Function at 0x18000ffa8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x180019018]
xor rax, rsp
mov qword [rbp + 0x370], rax
and dword [rsp + 0x38], 0
lea rcx, [rbp + 0x160]
and qword [rsp + 0x40], 0
mov rbx, r8
mov r8d, 0x208
mov dword [rsp + 0x34], 1
xor edx, edx
call sub.msvcrt.dll_memset
mov r9d, 0x103
lea r8, str.SOFTWAREMicrosoftClientForNFSCurrentVersionUsersDefault
lea rcx, [rbp + 0x160]
lea edi, [r9 + 1]
mov edx, edi
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
lea r8, str.Mount
mov edx, edi
lea rcx, [rbp + 0x160]
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x160]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1800100f9
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.Locking
lea rax, [rsp + 0x34]
mov dword [rsp + 0x30], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.EUCMount
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
cmp dword [rsp + 0x34], 0
lea r8, [rsp + 0x50]
mov rcx, qword [rbx]
mov r9d, edi
mov eax, dword [rcx + 0x38]
je 0x180010118
or eax, 1
mov edx, 0x42a
jmp 0x180010120
and eax, 0xfffffffe
mov edx, 0x42b
mov dword [rcx + 0x38], eax
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.USER32.dll_LoadStringW]
nop dword [rax + rax]
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x1800101e4
mov ecx, 0x2000
cmp eax, ecx
jne 0x18001015c
mov edx, 0x9e
mov rax, qword [rbx]
or dword [rax + 0x38], ecx
mov rcx, qword [rbx + 0x30]
jmp 0x180010256
cmp eax, 0x40
jne 0x18001016f
mov rax, qword [rbx]
mov edx, 0x9d
or dword [rax + 0x38], 0x40
jmp 0x180010153
mov ecx, 0x4000
cmp eax, ecx
jne 0x18001017f
mov edx, 0x9f
jmp 0x18001014d
mov ecx, 0x8000
cmp eax, ecx
jne 0x180010195
mov rax, qword [rbx]
or dword [rax + 0x38], ecx
mov edx, 0xa1
jmp 0x180010153
mov ecx, 0x10000
cmp eax, ecx
jne 0x1800101ab
mov rax, qword [rbx]
or dword [rax + 0x38], ecx
mov edx, 0xa2
jmp 0x180010153
mov ecx, 0x20000
cmp eax, ecx
jne 0x1800101bb
mov edx, 0xa3
jmp 0x18001014d
mov ecx, 0x40000
cmp eax, ecx
jne 0x1800101cb
mov edx, 0xa4
jmp 0x18001014d
mov ecx, 0x80000
cmp eax, ecx
jne 0x18001026a
mov rax, qword [rbx]
or dword [rax + 0x38], ecx
mov rcx, qword [rbx + 0x30]
jmp 0x180010251
mov rax, qword [rbx]
and dword [rax + 0x38], 0xffffffbf
mov rax, qword [rbx]
btr dword [rax + 0x38], 0xd
mov rax, qword [rbx]
btr dword [rax + 0x38], 0xe
mov rax, qword [rbx]
btr dword [rax + 0x38], 0xf
mov rax, qword [rbx]
btr dword [rax + 0x38], 0x10
mov rax, qword [rbx]
btr dword [rax + 0x38], 0x11
mov rax, qword [rbx]
btr dword [rax + 0x38], 0x12
mov rax, qword [rbx]
btr dword [rax + 0x38], 0x13
mov eax, dword [0x180019680]
test al, 0x10
jne 0x1800101a4
test al, 8
jne 0x18001018e
mov rcx, qword [rbx + 0x30]
test al, 0x20
je 0x180010248
mov edx, 0xa3
jmp 0x180010256
mov edx, 0xa4
test al, 0x40
jne 0x180010256
mov edx, 0xa0
mov r9d, edi
lea r8, [rsp + 0x50]
call qword [sym.imp.USER32.dll_LoadStringW]
nop dword [rax + rax]
mov rax, qword [rbx]
or dword [rax + 0x38], 4
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.180001570
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret