Function at 0x180019f7c
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rsi, rdx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
mov rbx, qword [0x18015f768]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x60]
lea rcx, [0x180162940]
call fcn.18001b638
nop
mov r8, qword [rax]
lea rdx, str._sInstall
lea rcx, [rsp + 0x50]
call fcn.180008f64
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
lea r15, [0x18015f758]
or r14d, 0xffffffff
cmp rcx, r15
je 0x18001a03e
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r13d
jg 0x18001a039
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
mov rbx, qword [rsp + 0x48]
jmp 0x18001a03e
mov rbx, qword [rsp + 0x48]
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, r13d
je 0x18001a0d4
lea rdi, [rbx - 0xc]
cmp dword [rdi], r13d
jl 0x18001a06c
mov qword [rsi], rbx
lock add dword [rdi], 1
jmp 0x18001a08d
mov rax, qword [0x18015f768]
mov qword [rsi], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
mov edx, eax
mov rcx, rsi
call fcn.180003e28
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, r15
je 0x18001a0b0
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r13d
jg 0x18001a0b0
call fcn.1800d1434
nop
cmp rdi, r15
je 0x18001a0cc
mov edx, r14d
lock xadd dword [rdi], edx
add edx, r14d
cmp edx, r13d
jg 0x18001a0cc
mov rcx, rdi
call fcn.1800d1434
mov rax, rsi
jmp 0x18001a3c2
mov ecx, 8
call fcn.1800d1934
cmp rax, r13
je 0x18001a0ed
lea rcx, [rsp + 0x70]
mov qword [rax], rcx
jmp 0x18001a0f0
mov rax, r13
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x98], r13
mov ebp, 0x80
mov dword [rsp + 0x40], ebp
mov edi, r13d
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xb0]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov r12d, 0x103
cmp eax, r12d
je 0x18001a1d9
inc edi
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x68]
call fcn.1800041c0
nop
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.180001910
nop
mov rcx, qword [rsp + 0x68]
add rcx, 0xfffffffffffffff4
cmp rcx, r15
je 0x18001a19d
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r13d
jg 0x18001a19d
call fcn.1800d1434
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xb0]
mov edx, edi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, r12d
jne 0x18001a156
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11, qword [rsp + 0x90]
sub r11, qword [rsp + 0x88]
test r11, 0xfffffffffffffff8
jne 0x18001a286
lea rdi, [rbx - 0xc]
cmp dword [rdi], r13d
jl 0x18001a213
mov qword [rsi], rbx
lock add dword [rdi], 1
jmp 0x18001a234
mov rax, qword [0x18015f768]
mov qword [rsi], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
mov edx, eax
mov rcx, rsi
call fcn.180003e28
nop
lea rcx, [rsp + 0x70]
call fcn.1800016ac
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, r15
je 0x18001a262
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r13d
jg 0x18001a262
call fcn.1800d1434
nop
cmp rdi, r15
je 0x18001a27e
mov eax, r14d
lock xadd dword [rdi], eax
add eax, r14d
cmp eax, r13d
jg 0x18001a27e
mov rcx, rdi
call fcn.1800d1434
mov rax, rsi
jmp 0x18001a3c2
lea rcx, [0x18010d37c]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [0x18010d37c]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.180008324
mov r11, qword [rsp + 0x90]
mov r12, r11
mov rax, qword [rsp + 0x88]
sub r12, rax
sar r12, 3
mov edi, r13d
mov rbp, r13
cmp r12d, r13d
jbe 0x18001a342
lea ebx, [r12 - 1]
sub r11, rax
sar r11, 3
cmp rbp, r11
jb 0x18001a2e9
call fcn.1800d15f4
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + rbp*8]
mov r8, rax
mov edx, dword [rax - 8]
lea rcx, [rsp + 0x48]
call fcn.180008324
cmp edi, ebx
jae 0x18001a321
lea rcx, [0x180117970]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [0x180117970]
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.180008324
inc edi
inc rbp
cmp edi, r12d
jae 0x18001a33d
mov r11, qword [rsp + 0x90]
mov rax, qword [rsp + 0x88]
jmp 0x18001a2d0
mov rbx, qword [rsp + 0x48]
lea rdi, [rbx - 0xc]
cmp dword [rdi], r13d
jl 0x18001a354
mov qword [rsi], rbx
lock add dword [rdi], 1
jmp 0x18001a375
mov rax, qword [0x18015f768]
mov qword [rsi], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
mov edx, eax
mov rcx, rsi
call fcn.180003e28
nop
lea rcx, [rsp + 0x70]
call fcn.1800016ac
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, r15
je 0x18001a3a3
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r13d
jg 0x18001a3a3
call fcn.1800d1434
nop
cmp rdi, r15
je 0x18001a3bf
mov eax, r14d
lock xadd dword [rdi], eax
add eax, r14d
cmp eax, r13d
jg 0x18001a3bf
mov rcx, rdi
call fcn.1800d1434
mov rax, rsi
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1800d12b0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret