Function at 0x180003e24
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x180295a70]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r15, rcx
xor edi, edi
mov r12, rdi
mov r13, rdi
mov rbp, rdi
mov dword [rsp + 0x30], edi
mov r14, rdi
mov rbx, rdi
mov qword [rsp + 0x50], rbx
mov qword [r11 - 0x48], rdi
lea rax, [r11 - 0x48]
mov qword [r11 - 0x68], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARE
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r11d, eax
cmp eax, edi
jne 0x180003eb2
mov r11d, edi
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rbx
movzx eax, r11w
mov esi, 0x80070000
or eax, esi
cmp r11d, edi
cmovle eax, r11d
cmp eax, edi
jl 0x1800041c7
mov dword [rsp + 0x38], edi
lea r9, [rsp + 0x38]
xor r8d, r8d
lea edx, [r8 + 4]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
cmp eax, 0x7a
je 0x180003ef6
movzx ecx, ax
or ecx, esi
cmp eax, edi
cmovle ecx, eax
jmp 0x180003f3a
mov ecx, dword [rsp + 0x38]
call fcn.18004a530
mov r13, rax
cmp rax, rdi
je 0x18000419f
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov rcx, rax
call fcn.1801603e0
lea r9, [rsp + 0x38]
mov r8, r13
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
movzx ecx, ax
or ecx, esi
cmp eax, edi
cmovle ecx, eax
cmp ecx, edi
jl 0x18000419f
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x50]
lea rdx, str.SECURITYSAMDomainsAccount
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov r11d, eax
movzx eax, ax
or eax, esi
cmp r11d, edi
cmovle eax, r11d
cmp eax, edi
jl 0x18000419f
cmp rbx, rdi
je 0x180003f85
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x34], edi
lea r9, [rsp + 0x34]
xor r8d, r8d
lea edx, [r8 + 4]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
cmp eax, 0x7a
je 0x180003fb9
movzx ecx, ax
or ecx, esi
cmp eax, edi
cmovle ecx, eax
jmp 0x180003ffd
mov ecx, dword [rsp + 0x34]
call fcn.18004a530
mov r12, rax
cmp rax, rdi
je 0x18000419f
mov r8d, dword [rsp + 0x34]
xor edx, edx
mov rcx, rax
call fcn.1801603e0
lea r9, [rsp + 0x34]
mov r8, r12
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
movzx ecx, ax
or ecx, esi
cmp eax, edi
cmovle ecx, eax
cmp ecx, edi
jl 0x18000419f
mov r8, r13
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
movzx edx, ax
or edx, esi
cmp eax, edi
cmovle edx, eax
cmp edx, edi
jl 0x18000419f
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x50]
lea rdx, str.SECURITYSAMDomainsAccount
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movzx esi, ax
or esi, 0x80070000
cmp eax, edi
cmovle esi, eax
cmp esi, edi
jl 0x18000410d
cmp rbx, rdi
je 0x18000406a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x40], edi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x18018ae28]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
cmp eax, edi
cmovle esi, eax
cmp esi, edi
jl 0x18000410d
mov ecx, dword [rsp + 0x30]
call fcn.18004a530
mov rbp, rax
cmp rax, rdi
jne 0x1800040c9
mov esi, 0x8007000e
jmp 0x18000410d
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call fcn.1801603e0
lea r11, [rsp + 0x30]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x18018ae28]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
cmp eax, edi
cmovle esi, eax
mov r8, r12
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
cmp esi, edi
jl 0x18000419f
test byte [rsp + 0x30], 3
jne 0x18000418b
mov byte [rsp + 0x50], dil
mov byte [rsp + 0x51], dil
mov byte [rsp + 0x52], dil
mov byte [rsp + 0x53], dil
mov byte [rsp + 0x54], dil
mov byte [rsp + 0x55], 5
mov eax, dword [rsp + 0x30]
lea rdi, [rax + rbp - 0x14]
cmp rdi, rbp
jb 0x180004185
cmp dword [rdi + 8], 0x15
jne 0x180004173
lea rcx, [rdi + 2]
mov r8d, 6
lea rdx, [rsp + 0x50]
call fcn.18015eb10
test eax, eax
je 0x18000417e
sub rdi, 4
cmp rdi, rbp
jb 0x180004189
jmp 0x180004155
mov r14, rdi
xor edi, edi
jmp 0x180004190
xor edi, edi
jmp 0x18000418b
xor edi, edi
mov esi, 0x80004005
cmp esi, edi
jl 0x18000419f
mov rdx, r15
mov rcx, r14
call sub.ADVAPI32.dll_ConvertSidToStringSidW
cmp r13, rdi
je 0x1800041ac
mov rcx, r13
call fcn.18015fde0
cmp r12, rdi
je 0x1800041b9
mov rcx, r12
call fcn.18015fde0
cmp rbp, rdi
je 0x1800041c7
mov rcx, rbp
call fcn.18015fde0
nop
cmp rbx, rdi
je 0x1800041d5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1801604e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret