Function at 0x180042370
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa68]
sub rsp, 0xb68
mov ebx, dword [rbp + 0xab0]
mov rdi, r9
imul eax, ecx, 0xa60
mov r11, r8
mov edx, ecx
mov dword [rsp + 0x60], ecx
mov dword [rbp - 0x60], eax
cmp ecx, eax
ja 0x1800427e7
mov r15, qword [rbp - 0x48]
mov r12d, 0x104
mov esi, dword [rbp + 0xab0]
xor r10d, r10d
mov r14d, dword [rbp + 0xab0]
nop dword [rax + rax]
cmp ecx, 0x15de9
ja 0x180042742
je 0x18004262d
cmp ecx, 0x27cb
ja 0x1800425db
je 0x18004256d
mov eax, ecx
sub eax, 0x24
je 0x180042bb2
sub eax, 0x19
je 0x1800424f0
sub eax, 0xd0
je 0x1800424c0
cmp eax, 0x14
jne 0x180042b91
mov r8, r12
mov dword [rsp + 0x74], r12d
xor edx, edx
lea rcx, [rbp + 0x140]
call fcn.180070440
lea rcx, [rbp + 0x250]
mov edx, 2
lea rax, [rbp + 0x140]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x180042460
mov eax, dword [rax]
mov dword [rcx], eax
mov dword [rbp - 0x64], r12d
jmp 0x180042b84
mov r8, qword [rbp + 0xad8]
mov r12d, 0x104
mov dword [rbp - 0x70], r10d
movzx eax, word [r8]
mov word [rbp + 0x8b8], ax
mov rax, qword [rbp + 0xad0]
mov eax, dword [rax]
mov dword [rbp + 0x9cc], eax
jmp 0x180042b91
mov rax, qword [rbp + 0xad0]
mov r8, qword [rbp + 0xad8]
mov eax, dword [rax]
mov ecx, dword [r8 + 8]
lea r9d, [rax + 1]
mov dword [rsp + 0x70], r9d
cmp r9d, ecx
jae 0x180042b8d
mov rdx, qword [r8]
movzx r8d, byte [rax + rdx]
nop
cmp byte [r9 + rdx], r8b
jne 0x18004252e
inc r9d
cmp r9d, ecx
jb 0x180042520
mov r8, qword [rbp + 0xad8]
mov edx, dword [rbp + 0xab0]
mov dword [rsp + 0x70], r9d
cmp r9d, ecx
jae 0x180042b8d
mov rdx, qword [r8]
nop dword [rax]
cmp byte [r9 + rdx], 0x20
jne 0x180042b87
inc r9d
mov dword [rsp + 0x70], r9d
cmp r9d, ecx
jb 0x180042550
jmp 0x180042b87
mov r8, qword [rbp + 0xad8]
mov r9d, dword [rsp + 0x70]
mov ecx, dword [r8 + 8]
cmp r9d, ecx
jae 0x1800425b8
mov rdx, qword [r8]
mov eax, r9d
cmp byte [rax + rdx], 0x20
jne 0x180042596
inc r9d
cmp r9d, ecx
jb 0x180042585
mov dword [rsp + 0x70], r9d
cmp r9d, ecx
jae 0x1800425b8
mov rax, qword [r8]
mov ecx, r9d
movzx edx, byte [rcx + rax]
cmp dl, 0xd
je 0x1800425b8
cmp dl, 0xa
jne 0x180042c1f
mov rax, qword [rbp + 0xad0]
mov edx, r10d
mov ecx, dword [rax]
mov rax, qword [r8]
cmp byte [rcx + rax], 0x3d
setne dl
inc edx
mov dword [r11], edx
mov dword [rdi], r9d
jmp 0x180042b87
cmp ecx, 0x4f59
je 0x1800428cf
cmp ecx, 0xaf7b
je 0x180042607
cmp ecx, 0xbc87
jne 0x180042b91
mov dword [rbp - 0x68], 4
jmp 0x180042b91
mov ecx, 0xfffffebc
mov qword [rbp + 0x9c2], r10
lea rdx, [rbp + 0x470]
mov word [rbp + 0x9ca], r10w
call qword [0x1800d5910]
jmp 0x180042b84
mov rax, qword [rbp + 0x9c2]
test rax, rax
je 0x180042722
mov qword [rsp + 0x28], r10
lea r8, [rbp - 0x70]
mov r9d, 0xcd
mov qword [rsp + 0x20], r10
xor edx, edx
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x10]
call fcn.180007740
movups xmm1, xmmword [rax]
movsd xmm0, qword [rax + 0x10]
movd eax, xmm1
movsd qword [rbp], xmm0
cdq
and edx, 3
lea r12d, [rdx + rax]
sar r12d, 2
mov dword [rbp - 0x70], r12d
test rdi, rdi
je 0x1800426f5
mov rcx, qword [rbp + 0x9c2]
lea r9, [rsp + 0x68]
xor edx, edx
mov qword [rsp + 0x68], rcx
lea rcx, [rbp - 0x10]
lea r8d, [rdx + 0x58]
call fcn.180012860
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
test r12d, r12d
jle 0x1800426d6
mov rdx, qword [rbp - 0x28]
mov ecx, r12d
sub rdx, rdi
nop dword [rax]
mov eax, dword [rdx + rdi]
mov dword [rdi], eax
add rdi, 4
sub rcx, 1
jne 0x1800426c0
mov qword [rbp + 0xac8], rdi
mov rax, qword [rbp + 0x9c2]
lea r8, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x68], rax
xor ecx, ecx
lea edx, [r9 + 0x37]
call fcn.180030a70
mov rax, qword [rbp + 0x9c2]
lea rdx, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x68], rax
mov ecx, 0xfd
call fcn.180027600
mov ecx, dword [rsp + 0x60]
xor r10d, r10d
mov edx, dword [rbp + 0xab0]
jmp 0x180042726
mov r12d, dword [rbp - 0x70]
movzx eax, word [rbp + 0x9ca]
mov ebx, r12d
mov word [0x1800d5918], ax
mov r12d, 0x104
jmp 0x180042b91
cmp ecx, 0x2eeb9
ja 0x1800427c7
je 0x180042784
cmp ecx, 0x177ed
je 0x180042774
cmp ecx, 0x20c57
je 0x1800427e7
cmp ecx, 0x23353
jne 0x180042b91
mov r14d, r10d
jmp 0x180042b91
mov dword [rsp + 0x7c], 0x50
mov esi, r10d
jmp 0x180042b91
movups xmm0, xmmword [str.PassesPreflightChecks____ready_to_start_diskspace_check]
mov qword [rbp - 0x50], 0xffffffff80000002
movups xmm1, xmmword [0x18009fab8]
mov qword [rbp - 0x58], 0xffffffff80000001
movaps xmmword [rbp + 0x10], xmm0
movups xmm0, xmmword [0x18009fac8]
movaps xmmword [rbp + 0x20], xmm1
movsd xmm1, qword [0x18009fad8]
movaps xmmword [rbp + 0x30], xmm0
movsd qword [rbp + 0x40], xmm1
jmp 0x180042b91
cmp ecx, 0x3aa1f
je 0x180042b59
cmp ecx, 0x46585
je 0x1800427fd
cmp ecx, 0x520eb
jne 0x180042b91
mov eax, ebx
add rsp, 0xb68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
test r15, r15
jne 0x180042c1f
mov ecx, r10d
mov r13d, r10d
mov dword [rsp + 0x68], ecx
mov r12d, 0x7d
nop word [rax + rax]
mov eax, r12d
sub eax, 0x7d
je 0x180042a8e
sub eax, 1
je 0x180042a2c
sub eax, 1
je 0x1800429bb
sub eax, 1
je 0x180042861
cmp eax, 1
jne 0x180042b18
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsxd r15, eax
xor r10d, r10d
jmp 0x180042b14
mov eax, dword [rbp - 0x80]
test eax, eax
je 0x180042b18
mov edi, r10d
nop
mov ebx, 0x107
nop word [rax + rax]
cmp ebx, 0x107
je 0x1800429aa
cmp ebx, 0xb6de
je 0x180042950
cmp ebx, 0x16cb5
je 0x180042913
cmp ebx, 0x2228c
je 0x1800428d9
cmp ebx, 0x2d863
jne 0x180042988
test esi, esi
je 0x180042988
test r14d, r14d
je 0x180042988
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1800427e9
lea rcx, [rbp + 0x80]
call fcn.1800737f4
mov rcx, rax
lea rdx, str.IDS_DEL_GROUP
call fcn.180078e00
test eax, eax
jne 0x180042985
xor r10d, r10d
cmp dword [rsp + 0x78], 1
jne 0x180042988
lea r14d, [rax + 1]
jmp 0x180042988
lea rcx, [rbp + 0x80]
call fcn.1800737f4
xor r10d, r10d
lea r8, str.enabled
mov rdx, rax
mov eax, r10d
nop
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r8 + rax - 1]
jne 0x180042988
cmp rax, 8
jne 0x180042930
cmp dword [rsp + 0x78], 1
jne 0x180042988
lea esi, [rax - 7]
jmp 0x180042988
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x7c]
lea rax, [rsp + 0x78]
mov edx, edi
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x80]
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r10
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor r10d, r10d
add ebx, 0xb5d7
cmp ebx, 0x38d33
jbe 0x180042880
inc edi
cmp edi, dword [rbp - 0x80]
jb 0x180042870
jmp 0x180042b14
mov dword [rsp + 0x7c], 0x50
mov byte [rbp + 0x80], 0
jmp 0x180042988
test r15, r15
jne 0x180042c1f
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x58], rax
lea r8, [rbp - 0x64]
lea rax, [rbp - 0x40]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rdx, [rbp + 0x250]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x34]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor r10d, r10d
jmp 0x180042b14
lea rcx, [rbp + 0xd0]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180042a36
lea r8, [rbp + 0x360]
xor edx, edx
nop dword [rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180042a50
mov rcx, qword [rbp - 0x50]
lea rax, [rbp - 0x78]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movsxd r15, eax
xor r10d, r10d
jmp 0x180042b14
lea rax, [rbp - 0x48]
mov edx, ecx
mov rcx, qword [rbp - 0x58]
lea r9, [rsp + 0x74]
mov qword [rsp + 0x38], rax
lea r8, [rbp + 0x360]
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r10
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ecx, dword [rsp + 0x74]
test eax, eax
mov r13d, eax
mov eax, 0x104
cmove ecx, eax
xor r10d, r10d
mov edx, r10d
mov dword [rsp + 0x74], ecx
nop dword [rax]
movzx ecx, byte [rbp + rdx + 0x10]
mov byte [rbp + rdx + 0xd0], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x180042ae0
lea rcx, [rbp + 0xd0]
dec rcx
nop
cmp byte [rcx + 1], r10b
lea rcx, [rcx + 1]
jne 0x180042b00
movzx eax, word [0x18009fa88]
mov word [rcx], ax
mov ecx, dword [rsp + 0x68]
inc r12d
cmp r12d, 0x82
jb 0x180042820
inc ecx
mov dword [rsp + 0x68], ecx
test r13d, r13d
je 0x180042810
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rbp + 0xac8]
xor r10d, r10d
mov ebx, r10d
movsxd r15, eax
mov r12d, 0x104
jmp 0x180042b87
mov rcx, qword [rbp - 0x50]
lea rax, [rbp - 0x58]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x78], 0xffffffff80000001
lea rdx, [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movsxd r15, eax
xor r10d, r10d
mov edx, dword [rbp + 0xab0]
mov ecx, dword [rsp + 0x60]
imul eax, edx, 0xa6
add ecx, eax
mov dword [rsp + 0x60], ecx
cmp ecx, dword [rbp - 0x60]
ja 0x1800427e7
mov r11, qword [rbp + 0xac0]
jmp 0x1800423e0
mov r10d, dword [rdi]
mov edx, r10d
mov r9d, dword [r11]
cmp r10d, r9d
jae 0x180042bfd
mov r11, qword [rbp + 0xad0]
xor r8d, r8d
nop word [rax + rax]
mov eax, edx
movzx ecx, byte [rax + r11]
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x180042bed
lea eax, [rcx - 0x41]
cmp al, 5
jbe 0x180042bed
sub cl, 0x61
cmp cl, 5
ja 0x180042bfd
cmp r8d, 8
ja 0x180042bfd
inc edx
inc r8d
cmp edx, r9d
jb 0x180042bd0
mov eax, edx
sub eax, r10d
dec eax
cmp eax, 7
ja 0x180042c1c
mov rax, qword [rbp + 0xab8]
mov dword [rax], edx
mov eax, 1
jmp 0x1800427e9
xor r10d, r10d
mov eax, r10d
jmp 0x1800427e9