Function at 0x1800088c8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x180057b40]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r15, rcx
xor edi, edi
mov r12, rdi
mov r13, rdi
mov rbp, rdi
mov dword [rsp + 0x30], edi
mov r14, rdi
mov rbx, rdi
mov qword [rsp + 0x50], rbx
mov qword [r11 - 0x48], rdi
lea rax, [r11 - 0x48]
mov qword [r11 - 0x68], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARE
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r11d, eax
cmp eax, edi
jne 0x180008956
mov r11d, edi
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rbx
movzx eax, r11w
mov esi, 0x80070000
or eax, esi
cmp r11d, edi
cmovle eax, r11d
cmp eax, edi
jl 0x180008c6b
mov dword [rsp + 0x38], edi
lea r9, [rsp + 0x38]
xor r8d, r8d
lea edx, [r8 + 4]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
cmp eax, 0x7a
je 0x18000899a
movzx ecx, ax
or ecx, esi
cmp eax, edi
cmovle ecx, eax
jmp 0x1800089de
mov ecx, dword [rsp + 0x38]
call fcn.18001ce30
mov r13, rax
cmp rax, rdi
je 0x180008c43
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov rcx, rax
call fcn.180026db0
lea r9, [rsp + 0x38]
mov r8, r13
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
movzx ecx, ax
or ecx, esi
cmp eax, edi
cmovle ecx, eax
cmp ecx, edi
jl 0x180008c43
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x50]
lea rdx, str.SECURITYSAMDomainsAccount
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov r11d, eax
movzx eax, ax
or eax, esi
cmp r11d, edi
cmovle eax, r11d
cmp eax, edi
jl 0x180008c43
cmp rbx, rdi
je 0x180008a29
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x34], edi
lea r9, [rsp + 0x34]
xor r8d, r8d
lea edx, [r8 + 4]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
cmp eax, 0x7a
je 0x180008a5d
movzx ecx, ax
or ecx, esi
cmp eax, edi
cmovle ecx, eax
jmp 0x180008aa1
mov ecx, dword [rsp + 0x34]
call fcn.18001ce30
mov r12, rax
cmp rax, rdi
je 0x180008c43
mov r8d, dword [rsp + 0x34]
xor edx, edx
mov rcx, rax
call fcn.180026db0
lea r9, [rsp + 0x34]
mov r8, r12
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
movzx ecx, ax
or ecx, esi
cmp eax, edi
cmovle ecx, eax
cmp ecx, edi
jl 0x180008c43
mov r8, r13
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
movzx edx, ax
or edx, esi
cmp eax, edi
cmovle edx, eax
cmp edx, edi
jl 0x180008c43
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x50]
lea rdx, str.SECURITYSAMDomainsAccount
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movzx esi, ax
or esi, 0x80070000
cmp eax, edi
cmovle esi, eax
cmp esi, edi
jl 0x180008bb1
cmp rbx, rdi
je 0x180008b0e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x40], edi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x180041ed0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
cmp eax, edi
cmovle esi, eax
cmp esi, edi
jl 0x180008bb1
mov ecx, dword [rsp + 0x30]
call fcn.18001ce30
mov rbp, rax
cmp rax, rdi
jne 0x180008b6d
mov esi, 0x8007000e
jmp 0x180008bb1
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call fcn.180026db0
lea r11, [rsp + 0x30]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x180041ed0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
cmp eax, edi
cmovle esi, eax
mov r8, r12
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
cmp esi, edi
jl 0x180008c43
test byte [rsp + 0x30], 3
jne 0x180008c2f
mov byte [rsp + 0x50], dil
mov byte [rsp + 0x51], dil
mov byte [rsp + 0x52], dil
mov byte [rsp + 0x53], dil
mov byte [rsp + 0x54], dil
mov byte [rsp + 0x55], 5
mov eax, dword [rsp + 0x30]
lea rdi, [rax + rbp - 0x14]
cmp rdi, rbp
jb 0x180008c29
cmp dword [rdi + 8], 0x15
jne 0x180008c17
lea rcx, [rdi + 2]
mov r8d, 6
lea rdx, [rsp + 0x50]
call fcn.180026140
test eax, eax
je 0x180008c22
sub rdi, 4
cmp rdi, rbp
jb 0x180008c2d
jmp 0x180008bf9
mov r14, rdi
xor edi, edi
jmp 0x180008c34
xor edi, edi
jmp 0x180008c2f
xor edi, edi
mov esi, 0x80004005
cmp esi, edi
jl 0x180008c43
mov rdx, r15
mov rcx, r14
call sub.ADVAPI32.dll_ConvertSidToStringSidW
cmp r13, rdi
je 0x180008c50
mov rcx, r13
call fcn.180026a20
cmp r12, rdi
je 0x180008c5d
mov rcx, r12
call fcn.180026a20
cmp rbp, rdi
je 0x180008c6b
mov rcx, rbp
call fcn.180026a20
nop
cmp rbx, rdi
je 0x180008c79
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180026cf0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret