Function at 0x18003ab88
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
mov eax, 0x2930
call fcn.1800f12f0
sub rsp, rax
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x88], 0xfffffffffffffffe
mov qword [rbp + 0x2928], rbx
mov qword [rbp + 0x2930], rsi
mov qword [rbp + 0x2938], rdi
mov rax, qword [0x1801563c0]
xor rax, rbp
mov qword [rbp + 0x28e0], rax
mov rdi, rcx
mov eax, 0x64
mov dword [rbp + 4], eax
mov dword [rbp], eax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMozillaFirefoxExtensions
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r13d, r13d
cmp eax, r13d
jne 0x18003b05b
mov esi, r13d
lea rax, [rbp]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 4]
lea r8, [rbp + 0x8e0]
xor edx, edx
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, r13d
jne 0x18003b05b
lea r12, [rdi + 0x18]
movabs rbx, 0xffffffffffffff0
lea r15d, [r13 + 0xf]
or r14, 0xffffffffffffffff
lea r8, [rbp + 0xe0]
lea rdx, [0x18010d2b0]
lea rcx, [rbp + 0x18e0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0x8e0]
lea rcx, [rbp + 0x10]
call fcn.1800041c0
nop
lea rdx, [rbp + 0x18e0]
lea rcx, [rbp + 8]
call fcn.1800041c0
nop
lea rdx, [0x18010d528]
lea rcx, [rbp + 0x18]
call fcn.1800041c0
nop
cmp qword [rbp + 0x10], r13
jne 0x18003acc6
mov rdx, r13
jmp 0x18003ad43
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jle 0x18003ace0
mov rdx, r13
jmp 0x18003ad43
movsxd rax, edx
add rax, rax
lea rcx, [r15 + rax]
cmp rcx, rax
ja 0x18003acf2
mov rcx, rbx
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1800f12f0
sub rsp, rcx
lea rdi, [rsp + 0x40]
cmp rdi, r13
je 0x18003ad40
mov byte [rdi], r13b
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, r14d
mov r8, qword [rbp + 0x10]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb rdx, rdx
and rdx, rdi
jmp 0x18003ad43
mov rdx, r13
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x50], r13
mov byte [rbp + 0x40], r13b
xor eax, eax
mov rcx, r14
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x38]
call fcn.180003768
nop
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0xb8]
call fcn.180059a54
nop
cmp qword [rbp + 0x58], 0x10
jb 0x18003ad8b
mov rcx, qword [rbp + 0x40]
call fcn.1800d1290
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x50], r13
mov byte [rbp + 0x40], r13b
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rdx, qword [rbp + 0xc0]
lea rcx, [rbp + 0x28]
call fcn.180007f64
nop
cmp qword [rbp + 8], r13
jne 0x18003adc3
mov rdx, r13
jmp 0x18003ae40
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jle 0x18003addd
mov rdx, r13
jmp 0x18003ae40
movsxd rax, edx
add rax, rax
lea rcx, [r15 + rax]
cmp rcx, rax
ja 0x18003adef
mov rcx, rbx
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1800f12f0
sub rsp, rcx
lea rdi, [rsp + 0x40]
cmp rdi, r13
je 0x18003ae3d
mov byte [rdi], r13b
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, r14d
mov r8, qword [rbp + 8]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb rdx, rdx
and rdx, rdi
jmp 0x18003ae40
mov rdx, r13
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x78], r13
mov byte [rbp + 0x68], r13b
xor eax, eax
mov rcx, r14
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x60]
call fcn.180003768
nop
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x90]
call fcn.180059a54
nop
cmp qword [rbp + 0x80], 0x10
jb 0x18003ae8e
mov rcx, qword [rbp + 0x68]
call fcn.1800d1290
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x78], r13
mov byte [rbp + 0x68], r13b
lea rdx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 0x10
cmovae rdx, qword [rbp + 0x98]
lea rcx, [rbp + 0x30]
call fcn.180007f64
nop
mov r9, qword [rbp + 0x28]
mov rdi, qword [rbp + 0x30]
mov r8, rdi
lea rdx, str._Addin_filename__s__name__s__type_extension___
lea rcx, [rbp + 0x18]
call fcn.180008f64
mov r11, qword [r12]
mov r8, qword [rbp + 0x18]
mov edx, dword [r11 - 8]
mov rcx, r12
call fcn.180039144
lea rcx, [0x18010d528]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [0x18010d528]
mov edx, eax
lea rcx, [rbp + 0x18]
call fcn.180003e28
inc esi
lea rax, [rbp]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 4]
lea r8, [rbp + 0x8e0]
mov edx, esi
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
lea rcx, [rdi - 0xc]
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18003af6b
mov edx, r14d
lock xadd dword [rcx], edx
add edx, r14d
cmp edx, r13d
jg 0x18003af6b
call fcn.1800d1434
nop
cmp qword [rbp + 0xb0], 0x10
jb 0x18003af81
mov rcx, qword [rbp + 0x98]
call fcn.1800d1290
mov qword [rbp + 0xb0], r15
mov qword [rbp + 0xa8], r13
mov byte [rbp + 0x98], r13b
mov rcx, qword [rbp + 0x28]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18003afb8
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r13d
jg 0x18003afb8
call fcn.1800d1434
nop
cmp qword [rbp + 0xd8], 0x10
jb 0x18003afce
mov rcx, qword [rbp + 0xc0]
call fcn.1800d1290
mov qword [rbp + 0xd8], r15
mov qword [rbp + 0xd0], r13
mov byte [rbp + 0xc0], r13b
mov rcx, qword [rbp + 0x18]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18003b005
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r13d
jg 0x18003b005
call fcn.1800d1434
nop
mov rcx, qword [rbp + 8]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18003b027
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r13d
jg 0x18003b027
call fcn.1800d1434
nop
mov rcx, qword [rbp + 0x10]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18003b048
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r13d
jg 0x18003b048
call fcn.1800d1434
cmp ebx, r13d
movabs rbx, 0xffffffffffffff0
je 0x18003ac6d
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x28e0]
xor rcx, rbp
call fcn.1800d12b0
mov rbx, qword [rbp + 0x2928]
mov rsi, qword [rbp + 0x2930]
mov rdi, qword [rbp + 0x2938]
lea rsp, [rbp + 0x28f0]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret