], rcx
lea r8, [rsp + 0x70]
mov qword [rbp - 0x60], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov word [rsp + 0x70], cx
mov byte [rsp + 0x68], cl
mov dword [rbp - 0x80], ecx
mov word [rsp + 0x78], cx
call fcn.18008b2a0
mov rcx, qword [rbp - 0x70]
mov edi, eax
mov edx, dword [rsp + 0x60]
cmp eax, 0xffffd8a8
jne 0x18008addc
xor edi, edi
jmp 0x18008addc
test edi, edi
je 0x18008ad16
mov rax, qword [r8 + 0x88]
test rax, rax
je 0x18008ad16
xor r9d, r9d
mov r8d, edi
xor ecx, ecx
lea edx, [r9 + 1]
call rax
mov rcx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x68]
mov rax, qword [r8 + 0x88]
test rax, rax
je 0x18008add8
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0x100
call rax
mov rcx, qword [rbp - 0x70]
jmp 0x18008add8
cmp ebx, 0x24a
ja 0x18008ad92
je 0x18008ad89
mov eax, ebx
sub eax, 0x1dd
je 0x18008ad80
sub eax, 0x1a
je 0x18008ad64
mov edx, dword [rsp + 0x60]
cmp eax, 0xa
jne 0x18008addc
mov dword [rbp - 0x78], edi
jmp 0x18008addc
cmp word [r11], 0
jge 0x18008ac36
cmp word [rcx + 2], 0
je 0x18008add8
mov eax, 0xffffd8e3
jmp 0x18008b27e
mov dword [rbp + 0x14], 0x440049
jmp 0x18008add8
mov dword [rbp + 0x18], 0x5f0058
jmp 0x18008add8
mov eax, ebx
sub eax, 0x26e
je 0x18008b27b
sub eax, r12d
je 0x18008adc6
mov edx, dword [rsp + 0x60]
cmp eax, 0x6d
jne 0x18008addc
mov eax, 0x61
mov dword [rbp + 0x26], 0x56005f
mov word [rbp + 0x2a], ax
mov dword [rbp + 0x2c], 0x350064
jmp 0x18008addc
mov dword [rbp + 0x1c], 0x340032
mov word [rbp + 0x20], dx
mov dword [rbp + 0x22], 0x330037
mov edx, dword [rsp + 0x60]
mov r8, qword [rbp - 0x68]
add ebx, 0x6d
mov r9, qword [rbp - 0x50]
mov r11, qword [rbp - 0x48]
cmp ebx, r14d
jb 0x18008ab03
mov r10, qword [rbp - 0x40]
mov ebx, dword [rbp + 0xf0]
mov r13d, ebx
shl r13d, 5
mov edi, ebx
cmp ebx, r13d
ja 0x18008b27b
movzx esi, byte [rsp + 0x68]
mov r12d, dword [rbp - 0x60]
movzx r14d, word [rsp + 0x68]
mov r15d, dword [rbp - 0x60]
cmp edi, 0xb21
ja 0x18008b0df
je 0x18008b0ce
cmp edi, 0x309
ja 0x18008b014
je 0x18008affe
mov eax, edi
sub eax, 0x43
je 0x18008af5b
sub eax, 0x86
je 0x18008aea1
sub eax, 0x3a
je 0x18008ae8c
cmp eax, 0x4c
je 0x18008b27b
jmp 0x18008b25b
mov eax, 0xffffd8e4
jmp 0x18008b27e
mov eax, 0xffffd8eb
jmp 0x18008b27e
mov edx, dword [rbp - 0x78]
mov dword [rsp + 0x60], edx
jmp 0x18008adf8
mov eax, 0x5f
mov dword [rbp + 0x32], 0x650064
mov word [rbp + 0x30], ax
jmp 0x18008b25b
test edx, edx
jne 0x18008af53
mov ebx, 0xf1
nop
mov eax, ebx
sub eax, 0xf1
je 0x18008aeca
cmp eax, 1
jne 0x18008af2b
test r9, r9
je 0x18008af2b
mov word [r9 + 0x10], r14w
jmp 0x18008af2b
test r10, r10
je 0x18008aed3
mov word [r10], r14w
mov eax, dword [rcx + 8]
lea rdx, [rsp + 0x70]
mov dword [rbp - 0x78], eax
movzx eax, word [rcx + 2]
lea rcx, [rbp - 0x80]
mov word [rsp + 0x70], ax
movzx eax, word [r11]
mov word [rsp + 0x78], ax
xor eax, eax
mov dword [rsp + 0x38], 0x103
mov dword [rbp - 0x38], eax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r9
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x38]
mov word [rbp - 0x80], r14w
call fcn.180096680
mov rcx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x68]
inc ebx
mov r9, qword [rbp - 0x50]
mov r10, qword [rbp - 0x40]
mov r11, qword [rbp - 0x48]
cmp ebx, 0xf3
jb 0x18008aeb0
mov edx, dword [rsp + 0x60]
mov ebx, dword [rbp + 0xf0]
mov dword [rbp - 0x78], edx
jmp 0x18008b25b
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x18008af7b
add rcx, 0xd
mov r8d, 0x20
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov rcx, qword [rbp - 0x70]
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
test eax, eax
je 0x18008af8b
mov dword [rcx + 8], eax
mov rax, qword [rbp - 0x50]
test rax, rax
je 0x18008af98
movzx eax, word [rax + 8]
mov word [rsp + 0x70], ax
lea rdx, [rsp + 0x68]
mov rax, qword [rbp - 8]
xor r9d, r9d
mov r8d, 0x128
movzx eax, word [rax]
mov word [rsp + 0x78], ax
mov rax, qword [rbp - 0x48]
movzx eax, word [rax]
mov word [rbp - 0x80], ax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.180092560
movzx r14d, word [rsp + 0x68]
mov edx, eax
mov dword [rsp + 0x60], eax
jmp 0x18008b25b
xor eax, eax
mov dword [rbp + 0x36], 0x630073
mov word [rbp + 0x3a], ax
mov word [rbp + 0x40], ax
jmp 0x18008b25b
cmp edi, 0x50f
je 0x18008b094
cmp edi, 0x715
je 0x18008b070
cmp edi, 0x91b
jne 0x18008b25b
lea rcx, [rbp + 0x40]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x18008b040
movsd xmm0, qword [str..dll]
mov sil, 1
movzx eax, word [0x1800a54b0]
mov r12d, 2
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
jmp 0x18008b25b
mov r8d, 0xa
mov dword [rbp + 0x4a], 0x79
lea rdx, [rbp + 0x4c]
lea ecx, [r8 + 0x16]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
mov edx, dword [rsp + 0x60]
jmp 0x18008b25b
lea rcx, [rbp + 0x40]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x18008b0a0
mov eax, dword [0x1800a54b4]
mov dword [rcx], eax
movabs rax, 0x65006c0073
mov qword [rbp + 0x42], rax
mov eax, 0x61
mov dword [rbp + 0x48], eax
jmp 0x18008b25b
xor eax, eax
mov dword [rbp - 0x2c], 0x40000
mov dword [rbp - 0x20], eax
jmp 0x18008b25b
cmp edi, 0x1339
ja 0x18008b173
je 0x18008b138
cmp edi, 0xd27
je 0x18008b123
cmp edi, 0xf2d
je 0x18008b116
cmp edi, 0x1133
jne 0x18008b25b
xor eax, eax
mov r15d, eax
mov dword [rbp - 0x28], eax
jmp 0x18008b25b
mov qword [rbp - 0x18], 0xffffffffffffffff
jmp 0x18008b25b
xor eax, eax
mov dword [rbp - 0x30], 1
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x24], eax
jmp 0x18008b25b
mov r8d, 0xb7
lea rdx, [rbp + 0x40]
lea ecx, [r8 + 0x10]
call fcn.1800054c0
mov r8d, dword [rbp - 0x30]
lea r9, [rbp - 0x58]
mov edx, dword [rbp - 0x2c]
mov ecx, r12d
mov qword [rbp], rax
xor eax, eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_SaferCreateLevel]
mov edx, dword [rsp + 0x60]
jmp 0x18008b25b
cmp edi, 0x153f
je 0x18008b24b
cmp edi, 0x1745
je 0x18008b198
cmp edi, 0x194b
je 0x18008b27b
jmp 0x18008b25b
test sil, sil
je 0x18008b20b
mov ebx, 0x10a
mov eax, ebx
sub eax, 0x10a
je 0x18008b1e1
cmp eax, 1
jne 0x18008b1fb
cmp qword [rbp - 0x18], 0
jne 0x18008b1c6
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_SaferCloseLevel]
xor sil, sil
jmp 0x18008b1fb
test sil, sil
je 0x18008b1fb
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_SaferCloseLevel]
jmp 0x18008b1fb
mov rcx, qword [rbp - 0x58]
lea r8, [rbp - 0x18]
xor eax, eax
mov r9d, r15d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_SaferComputeTokenFromLevel]
inc ebx
cmp ebx, 0x10c
jb 0x18008b1a2
mov ebx, dword [rbp + 0xf0]
mov eax, dword [rbp - 0x60]
lea r8, [rbp - 0x20]
mov dword [rsp + 0x38], eax
lea rcx, [rbp + 8]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp - 0x28]
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0x24]
mov qword [rsp + 0x20], rax
call sub.SHLWAPI.dll_SHRegGetUSValueW
call qword [rbp]
mov edx, dword [rsp + 0x60]
cmp eax, 1
sete byte [rbp - 0x78]
jmp 0x18008b25b
xor eax, eax
movzx esi, sil
cmp qword [rbp - 0x58], rax
mov dword [rbp - 0x60], eax
cmove esi, eax
mov rcx, qword [rbp - 0x70]
lea edi, [rdi + rbx*2]
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x50]
mov r10, qword [rbp - 0x40]
mov r11, qword [rbp - 0x48]
cmp edi, r13d
jbe 0x18008ae23
mov eax, dword [rbp - 0x78]
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1800a1820
add rsp, 0x178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret