Function at 0x180001a40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x18008ab58]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
lea rcx, [0x18008b6d0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
xor edi, edi
mov dword [0x18008b4c0], 1
lea rcx, [0x18008b6a8]
mov dword [0x18008b4c4], edi
mov dword [0x18008b4bc], edi
mov qword [0x18008b4a8], rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
lea rcx, [0x18008b680]
mov qword [0x18008b4b0], rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
lea rcx, [0x18008b658]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
lea rcx, [0x18008b6f8]
mov qword [0x18008b4a0], rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
lea rcx, [0x18008b600]
mov dword [0x18008b4b8], edi
mov dword [0x18008b4c8], edi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
lea rcx, [0x18008b650]
mov dword [0x18008ba10], edi
mov qword [0x18008ba08], rdi
mov qword [0x18008b388], rdi
mov qword [0x18008b390], rdi
call qword [sym.imp.ntdll.dll_RtlGetNtProductType]
nop dword [rax + rax]
test al, al
je 0x180001b61
cmp dword [0x18008b650], 2
je 0x180001b57
mov dword [0x18008ab78], edi
mov dword [0x18008b3a0], 1
lea rax, [rsp + 0x48]
mov dword [rsp + 0x40], edi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x48], rdi
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionSeCEdit
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x180001bd6
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.PolicyDebugLevel
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x18000bc6e
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180001bec
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
je 0x180001bf6
mov dword [0x18008ab78], edi
lea rax, [rsp + 0x48]
mov dword [rsp + 0x44], edi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x48], rdi
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionSeCEdit
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x180001c6b
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.PolicyLogSize
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x18000bccf
mov eax, dword [0x18008b3a4]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180001c8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, dword [0x18008b3a4]
test ebx, ebx
je 0x18000bd32
mov dword [0x18008b3a4], 0x100000
cmp dword [0x18008ab78], edi
jne 0x18000bd4f
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, str.Initialize_NotificationQSync
mov dword [rsp + 0x20], edi
xor ecx, ecx
lea edx, [r9 + 1]
call fcn.180001f80
lea rcx, [0x18008b628]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
call fcn.180001d30
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, str.Unflush_Notification_Queue
mov dword [rsp + 0x20], edi
xor edx, edx
mov ecx, eax
call fcn.180001f80
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.180002a90
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
mov eax, dword [rsp + 0x44]
add eax, 0xfffffffc
cmp eax, 1
ja 0x18000bcc5
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [0x18008ab78]
xor r8d, r8d
lea rdx, str.PolicyDebugLevel
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x180001bd6
mov dword [0x18008ab78], edi
jmp 0x180001bd6
mov ebx, 0x70c
jmp 0x180001bd6
mov eax, dword [rsp + 0x40]
add eax, 0xfffffffc
cmp eax, 1
ja 0x18000bd28
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [0x18008b3a4]
xor r8d, r8d
lea rdx, str.PolicyLogSize
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x180001c6b
mov eax, edi
mov dword [0x18008b3a4], eax
jmp 0x180001c71
mov ebx, 0x70c
jmp 0x180001c6b
test eax, eax
je 0x18000bd3f
shl eax, 0xa
mov dword [0x18008b3a4], eax
cmp eax, 0x100000
jae 0x180001c9f
jmp 0x180001c95
mov edx, 0x104
mov word [rsp + 0x50], di
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemWindowsDirectoryW]
nop dword [rax + rax]
lea r8, str._securitylogs_scepol.log
mov word [rbp + 0x158], di
mov edx, 0x137
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x50]
mov edx, 0x40000000
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 1]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov qword [0x18008ab70], rax
cmp rax, 0xffffffffffffffff
je 0x18000bdf5
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
cmp qword [0x18008ab70], 0xffffffffffffffff
jne 0x180001cab
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
nop
jmp 0x180001cab