Function at 0x180009170
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x22f0
call fcn.180048e70
sub rsp, rax
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rsp + 0x2320], rbx
mov qword [rsp + 0x2330], rbp
mov qword [rsp + 0x2338], rsi
mov rax, qword [0x18006afd8]
xor rax, rsp
mov qword [rsp + 0x22e0], rax
mov qword [rsp + 0x80], rdx
mov esi, ecx
mov qword [rsp + 0xa8], rdx
xor r12d, r12d
mov rbp, r12
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], r12d
lea rcx, [0x18006af50]
mov rax, qword [0x18006af50]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x50], rdi
lea rdx, str.CommandBandLayout
or r13, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x180009235
movzx ebx, dx
xor edx, edx
mov ecx, ebx
call fcn.180005550
test rax, rax
je 0x180009256
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.180005780
mov rdi, qword [rsp + 0x50]
jmp 0x180009256
xor eax, eax
mov rcx, r13
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x50]
call fcn.180005a60
mov rdi, qword [rsp + 0x50]
cmp esi, 7
jne 0x180009287
xor eax, eax
mov rcx, r13
lea rdi, str.ButtonLayout
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.ButtonLayout
lea rcx, [rsp + 0x50]
call fcn.180005a60
mov rdi, qword [rsp + 0x50]
mov ebx, 8
mov eax, 6
cmp esi, 7
cmove ebx, eax
mov dword [rsp + 0x70], ebx
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0xae0]
call fcn.180036ea0
cmp esi, 7
jne 0x180009306
mov ecx, 0x101
test ebx, ebx
je 0x180009434
lea rdx, [rsp + 0xae1]
mov r8d, ebx
lea r9d, [rcx + 2]
mov byte [rdx - 1], cl
mov eax, ecx
shr eax, 8
mov byte [rdx], al
mov eax, ecx
shr eax, 0x10
mov byte [rdx + 1], al
mov eax, ecx
shr eax, 0x18
mov byte [rdx + 2], al
inc ecx
cmp ecx, 0x102
cmove ecx, r9d
add rdx, 4
sub r8, 1
jne 0x1800092d1
jmp 0x180009434
mov byte [rsp + 0xb8], 1
mov byte [rsp + 0xb9], 1
mov byte [rsp + 0xba], 0
mov byte [rsp + 0xbb], 0
mov byte [rsp + 0xbc], 3
mov byte [rsp + 0xbd], 1
mov byte [rsp + 0xbe], 0
mov byte [rsp + 0xbf], 0
mov byte [rsp + 0xc0], 8
mov byte [rsp + 0xc1], 1
mov byte [rsp + 0xc2], 0
mov byte [rsp + 0xc3], 0
mov byte [rsp + 0xc4], 4
mov byte [rsp + 0xc5], 1
mov byte [rsp + 0xc6], 0
mov byte [rsp + 0xc7], 0
mov byte [rsp + 0xc8], 5
mov byte [rsp + 0xc9], 1
mov byte [rsp + 0xca], 0
mov byte [rsp + 0xcb], 0
mov byte [rsp + 0xcc], 0x43
mov byte [rsp + 0xcd], 1
mov byte [rsp + 0xce], 0
mov byte [rsp + 0xcf], 0
mov byte [rsp + 0xd0], 6
mov byte [rsp + 0xd1], 1
mov byte [rsp + 0xd2], 0
mov byte [rsp + 0xd3], 0
mov byte [rsp + 0xd4], 7
mov byte [rsp + 0xd5], 1
mov byte [rsp + 0xd6], 0
mov byte [rsp + 0xd7], 0
lea rdx, [rsp + 0xae0]
lea rcx, [rsp + 0xb8]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov rax, qword [rcx + 0x18]
mov qword [rdx + 0x18], rax
mov dword [rsp + 0x78], 0x800
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x1ae0]
call fcn.180036ea0
mov r15b, 1
mov qword [rsp + 0x98], r12
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerLowRegistryCommandBar
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800094ef
mov rbp, qword [rsp + 0x98]
mov qword [rsp + 0x58], rbp
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1ae0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
xor r8d, r8d
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800094d9
movzx r15d, r15b
cmp dword [rsp + 0x88], 3
cmove r15d, r12d
test rbp, rbp
je 0x1800094ef
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, r12
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], r12d
mov r14d, r12d
mov dword [rsp + 0x74], pe_nt_image_headers64
mov ebx, 0x169
mov eax, 0x110
cmp esi, 7
cmove ebx, eax
xor esi, esi
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x12e0]
call fcn.180036ea0
mov qword [rsp + 0x90], rsi
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerExtensions
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180009583
xor ecx, ecx
mov eax, ecx
test rbp, rbp
je 0x180009570
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov rbp, qword [rsp + 0x90]
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x60], ecx
jmp 0x180009585
xor ecx, ecx
test eax, eax
jne 0x1800099cd
lea rsi, [rsp + 0x12e1]
mov r13d, r14d
mov rdi, qword [rsp + 0x80]
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x74]
lea r8, [rsp + 0xe0]
mov edx, r14d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180009696
lea rcx, [rsp + 0xe0]
call fcn.1800088f0
test al, al
je 0x18000967c
mov rax, qword [rdi]
lea r8, [rsp + 0xe0]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x180009614
add rax, 2
test ecx, ecx
jne 0x180009600
test edx, edx
cmove r12d, ebx
test r15b, r15b
je 0x18000967a
lea rcx, [rsp + 0xe0]
call fcn.180008f30
test al, al
je 0x18000967a
mov rax, qword [rdi]
lea r8, [rsp + 0xe0]
sub r8, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x180009654
add rax, 2
test ecx, ecx
jne 0x180009640
test edx, edx
je 0x18000967a
mov byte [rsi - 1], bl
mov eax, ebx
shr eax, 8
mov byte [rsi], al
mov eax, ebx
shr eax, 0x10
mov byte [rsi + 1], al
mov eax, ebx
shr eax, 0x18
mov byte [rsi + 2], al
add r13d, 4
add rsi, 4
inc ebx
inc r14d
xor ecx, ecx
mov word [rsp + 0xe0], cx
mov dword [rsp + 0x74], pe_nt_image_headers64
jmp 0x1800095a0
mov dword [rsp + 0x68], r13d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbp, rbp
mov rdi, qword [rsp + 0x50]
mov r13, 0xffffffffffffffff
je 0x1800096c8
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r14d, r14d
mov rbp, r14
mov qword [rsp + 0x58], r14
jmp 0x1800096cb
xor r14d, r14d
mov dword [rsp + 0x60], r14d
test r12d, r12d
je 0x1800099cd
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x2e0]
call fcn.180036ea0
mov byte [rsp + 0x2e0], 7
mov byte [rsp + 0x2e1], 0
mov byte [rsp + 0x2e2], 0
mov byte [rsp + 0x2e3], 0
mov r10d, r12d
shr r10d, 8
mov r11d, r12d
shr r11d, 0x10
mov esi, r12d
shr esi, 0x18
test r15b, r15b
je 0x1800097de
mov r9d, dword [rsp + 0x70]
test r9d, r9d
je 0x180009786
mov rcx, r14
mov rdx, r9
nop dword [rax + rax]
movzx eax, byte [rsp + rcx + 0xae0]
mov byte [rsp + rcx + 0x2e4], al
movzx eax, byte [rsp + rcx + 0xae1]
mov byte [rsp + rcx + 0x2e5], al
movzx eax, byte [rsp + rcx + 0xae2]
mov byte [rsp + rcx + 0x2e6], al
movzx eax, byte [rsp + rcx + 0xae3]
mov byte [rsp + rcx + 0x2e7], al
add rcx, 4
sub rdx, 1
jne 0x180009740
lea r9d, [r9*4 + 4]
movsxd rax, r9d
mov ebx, dword [rsp + 0x68]
test ebx, ebx
je 0x1800097d8
lea rcx, [rsp + 0x12e1]
lea rdx, [rsp + rax + 0x2e1]
mov r8, rbx
nop dword [rax]
movzx eax, byte [rcx - 1]
mov byte [rdx - 1], al
movzx eax, byte [rcx]
mov byte [rdx], al
movzx eax, byte [rcx + 1]
mov byte [rdx + 1], al
movzx eax, byte [rcx + 2]
mov byte [rdx + 2], al
add rcx, 4
add rdx, 4
sub r8, 1
jne 0x1800097b0
lea ebx, [r9 + rbx*4]
jmp 0x180009843
mov ebx, r14d
mov eax, dword [rsp + 0x78]
shr eax, 2
test eax, eax
je 0x180009840
lea rdx, [rsp + 0x2e1]
lea rcx, [rsp + 0x1ae1]
mov r8d, eax
nop
movzx eax, byte [rcx - 1]
cmp al, r12b
jne 0x18000981a
cmp byte [rcx], r10b
jne 0x18000981a
cmp byte [rcx + 1], r11b
jne 0x18000981a
cmp byte [rcx + 2], sil
je 0x180009836
mov byte [rdx - 1], al
movzx eax, byte [rcx]
mov byte [rdx], al
movzx eax, byte [rcx + 1]
mov byte [rdx + 1], al
movzx eax, byte [rcx + 2]
mov byte [rdx + 2], al
inc ebx
add rdx, 4
add rcx, 4
sub r8, 1
jne 0x180009800
shl ebx, 2
mov eax, ebx
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp eax, 1
jl 0x1800098a4
lea eax, [rbx - 1]
movsxd rcx, eax
cmp eax, 4
jl 0x18000987f
lea rcx, [rsp + rcx + 0x2e4]
add eax, 0xfffffffd
mov edx, eax
nop dword [rax + rax]
movzx eax, byte [rcx - 4]
mov byte [rcx], al
dec rcx
sub rdx, 1
jne 0x180009870
mov byte [rsp + 0x2e4], r12b
mov byte [rsp + 0x2e5], r10b
mov byte [rsp + 0x2e6], r11b
mov byte [rsp + 0x2e7], sil
add ebx, 4
jmp 0x1800098d0
mov byte [rsp + rbx + 0x2e0], r12b
lea eax, [rbx + 1]
mov byte [rsp + rax + 0x2e0], r10b
lea eax, [rbx + 2]
mov byte [rsp + rax + 0x2e0], r11b
lea eax, [rbx + 3]
mov byte [rsp + rax + 0x2e0], sil
add ebx, 4
mov qword [rsp + 0x68], r14
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerLowRegistryCommandBar
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18000995e
mov eax, r14d
test rbp, rbp
je 0x18000992a
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x68]
mov qword [rsp + 0x58], rbp
test eax, eax
jne 0x18000995e
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbp, rbp
je 0x180009971
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x60], r14d
lea rdx, [rdi - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180009992
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800099a3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rsp + 0x80]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r13d
dec r13d
test r13d, r13d
jg 0x1800099c9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
jmp 0x180009a22
lea rdx, [rdi - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800099e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800099fa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rsp + 0x80]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r13d
dec r13d
test r13d, r13d
jg 0x180009a20
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
mov rcx, qword [rsp + 0x22e0]
xor rcx, rsp
call fcn.180036e70
lea r11, [rsp + 0x22f0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret