Function at 0x18005e510
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push r12
push r13
lea rbp, [rsp - 0x188]
sub rsp, 0x288
mov rax, qword [0x18019bca8]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor r13d, r13d
lea rcx, [0x18019dd50]
mov qword [rsp + 0x50], r13
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov r8d, 0x80
lea rdx, [rsp + 0x70]
lea rcx, [0x180168bc0]
call fcn.18005e6e0
mov ebx, eax
test eax, eax
js 0x1800c53d8
mov qword [rsp + 0x2b0], rsi
mov r12d, ebx
mov qword [rsp + 0x2b8], rdi
mov qword [rsp + 0x2c0], r14
mov qword [rsp + 0x280], r15
test ebx, ebx
js 0x18005e67c
lea r8, [rsp + 0x70]
mov rdx, 0xffffffff80000000
lea rcx, [rsp + 0x50]
call fcn.18005f30c
test eax, eax
jne 0x18005e67c
mov qword [rsp + 0x48], r13
lea rax, [rsp + 0x70]
mov ecx, 0x80
cmp word [rax], r13w
je 0x18005e5da
add rax, 2
sub rcx, 1
jne 0x18005e5c5
jmp 0x1800c5570
test rcx, rcx
je 0x1800c5570
mov eax, 0x80
mov r12d, r13d
sub rax, rcx
lea rax, [rsp + rax*2 + 0x70]
test rcx, rcx
je 0x1800c53f2
lea r9, str.Disabled
mov r8d, 0x7ffffffe
sub r9, rax
nop dword [rax]
test r8, r8
je 0x18005e634
movzx edx, word [r9 + rax]
test dx, dx
je 0x18005e634
mov word [rax], dx
dec r8
add rax, 2
sub rcx, 1
jne 0x18005e610
jmp 0x1800c53f2
test rcx, rcx
je 0x1800c53f2
mov word [rax], r13w
test r12d, r12d
js 0x1800c5576
lea r8, [rsp + 0x70]
mov rdx, 0xffffffff80000000
lea rcx, [rsp + 0x48]
call fcn.18005f30c
test eax, eax
je 0x1800c5401
lea rcx, [rsp + 0x50]
call fcn.18005f368
lea rcx, [rsp + 0x48]
call fcn.18005f368
lea rcx, [0x18019dd50]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x50]
call fcn.18005f368
mov r15, qword [rsp + 0x280]
mov eax, r12d
mov r14, qword [rsp + 0x2c0]
mov rdi, qword [rsp + 0x2b8]
mov rsi, qword [rsp + 0x2b0]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.18008b970
add rsp, 0x288
pop r13
pop r12
pop rbx
pop rbp
ret
cmp dword [0x18019cca4], r13d
je 0x18005e56d
mov ecx, ebx
call fcn.180096ba4
nop
jmp 0x18005e56d
sub rax, 2
mov r12d, 0x8007007a
jmp 0x18005e63d
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x70]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r13
mov r15d, r13d
mov dword [rsp + 0x40], 0x80
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jne 0x1800c5551
mov r14d, dword [rsp + 0x40]
lea rdx, [rsp + 0x60]
inc r15d
lea rcx, [rbp + 0x70]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_IIDFromString]
mov edi, eax
test eax, eax
jns 0x1800c5473
cmp dword [0x18019cca4], r13d
je 0x1800c5473
mov ecx, eax
call fcn.180096ba4
mov r12d, edi
test edi, edi
js 0x18005e672
mov eax, dword [0x18019d9f8]
mov edi, eax
lea esi, [rax + 1]
cmp esi, eax
sbb r12d, r12d
and r12d, 0x80070216
cmp esi, eax
cmovae r14d, esi
jae 0x1800c54b4
cmp dword [0x18019cca4], r13d
je 0x1800c54b4
mov ecx, r12d
call fcn.180096ba4
mov eax, dword [0x18019d9f8]
cmp esi, edi
jb 0x1800c550e
cmp r14d, dword [0x18019d9f4]
ja 0x1800c54dd
movups xmm0, xmmword [rsp + 0x60]
shl rax, 4
add rax, qword [0x18019d9e0]
movups xmmword [rax], xmm0
mov dword [0x18019d9f8], r14d
jmp 0x1800c550e
mov edx, 0x10
lea r9, [rsp + 0x60]
lea rcx, [0x18019d9e0]
lea r8d, [rdx - 0xf]
call fcn.18003376c
mov r12d, eax
test eax, eax
jns 0x1800c550e
cmp dword [0x18019cca4], r13d
je 0x1800c550e
mov ecx, eax
call fcn.180096ba4
test r12d, r12d
js 0x1800c5561
lea rax, [rsp + 0x58]
mov dword [rsp + 0x40], 0x80
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x70]
mov qword [rsp + 0x28], r13
mov edx, r15d
mov rcx, rbx
mov qword [rsp + 0x20], r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
je 0x1800c544b
lea rcx, [rsp + 0x48]
call fcn.18005f368
nop
jmp 0x18005e668
cmp dword [0x18019cca4], r13d
je 0x18005e672
jmp 0x1800c5583
mov r12d, 0x80070057
cmp dword [0x18019cca4], r13d
je 0x18005e672
mov ecx, r12d
call fcn.180096ba4
nop
jmp 0x18005e672