Function at 0x1800540a0
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r15
push rbp
lea rbp, [rax - 0x3d8]
sub rsp, 0x4d0
mov rax, qword [0x1800a98a0]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
mov ebx, ecx
mov edi, 1
call qword [sym.imp.KERNELBASE.dll_WTSGetServiceSessionId]
mov edx, eax
xor r15d, r15d
mov rax, qword gs:[0x60]
cmp dword [rax + 0x2c0], edx
je 0x180054111
call qword [sym.imp.ntdll.dll_RtlGetActiveConsoleId]
mov edx, eax
mov esi, edi
mov rax, qword gs:[0x60]
cmp dword [rax + 0x2c0], edx
jne 0x180054114
mov esi, r15d
lea rdx, [rsp + 0x34]
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x34], r15d
call qword [sym.imp.WINSTA.dll_WinStationGetLoggedOnCount]
test ebx, 0x4809
je 0x180054195
mov ecx, dword [rsp + 0x30]
mov r8d, ebx
mov edx, dword [rsp + 0x34]
call fcn.180054020
test esi, esi
je 0x180054171
test eax, eax
je 0x18005416a
cmp dword [rsp + 0x30], edi
jbe 0x180054163
neg edx
sbb ebx, ebx
and ebx, 0x28
add ebx, 0x2c8
jmp 0x1800541d3
mov ebx, 0x2ef
jmp 0x1800541d3
mov ebx, 0x2c7
jmp 0x1800541d3
test eax, eax
je 0x1800542e5
cmp dword [rsp + 0x30], edi
jbe 0x18005418e
neg edx
sbb ebx, ebx
and ebx, 0x29
add ebx, 0x2c9
jmp 0x1800541d3
mov ebx, 0x2f1
jmp 0x1800541d3
test ebx, 0x1002
je 0x1800542e5
mov ecx, dword [rsp + 0x30]
mov r8d, ebx
mov edx, dword [rsp + 0x34]
call fcn.180054020
test eax, eax
je 0x1800542e5
cmp dword [rsp + 0x30], edi
jbe 0x1800541ce
neg edx
sbb ebx, ebx
and ebx, 0x2a
add ebx, 0x2ca
jmp 0x1800541d3
mov ebx, 0x2f3
lea rdx, str.RegistryMachineSoftwareMicrosoftWindows_NTCurrentVersionWindows
or esi, 0xffffffff
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x58], 0x30
xorps xmm0, xmm0
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x60], r15
mov edx, 0x20019
mov dword [rsp + 0x70], 0x40
lea rcx, [rsp + 0x38]
movdqu xmmword [rsp + 0x78], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x180054278
lea rdx, str.ShutdownWarningDialogTimeout
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x78]
mov r8d, 2
mov dword [rsp + 0x20], 0x14
lea rdx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov rcx, qword [rsp + 0x38]
test eax, eax
cmovns esi, dword [rbp - 0x6c]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [0x1800aa228]
lea r8, [rbp - 0x60]
mov r9d, 0x104
mov word [rsp + 0x20], r15w
mov edx, 0x2c6
call qword [sym.imp.KERNELBASE.dll_LoadStringBaseExW]
mov rcx, qword [0x1800aa228]
lea r8, [rbp + 0x1b0]
mov r9d, 0x104
mov word [rsp + 0x20], r15w
mov edx, ebx
call qword [sym.imp.KERNELBASE.dll_LoadStringBaseExW]
mov r9d, 0x211034
mov dword [rsp + 0x28], esi
lea r8, [rbp - 0x60]
mov word [rsp + 0x20], r15w
lea rdx, [rbp + 0x1b0]
xor ecx, ecx
call sym.USER32.dll_MessageBoxTimeoutW
cmp eax, 7
cmove edi, r15d
mov eax, edi
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.180033470
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r15, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret