Function at 0x18009ffa0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
push r15
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x18012a010]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
xor r15d, r15d
mov qword [rsp + 0x70], rcx
mov dword [rbp - 0x40], r15d
lea rdx, str.Path
movdqa xmm0, xmmword [0x180119920]
lea rcx, [rsp + 0x50]
mov edi, r15d
lea r8d, [r15 + 4]
mov byte [rsp + 0x50], dil
movdqu xmmword [rsp + 0x60], xmm0
call fcn.1800c2b50
movdqa xmm0, xmmword [0x180119920]
lea r8d, [r15 + 0x3f]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_firefox.exe
mov byte [rsp + 0x30], dil
lea rcx, [rsp + 0x30]
movdqu xmmword [rsp + 0x40], xmm0
call fcn.1800c2b50
xor edx, edx
lea rcx, [rbp - 0x30]
mov r8d, 0x400
call fcn.1800d2e20
cmp qword [rsp + 0x48], 0x10
lea rdx, [rsp + 0x30]
lea r8, [rbp - 0x68]
mov dword [rbp - 0x40], 0x400
cmovae rdx, qword [rsp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1800a0095
cmp qword [rsp + 0x68], 0x10
lea rax, [rbp - 0x40]
mov rcx, qword [rbp - 0x68]
lea rdx, [rsp + 0x50]
cmovae rdx, qword [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], r15
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], dil
nop word [rax + rax]
inc r8
cmp byte [rax + r8], dil
jne 0x1800a00c0
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x60]
call fcn.1800c2b50
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1800a0113
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a010e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800a087b
call fcn.1800cf9b0
mov rdx, qword [rsp + 0x68]
movdqa xmm0, xmmword [0x180119920]
mov byte [rsp + 0x30], dil
movdqu xmmword [rsp + 0x40], xmm0
cmp rdx, 0x10
jb 0x1800a0163
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a015e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800a087b
call fcn.1800cf9b0
mov qword [rsp + 0x538], rbx
mov rbx, qword [rbp - 0x50]
mov qword [rsp + 0x540], rsi
test rbx, rbx
je 0x1800a0200
lea rcx, [rbx - 1]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], dil
cmp rbx, rcx
jb 0x1800a0881
sub rbx, rcx
lea rdx, [rbp - 0x60]
mov edi, 1
cmp rbx, rdi
mov r8d, edi
cmovb r8, rbx
cmp qword [rbp - 0x48], 0x10
cmovae rdx, qword [rbp - 0x60]
add rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.1800c2b50
mov rdx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
cmp rdx, 0x10
cmovae rax, rcx
cmp qword [rsp + 0x40], rdi
jne 0x1800a01fa
cmp byte [rax], 0x5c
jne 0x1800a01fa
mov rbx, qword [rbp - 0x50]
movzx esi, dil
jmp 0x1800a020d
mov rbx, qword [rbp - 0x50]
jmp 0x1800a020a
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
xor sil, sil
mov qword [rsp + 0x548], r12
mov qword [rsp + 0x508], r13
mov qword [rsp + 0x500], r14
movaps xmmword [rsp + 0x4f0], xmm6
movaps xmmword [rsp + 0x4e0], xmm7
test dil, 1
je 0x1800a026e
cmp rdx, 0x10
jb 0x1800a026e
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a0269
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800a0875
call fcn.1800cf9b0
test sil, sil
je 0x1800a02fe
lea r8, [rbx - 1]
mov qword [rsp + 0x60], r15
cmp rbx, r8
mov qword [rsp + 0x68], 0xf
lea rdx, [rbp - 0x60]
mov byte [rsp + 0x50], r15b
cmovb r8, rbx
lea rcx, [rsp + 0x50]
cmp qword [rbp - 0x48], 0x10
cmovae rdx, qword [rbp - 0x60]
call fcn.1800c2b50
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x1800a02e8
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a02e3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800a0875
call fcn.1800cf9b0
movups xmm1, xmmword [rsp + 0x60]
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp - 0x50], xmm1
mov rbx, qword [rbp - 0x50]
movups xmmword [rbp - 0x60], xmm0
cmp qword [rbp - 0x48], 0x10
lea rdi, [rbp - 0x60]
mov r13, qword [rbp - 0x60]
movabs rax, 0x7fffffffffffffff
cmovae rdi, r13
cmp rbx, 0x10
jae 0x1800a033d
movups xmm0, xmmword [rdi]
mov qword [rsp + 0x48], 0xf
mov r14d, 0xf
movups xmmword [rsp + 0x30], xmm0
mov rsi, qword [rsp + 0x30]
jmp 0x1800a03af
mov r14, rbx
or r14, 0xf
cmp r14, rax
cmova r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x1800a0384
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800a0887
mov rcx, rax
call fcn.1800cf9b8
test rax, rax
je 0x1800a088d
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1800a0396
test rcx, rcx
je 0x1800a0393
call fcn.1800cf9b8
mov rsi, rax
jmp 0x1800a0396
mov rsi, r15
lea r8, [rbx + 1]
mov qword [rsp + 0x30], rsi
mov rdx, rdi
mov rcx, rsi
call fcn.1800d3040
mov qword [rsp + 0x48], r14
cmp r14, 0x10
mov qword [rsp + 0x40], rbx
lea r15, [rsp + 0x30]
mov rcx, rbx
cmovae r15, rsi
lea rax, [rsp + 0x30]
jb 0x1800a03ce
mov rax, rsi
lea rdi, [rsp + 0x30]
cmovae rdi, rsi
lea r12, [rax + rcx]
cmp rdi, r12
je 0x1800a03f7
sub r15, rdi
movzx ecx, byte [rdi]
call fcn.1800dbd50
mov byte [rdi + r15], al
inc rdi
cmp rdi, r12
jne 0x1800a03e3
movups xmm0, xmmword [rsp + 0x30]
lea rdx, [0x18012d5b8]
movups xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm1
call fcn.1800c2490
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.18008cd30
mov r12, qword [rbp - 0x48]
test eax, eax
jg 0x1800a0796
cmp r12, 0x10
lea rsi, [rbp - 0x60]
movabs r15, 0x7fffffffffffffff
cmovae rsi, r13
cmp rbx, 0x10
jae 0x1800a0464
movups xmm0, xmmword [rsi]
mov qword [rsp + 0x68], 0xf
movups xmmword [rsp + 0x50], xmm0
jmp 0x1800a04d5
mov rdi, rbx
or rdi, 0xf
cmp rdi, r15
cmova rdi, r15
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1800a04ae
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800a0893
mov rcx, rax
call fcn.1800cf9b8
mov rcx, rax
test rax, rax
je 0x1800a0899
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800a04bc
test rcx, rcx
je 0x1800a04ba
call fcn.1800cf9b8
jmp 0x1800a04bc
xor eax, eax
lea r8, [rbx + 1]
mov qword [rsp + 0x50], rax
mov rdx, rsi
mov rcx, rax
call fcn.1800d3040
mov qword [rsp + 0x68], rdi
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x60], rbx
call fcn.1800c2490
mov r8, rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.18009e3a0
cmp qword [0x18012cdb0], 0x10
lea r8, [0x18012cd98]
mov r9, qword [0x18012cda8]
mov rcx, rax
cmovae r8, qword [0x18012cd98]
call fcn.1800c7240
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [0x18012cdb0]
cmp rdx, 0x10
jb 0x1800a057c
mov rcx, qword [0x18012cd98]
inc rdx
cmp rdx, 0x1000
jb 0x1800a0577
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800a0899
mov rcx, r8
call fcn.1800cf9b0
mov rdx, qword [rsp + 0x48]
movups xmmword [0x18012cd98], xmm6
movups xmmword [0x18012cda8], xmm7
cmp rdx, 0x10
jb 0x1800a05c7
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a05c2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800a0899
call fcn.1800cf9b0
cmp r12, 0x10
lea r14, [rbp - 0x60]
cmovae r14, r13
cmp rbx, 0x10
jae 0x1800a05f7
movups xmm0, xmmword [r14]
mov qword [rsp + 0x48], 0xf
mov esi, 0xf
movups xmmword [rsp + 0x30], xmm0
mov rdi, qword [rsp + 0x30]
jmp 0x1800a0668
mov rsi, rbx
or rsi, 0xf
cmp rsi, r15
cmova rsi, r15
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1800a063e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800a089f
mov rcx, rax
call fcn.1800cf9b8
test rax, rax
je 0x1800a086f
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800a064f
test rcx, rcx
je 0x1800a064d
call fcn.1800cf9b8
mov rdi, rax
jmp 0x1800a064f
xor edi, edi
lea r8, [rbx + 1]
mov qword [rsp + 0x30], rdi
mov rdx, r14
mov rcx, rdi
call fcn.1800d3040
mov qword [rsp + 0x48], rsi
cmp rsi, 0x10
mov qword [rsp + 0x40], rbx
lea r14, [rsp + 0x30]
cmovae r14, rdi
lea rax, [rsp + 0x30]
jb 0x1800a0684
mov rax, rdi
lea r15, [rbx + rax]
lea rbx, [rsp + 0x30]
cmovae rbx, rdi
cmp rbx, r15
je 0x1800a06b4
sub r14, rbx
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.1800dbd50
mov byte [r14 + rbx], al
inc rbx
cmp rbx, r15
jne 0x1800a06a0
movups xmm0, xmmword [rsp + 0x30]
cmp qword [0x18012d5d0], 0x10
lea r8, [0x18012d5b8]
movups xmm1, xmmword [rsp + 0x40]
cmovae r8, qword [0x18012d5b8]
lea rcx, [rsp + 0x50]
mov r9, qword [0x18012d5c8]
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm1
call fcn.1800c7240
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [0x18012d5d0]
cmp rdx, 0x10
jb 0x1800a074b
mov rcx, qword [0x18012d5b8]
inc rdx
cmp rdx, 0x1000
jb 0x1800a0746
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800a086f
mov rcx, r8
call fcn.1800cf9b0
mov rdx, qword [rsp + 0x68]
movups xmmword [0x18012d5b8], xmm6
movups xmmword [0x18012d5c8], xmm7
cmp rdx, 0x10
jb 0x1800a0796
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a0791
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800a086f
call fcn.1800cf9b0
cmp r12, 0x10
jb 0x1800a07ce
lea rdx, [r12 + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x1800a07c6
mov r13, qword [r13 - 8]
add rdx, 0x27
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800a0875
mov rcx, r13
call fcn.1800cf9b0
mov rbx, qword [rsp + 0x70]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800a0809
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1800a0804
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800a0875
mov rcx, r8
call fcn.1800cf9b0
movaps xmm6, xmmword [rsp + 0x4f0]
mov r14, qword [rsp + 0x500]
mov r13, qword [rsp + 0x508]
mov r12, qword [rsp + 0x548]
movaps xmm7, xmmword [rsp + 0x4e0]
mov rsi, qword [rsp + 0x540]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rbx, qword [rsp + 0x538]
mov rcx, qword [rbp + 0x3d0]
xor rcx, rsp
call fcn.1800cf6f0
add rsp, 0x510
pop r15
pop rdi
pop rbp
ret
call fcn.1800dec10
int3
call fcn.1800dec10
int3
call fcn.1800dec10
int3
call fcn.1800c2e00
int3
call fcn.1800892e0
int3
call fcn.1800dec10
int3
call fcn.1800892e0
int3
call fcn.1800dec10
int3
call fcn.1800892e0
int3