Function at 0x18000a040
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
lea rcx, [0x18009c570]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [0x18007b180]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor ebx, ebx
test eax, eax
jne 0x18000a0b9
cmp dword [rsp + 0x78], 4
jne 0x18000a0b9
mov ecx, dword [rsp + 0x80]
jmp 0x18000a0bb
mov ecx, ebx
mov eax, ebx
test ecx, ecx
setne al
mov dword [0x18009c84c], eax
call fcn.180005620
cmp dword [0x18009c84c], ebx
jne 0x18000a0e9
cmp byte [0x18009d5e0], bl
jne 0x18000a0e9
cmp byte [0x18009d4c0], bl
je 0x18000a443
lea rdx, [0x18009c860]
lea rcx, [rsp + 0x38]
call fcn.180047264
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1800996a8]
call fcn.18000ba90
nop
cmp qword [rsp + 0x58], 0x10
jb 0x18000a124
mov rcx, qword [rsp + 0x40]
call fcn.1800538dc
call fcn.18005e3c0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.18005ee70
mov edi, 1
mov rcx, qword [0x18009ca68]
test rcx, rcx
je 0x18000a15d
lea rdx, str.explorer.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18000a200
cmp dword [0x18009c7e8], 0
jne 0x18000a200
mov dword [0x18009c7e8], ebx
lea rdx, [0x18007b1b8]
lea rcx, str.kernelbase.dll
call fcn.180060780
mov qword [0x18009c7e0], rax
test rax, rax
je 0x18000a1ae
lea rdx, [0x180009950]
lea rcx, [0x18009c7e0]
call fcn.18005ef60
test eax, eax
jne 0x18000a1ae
mov dword [0x18009c7e8], edi
jmp 0x18000a200
cmp dword [0x18009c7e8], 0
jne 0x18000a200
mov dword [0x18009c7e8], ebx
lea rdx, [0x18007b1b8]
lea rcx, [0x18007b1d8]
call fcn.180060780
mov qword [0x18009c7e0], rax
test rax, rax
je 0x18000a200
lea rdx, [0x180009950]
lea rcx, [0x18009c7e0]
call fcn.18005ef60
mov ecx, dword [0x18009c7e8]
test eax, eax
cmove ecx, edi
mov dword [0x18009c7e8], ecx
cmp dword [0x18009c7ec], 0
jne 0x18000a252
mov dword [0x18009c7ec], ebx
lea rdx, str.CreateDCA
lea rcx, str.gdi32.dll
call fcn.180060780
mov qword [0x18009c7f0], rax
test rax, rax
je 0x18000a252
lea rdx, [0x180009cb0]
lea rcx, [0x18009c7f0]
call fcn.18005ef60
mov ecx, dword [0x18009c7ec]
test eax, eax
cmove ecx, edi
mov dword [0x18009c7ec], ecx
cmp dword [0x18009c800], 0
jne 0x18000a2a4
mov dword [0x18009c800], ebx
lea rdx, str.CreateDCW
lea rcx, str.gdi32.dll
call fcn.180060780
mov qword [0x18009c7f8], rax
test rax, rax
je 0x18000a2a4
lea rdx, [0x180009e00]
lea rcx, [0x18009c7f8]
call fcn.18005ef60
mov ecx, dword [0x18009c800]
test eax, eax
cmove ecx, edi
mov dword [0x18009c800], ecx
cmp dword [0x18009c804], 0
jne 0x18000a2f6
mov dword [0x18009c804], ebx
lea rdx, str.DeleteDC
lea rcx, str.gdi32.dll
call fcn.180060780
mov qword [0x18009c808], rax
test rax, rax
je 0x18000a2f6
lea rdx, [0x180009e90]
lea rcx, [0x18009c808]
call fcn.18005ef60
mov ecx, dword [0x18009c804]
test eax, eax
cmove ecx, edi
mov dword [0x18009c804], ecx
cmp dword [0x18009c818], 0
jne 0x18000a348
mov dword [0x18009c818], ebx
lea rdx, str.StartDocW
lea rcx, str.gdi32.dll
call fcn.180060780
mov qword [0x18009c810], rax
test rax, rax
je 0x18000a348
lea rdx, [0x180009eb0]
lea rcx, [0x18009c810]
call fcn.18005ef60
mov ecx, dword [0x18009c818]
test eax, eax
cmove ecx, edi
mov dword [0x18009c818], ecx
cmp dword [0x18009c81c], 0
jne 0x18000a39a
mov dword [0x18009c81c], ebx
lea rdx, str.EndDoc
lea rcx, str.gdi32.dll
call fcn.180060780
mov qword [0x18009c820], rax
test rax, rax
je 0x18000a39a
lea rdx, [0x180009f30]
lea rcx, [0x18009c820]
call fcn.18005ef60
mov ecx, dword [0x18009c81c]
test eax, eax
cmove ecx, edi
mov dword [0x18009c81c], ecx
cmp dword [0x18009c834], 0
jne 0x18000a3ec
mov dword [0x18009c834], ebx
lea rdx, str.StartPage
lea rcx, str.gdi32.dll
call fcn.180060780
mov qword [0x18009c838], rax
test rax, rax
je 0x18000a3ec
lea rdx, [0x180009fb0]
lea rcx, [0x18009c838]
call fcn.18005ef60
mov edx, dword [0x18009c834]
test eax, eax
cmove edx, edi
mov dword [0x18009c834], edx
cmp dword [0x18009c848], 0
jne 0x18000a43e
mov dword [0x18009c848], ebx
lea rdx, str.EndPage
lea rcx, str.gdi32.dll
call fcn.180060780
mov qword [0x18009c840], rax
test rax, rax
je 0x18000a43e
lea rdx, [0x180009ff0]
lea rcx, [0x18009c840]
call fcn.18005ef60
mov ecx, dword [0x18009c848]
test eax, eax
cmove ecx, edi
mov dword [0x18009c848], ecx
call fcn.18005e690
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret