Function at 0x18001eeb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbx, rcx
mov qword [rax - 0x48], rcx
xor ebp, ebp
mov dword [rax - 0x80], ebp
call fcn.1800014c0
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x44], ebp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov edi, 0x20019
mov dword [rsp + 0x40], ebp
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x18001ef3b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x40]
call rsi
test eax, eax
je 0x18001ef48
mov eax, 0x20119
cmp dword [rsp + 0x40], 1
cmove edi, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x18001ef5d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18001ef94
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x48], rbp
jmp 0x18001efe3
mov dword [rsp + 0x5c], 4
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x44], ebp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5c]
xor r8d, r8d
lea rdx, str.InstallDate
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x50]
test eax, eax
cmovne ecx, eax
mov dword [rsp + 0x50], ecx
mov eax, dword [rsp + 0x44]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x60], ebp
xor eax, eax
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x7c], eax
mov dword [rsp + 0x80], eax
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x60]
call sub.MSVCR80.dll__localtime64_s
mov r9d, dword [rsp + 0x70]
add r9d, 1
mov r8d, dword [rsp + 0x74]
add r8d, 0x76c
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x20], eax
lea rdx, str._04d_02d_02d_02d_02d_02d
mov rcx, rbx
call fcn.180010a80
mov rcx, rbx
call fcn.1800014b0
cmp rax, 0xe
jae 0x18001f09d
nop
lea rdx, [0x180059770]
mov rcx, rbx
call fcn.1800046e0
mov rcx, rbx
call fcn.1800014b0
cmp rax, 0xe
jb 0x18001f080
mov rcx, rbx
call fcn.1800014b0
cmp rax, 0xe
jbe 0x18001f0df
mov r9d, 0xe
xor r8d, r8d
lea rdx, [rsp + 0xa0]
mov rcx, rbx
call fcn.180001640
nop
mov rdx, rax
mov rcx, rbx
call fcn.180001590
nop
lea rcx, [rsp + 0xa0]
call fcn.180001570
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x18001f0f4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
jmp 0x18001f0f7
mov rax, rbx
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret