Function at 0x18009ec80
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
push r12
push r13
lea rbp, [rsp - 0x3e8]
sub rsp, 0x4e8
xor r13d, r13d
lea rdx, str.Path
mov dword [rbp + 0x418], r13d
mov r12, rcx
movdqa xmm0, xmmword [0x180104d50]
lea rcx, [rsp + 0x30]
mov edi, r13d
lea r8d, [r13 + 4]
mov byte [rsp + 0x30], dil
movdqu xmmword [rsp + 0x40], xmm0
call fcn.1800b8fb0
movdqa xmm0, xmmword [0x180104d50]
lea r8d, [r13 + 0x3f]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_firefox.exe
mov byte [rsp + 0x70], dil
lea rcx, [rsp + 0x70]
movdqu xmmword [rbp - 0x80], xmm0
call fcn.1800b8fb0
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x400
call fcn.1800c3fd0
cmp qword [rbp - 0x78], 0x10
lea rdx, [rsp + 0x70]
lea r8, [rbp + 0x420]
mov dword [rbp + 0x418], 0x400
cmovae rdx, qword [rsp + 0x70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x18009ed71
cmp qword [rsp + 0x48], 0x10
lea rax, [rbp + 0x418]
mov rcx, qword [rbp + 0x420]
lea rdx, [rsp + 0x30]
cmovae rdx, qword [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp + 0x420]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x60], r13
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], dil
nop dword [rax]
inc r8
cmp byte [rax + r8], dil
jne 0x18009eda0
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.1800b8fb0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x18009edf3
mov rcx, qword [rsp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009edee
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009f3df
call fcn.1800c1180
mov rdx, qword [rsp + 0x48]
movdqa xmm0, xmmword [0x180104d50]
mov byte [rsp + 0x70], dil
movdqu xmmword [rbp - 0x80], xmm0
cmp rdx, 0x10
jb 0x18009ee42
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009ee3d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009f3df
call fcn.1800c1180
mov qword [rsp + 0x510], rbx
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x4e0], rsi
test rbx, rbx
je 0x18009eee1
lea rcx, [rbx - 1]
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], dil
cmp rbx, rcx
jb 0x18009f3e5
sub rbx, rcx
lea rdx, [rsp + 0x50]
mov edi, 1
cmp rbx, rdi
mov r8d, edi
cmovb r8, rbx
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
add rdx, rcx
lea rcx, [rsp + 0x70]
call fcn.1800b8fb0
mov rdx, qword [rbp - 0x78]
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
cmp rdx, 0x10
cmovae rax, rcx
cmp qword [rbp - 0x80], rdi
jne 0x18009eeda
cmp byte [rax], 0x5c
jne 0x18009eeda
mov rbx, qword [rsp + 0x60]
movzx esi, dil
jmp 0x18009eeed
mov rbx, qword [rsp + 0x60]
jmp 0x18009eeea
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rsp + 0x70]
xor sil, sil
mov qword [rsp + 0x4d8], r14
mov qword [rsp + 0x4d0], r15
movaps xmmword [rsp + 0x4c0], xmm6
movaps xmmword [rsp + 0x4b0], xmm7
test dil, 1
je 0x18009ef46
cmp rdx, 0x10
jb 0x18009ef46
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009ef41
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009f3d9
call fcn.1800c1180
test sil, sil
je 0x18009efde
lea r8, [rbx - 1]
mov qword [rsp + 0x40], r13
cmp rbx, r8
mov qword [rsp + 0x48], 0xf
lea rdx, [rsp + 0x50]
mov byte [rsp + 0x30], r13b
cmovb r8, rbx
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
call fcn.1800b8fb0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x18009efc5
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009efc0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009f3d9
call fcn.1800c1180
movups xmm1, xmmword [rsp + 0x40]
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsp + 0x60], xmm1
mov rbx, qword [rsp + 0x60]
movups xmmword [rsp + 0x50], xmm0
mov r14, qword [rsp + 0x68]
lea r15, [rsp + 0x50]
mov rdi, qword [rsp + 0x50]
cmp r14, 0x10
movabs rax, 0x7fffffffffffffff
cmovae r15, rdi
cmp rbx, 0x10
jae 0x18009f019
movups xmm0, xmmword [r15]
mov qword [rsp + 0x48], 0xf
movups xmmword [rsp + 0x30], xmm0
jmp 0x18009f08b
mov rsi, rbx
or rsi, 0xf
cmp rsi, rax
cmova rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x18009f063
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18009f3eb
mov rcx, rax
call fcn.1800c1188
mov rcx, rax
test rax, rax
je 0x18009f3f1
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18009f072
test rcx, rcx
je 0x18009f06f
call fcn.1800c1188
jmp 0x18009f072
mov rax, r13
lea r8, [rbx + 1]
mov qword [rsp + 0x30], rax
mov rdx, r15
mov rcx, rax
call fcn.1800c41f0
mov qword [rsp + 0x48], rsi
lea r13, [0x180117178]
mov qword [rsp + 0x40], rbx
mov rdx, r13
lea rcx, [rsp + 0x70]
call fcn.1800b8a30
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.18008c300
test eax, eax
jg 0x18009f311
cmp r14, 0x10
lea r15, [rsp + 0x50]
cmovae r15, rdi
cmp rbx, 0x10
jae 0x18009f0e0
movups xmm0, xmmword [r15]
mov qword [rsp + 0x48], 0xf
movups xmmword [rsp + 0x30], xmm0
jmp 0x18009f15b
movabs rax, 0x7fffffffffffffff
mov rsi, rbx
or rsi, 0xf
cmp rsi, rax
cmova rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x18009f134
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18009f3f7
mov rcx, rax
call fcn.1800c1188
mov rcx, rax
test rax, rax
je 0x18009f3fd
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18009f142
test rcx, rcx
je 0x18009f140
call fcn.1800c1188
jmp 0x18009f142
xor eax, eax
lea r8, [rbx + 1]
mov qword [rsp + 0x30], rax
mov rdx, r15
mov rcx, rax
call fcn.1800c41f0
mov qword [rsp + 0x48], rsi
mov rdx, r12
mov qword [rsp + 0x40], rbx
lea rcx, [rbp - 0x70]
call fcn.1800b8a30
mov r8, rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.18009d4e0
cmp qword [0x180116c10], 0x10
lea r8, [0x180116bf8]
mov r9, qword [0x180116c08]
mov rcx, rax
cmovae r8, qword [0x180116bf8]
call fcn.1800ba920
xor esi, esi
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
mov rdx, qword [0x180116c10]
cmp rdx, 0x10
jb 0x18009f1fd
mov rcx, qword [0x180116bf8]
inc rdx
cmp rdx, 0x1000
jb 0x18009f1f8
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18009f3fd
mov rcx, r8
call fcn.1800c1180
mov rdx, qword [rbp - 0x78]
movups xmmword [0x180116bf8], xmm6
movups xmmword [0x180116c08], xmm7
cmp rdx, 0x10
jb 0x18009f247
mov rcx, qword [rsp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009f242
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009f3fd
call fcn.1800c1180
mov rdx, qword [0x180117188]
lea rcx, [rsp + 0x30]
add rdx, rbx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], sil
call fcn.1800ba640
cmp qword [0x180117190], 0x10
lea rcx, [rsp + 0x30]
mov r8, qword [0x180117188]
cmovae r13, qword [0x180117178]
mov rdx, r13
call fcn.1800b8790
cmp r14, 0x10
lea rdx, [rsp + 0x50]
mov r8, rbx
lea rcx, [rsp + 0x30]
cmovae rdx, rdi
call fcn.1800b8790
mov rdx, qword [0x180117190]
cmp rdx, 0x10
jb 0x18009f2ed
mov rcx, qword [0x180117178]
inc rdx
cmp rdx, 0x1000
jb 0x18009f2e8
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18009f3d3
mov rcx, r8
call fcn.1800c1180
movups xmm0, xmmword [rsp + 0x30]
mov r14, qword [rsp + 0x68]
movups xmm1, xmmword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
movups xmmword [0x180117178], xmm0
movups xmmword [0x180117188], xmm1
jmp 0x18009f313
xor esi, esi
cmp r14, 0x10
jb 0x18009f34a
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x18009f342
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009f3d9
mov rcx, rdi
call fcn.1800c1180
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x18009f382
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x18009f37d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18009f3d9
mov rcx, r8
call fcn.1800c1180
movaps xmm6, xmmword [rsp + 0x4c0]
mov r15, qword [rsp + 0x4d0]
mov r14, qword [rsp + 0x4d8]
movaps xmm7, xmmword [rsp + 0x4b0]
mov rbx, qword [rsp + 0x510]
mov qword [r12 + 0x10], rsi
mov rsi, qword [rsp + 0x4e0]
mov qword [r12 + 0x18], 0xf
mov byte [r12], 0
add rsp, 0x4e8
pop r13
pop r12
pop rdi
pop rbp
ret
call fcn.1800cc350
int3
call fcn.1800cc350
int3
call fcn.1800cc350
int3
call fcn.1800b91a0
int3
call fcn.180089550
int3
call fcn.1800cc350
int3
call fcn.180089550
int3
call fcn.1800cc350
int3