Function at 0x18005f104
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor r15d, r15d
mov r12d, edx
mov rdi, rcx
test rcx, rcx
jne 0x18005f13d
xor eax, eax
jmp 0x18005f57b
mov rdx, qword [rcx + 8]
lea r9, [rbp - 0x10]
mov ecx, r12d
mov qword [rbp - 0x10], r15
mov r8d, 0x20019
mov dword [rbp - 0x20], r15d
call fcn.18005cd24
mov ebx, eax
test eax, eax
jne 0x18005f1a9
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x58], r15
xor r9d, r9d
mov qword [rsp + 0x50], r15
xor r8d, r8d
mov qword [rsp + 0x48], r15
xor edx, edx
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov ebx, eax
jmp 0x18005f1bf
mov r9, qword [rdi + 8]
mov r8d, 0x1c6a
mov edx, eax
mov ecx, 1
call fcn.180038d90
test ebx, ebx
jne 0x18005f564
mov edx, dword [rbp - 0x20]
xor ecx, ecx
add edx, 2
add rdx, rdx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x18005f4fa
mov qword [rbp - 0x18], r15
mov r13d, r15d
mov ecx, dword [rbp - 0x20]
xor edx, edx
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
add r8, r8
mov rcx, rsi
mov dword [rbp + 0x40], eax
call sub.msvcrt.dll_memset
mov rcx, qword [rbp - 0x10]
lea r9, [rbp + 0x40]
mov qword [rsp + 0x38], r15
mov r8, rsi
mov qword [rsp + 0x30], r15
mov edx, r13d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov r14d, eax
cmp eax, 0xea
jne 0x18005f2c7
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov edx, 0x202
mov dword [rbp - 0x20], 0xff
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x18005f4fa
mov ecx, dword [rbp - 0x20]
xor edx, edx
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
add r8, r8
mov rcx, rsi
mov dword [rbp + 0x40], eax
call sub.msvcrt.dll_memset
mov rcx, qword [rbp - 0x10]
lea r9, [rbp + 0x40]
mov qword [rsp + 0x38], r15
mov r8, rsi
mov qword [rsp + 0x30], r15
mov edx, r13d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov r14d, eax
test r14d, r14d
jne 0x18005f506
mov edx, dword [rdi + 0x38]
mov r8, rsi
mov rcx, qword [rdi + 0x30]
inc r13d
call fcn.18005b940
test eax, eax
jne 0x18005f1f1
mov rax, qword [rdi + 8]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r15w
jne 0x18005f2f2
mov eax, dword [rbp + 0x40]
inc eax
add eax, ecx
xor ecx, ecx
mov dword [rbp + 0x40], eax
lea edx, [rax + 1]
add rdx, rdx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x18005f501
mov edx, dword [rbp + 0x40]
lea r8, str._s_s
mov r9, qword [rdi + 8]
inc edx
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.msvcrt.dll_swprintf_s]
nop dword [rax + rax]
xor edx, edx
mov r9, r15
mov r8d, 0x1be7
lea ecx, [rdx + 3]
call fcn.180038d90
cmp byte [rdi + 0x14], 2
lea rax, [rbp - 0x18]
mov rdx, qword [rdi + 0x28]
mov rcx, r15
mov qword [rsp + 0x48], rax
setne r9b
mov rax, qword [rbp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x38], rax
mov eax, dword [rdi + 0x18]
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], eax
mov byte [rsp + 0x20], 1
call fcn.180060ebc
mov ebx, eax
cmp eax, 0x20
je 0x18005f3ba
cmp eax, 5
je 0x18005f3ba
cmp eax, 0x780
je 0x18005f3ba
cmp eax, 0x538
jne 0x18005f3cf
mov r9, r15
mov r8d, 0x1c60
mov edx, ebx
mov ecx, 1
call fcn.180038d90
test ebx, ebx
jne 0x18005f467
mov eax, dword [rdi + 0x18]
and eax, 0x1c
cmp byte [rdi + 0x14], 2
jne 0x18005f40a
mov rcx, qword [rbp + 0x58]
mov r9d, r12d
mov r8, qword [rbp - 0x18]
mov edx, eax
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x50]
mov qword [rsp + 0x20], rcx
mov rcx, r15
call fcn.18005f9ec
mov ebx, eax
jmp 0x18005f467
mov r9, qword [rbp - 0x18]
mov r8d, eax
mov edx, r12d
mov dword [rsp + 0x20], 1
mov rcx, r15
call qword [sym.imp.NTMARTA.dll_AccRewriteSetNamedRights]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x18005f467
mov eax, dword [0x18008b2a0]
mov rdx, qword gs:[0x58]
mov ecx, 0x18
mov rax, qword [rdx + rax*8]
mov dword [rcx + rax], ebx
cmp ebx, 5
jne 0x18005f465
mov r9, qword [rdi + 8]
lea ecx, [rbx - 4]
mov edx, ebx
mov r8d, 0x1c77
call fcn.180038d90
xor ebx, ebx
cmp qword [rbp - 0x18], 0
je 0x18005f483
lea rcx, [rbp - 0x18]
call qword [sym.imp.ntdll.dll_RtlDeleteSecurityObject]
nop dword [rax + rax]
and qword [rbp - 0x18], 0
cmp ebx, 0x538
je 0x18005f4a8
cmp ebx, 0x20
ja 0x18005f4a0
movabs rcx, 0x10000006c
bt rcx, rbx
jb 0x18005f4a8
cmp ebx, 0x780
jne 0x18005f4c5
mov eax, dword [0x18008b2a0]
mov rdx, qword gs:[0x58]
mov ecx, 0x18
mov rax, qword [rdx + rax*8]
mov dword [rcx + rax], ebx
xor ebx, ebx
test ebx, ebx
je 0x18005f4de
mov r9, r15
mov r8d, 0x1c77
mov edx, ebx
mov ecx, 1
call fcn.180038d90
mov rcx, r15
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
xor r15d, r15d
test ebx, ebx
je 0x18005f1f1
jmp 0x18005f506
mov ebx, 8
jmp 0x18005f564
mov ebx, 8
test rsi, rsi
je 0x18005f51a
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
test r14d, r14d
je 0x18005f545
cmp r14d, 0x103
je 0x18005f545
mov r9, qword [rdi + 8]
mov r8d, 0x1c39
mov edx, r14d
mov ecx, 1
call fcn.180038d90
test ebx, ebx
cmove ebx, r14d
mov rax, qword [rbp - 0x18]
test rax, rax
je 0x18005f564
cmp rax, qword [rdi + 0x28]
je 0x18005f564
lea rcx, [rbp - 0x18]
call qword [sym.imp.ntdll.dll_RtlDeleteSecurityObject]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x18005f579
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret