Function at 0x18000508c
Capabilities:
Get windows directory from kuser_shared_data
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x230
mov rbp, qword [0x18000d4a0]
mov r15, qword [0x18000d490]
mov r14d, dword [0x18000d498]
mov rcx, qword [rbp + 8]
mov ebx, 0x138
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r12d, r12d
mov rdi, rax
cmp rax, r12
je 0x180005419
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
lea rcx, [rdi + 0x68]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [rdi + 0x98]
mov qword [r11], r11
mov qword [rdi + 0xa0], r11
call fcn.180008b44
mov ebx, eax
cmp eax, r12d
jne 0x18000540f
mov rcx, rdi
call fcn.180007678
mov rcx, qword [rbp + 0x18]
mov edx, 0xdc444c2b
call fcn.18000459c
cmp rax, r12
je 0x180005144
lea edx, [r12 + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call rax
jmp 0x180005147
mov rax, r12
mov qword [rdi + 0x28], rax
cmp rax, r12
jne 0x18000515b
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180005408
mov rax, qword [0x18000d4a0]
xor edx, edx
mov r8d, 0x1102
mov r13, qword [rax + 8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
lea rax, [0x180000000]
cmp rsi, r12
je 0x180005226
lea rdx, [r15 + rax + 0x110b0]
lea r8, [rsp + 0x278]
mov rcx, 0xffffffff80000002
mov word [rsi], r12w
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
cmp eax, r12d
jne 0x180005216
xor edx, edx
jmp 0x1800051cf
lea rdx, [rsp + 0x20]
mov rcx, rsi
inc r12d
call fcn.180009110
mov ebx, eax
test eax, eax
jne 0x1800051ee
mov edx, r12d
mov rcx, qword [rsp + 0x278]
lea r8, [rsp + 0x20]
mov r9d, 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
test eax, eax
je 0x1800051b6
xor r12d, r12d
cmp ebx, 0x103
jne 0x180005203
mov qword [0x18000d480], rsi
mov ebx, r12d
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, r12d
je 0x180005234
mov r8, rsi
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18000522b
mov ebx, 8
cmp ebx, r12d
jne 0x18000540f
mov rsi, qword [0x18000d490]
lea rcx, [rsp + 0x280]
mov edx, 0x7ffe0030
mov r8d, 8
call sub.ntdll.dll_memcpy
lea r13, [0x180000000]
lea rdx, [rsp + 0x280]
lea r8, [rsi + r13 + 0x11198]
mov rcx, rdi
mov word [rsp + 0x286], r12w
call fcn.180005ca4
mov ebx, eax
cmp eax, r12d
je 0x18000529c
lea r8, [rsi + r13 + 0x111f0]
lea rdx, [rsp + 0x280]
mov rcx, rdi
call fcn.180005ca4
mov ebx, eax
cmp ebx, r12d
jne 0x18000540f
lea rdx, [rdi + 8]
mov rcx, rdi
call fcn.180006dcc
mov ebx, eax
cmp eax, r12d
jne 0x1800052e2
mov rcx, rdi
mov ebx, 8
call fcn.180003c24
mov qword [rdi + 0x30], rax
cmp rax, r12
je 0x1800052e2
lea rcx, [rdi + 8]
call fcn.180003c24
cmp rax, r12
mov qword [rdi + 0x38], rax
cmovne ebx, r12d
cmp ebx, r12d
jne 0x18000540f
mov rcx, rdi
call fcn.180008708
cmp eax, r12d
jne 0x180005302
mov ebx, 0xb7
jmp 0x18000540f
lea r8, [r15 + r13 + 0xf000]
mov edx, r14d
movzx r9d, word [r8 + 2]
movzx r11d, word [r8]
xor edx, 0xe49a1e6d
lea r10, [r9 + 8]
cmp r11, r10
jbe 0x180005339
lea rax, [r9 + r8 + 8]
cmp edx, r12d
je 0x18000533c
mov rcx, rax
call fcn.180004ed8
jmp 0x18000533c
mov rax, r12
cmp rax, r12
jne 0x18000534b
mov ebx, 2
jmp 0x18000540f
xor r14d, 0xecb028fc
cmp r11, r10
jbe 0x18000536e
lea rax, [r9 + r8 + 8]
cmp r14d, r12d
je 0x180005371
mov edx, r14d
mov rcx, rax
call fcn.180004ed8
jmp 0x180005371
mov rax, r12
cmp rax, r12
je 0x180005341
xor ecx, ecx
mov qword [rdi + 0x40], r8
mov qword [0x18000d488], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, qword [rsp + 0x270]
je 0x1800053fb
mov rcx, qword [rbp + 0x18]
mov edx, 0xaade337c
call fcn.18000459c
mov rsi, rax
cmp rax, r12
je 0x1800053be
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
lea ecx, [rdx + 0x10]
mov r8d, eax
call rsi
mov rsi, rax
jmp 0x1800053c1
mov rsi, r12
cmp rsi, r12
je 0x180005150
mov rcx, qword [rbp + 0x18]
mov edx, 0x1c8cff93
call fcn.18000459c
cmp rax, r12
je 0x1800053ee
lea rcx, [0x180001110]
mov r8, rdi
mov rdx, rsi
call rax
jmp 0x1800053f1
mov eax, r12d
cmp eax, r12d
jne 0x18000541e
jmp 0x180005150
lock add dword [rbp + 0x38], 1
mov rcx, rdi
call fcn.180002b60
mov ebx, eax
cmp eax, r12d
je 0x18000541e
mov rcx, rdi
call fcn.180005578
jmp 0x18000541e
mov ebx, 8
mov eax, ebx
mov rbx, qword [rsp + 0x288]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret