Function at 0x1800015c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x180037318]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r13, rcx
xor r14d, r14d
mov r12, r14
mov rbp, r14
mov rsi, r14
mov dword [r11 - 0x58], r14d
mov rbx, r14
mov qword [rsp + 0x50], rbx
mov qword [r11 - 0x48], r14
lea rax, [r11 - 0x48]
mov qword [r11 - 0x68], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARE
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180001646
mov eax, r14d
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rbx
jmp 0x180001652
test eax, eax
jle 0x180001652
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x180001959
mov dword [rsp + 0x38], r14d
lea r9, [rsp + 0x38]
xor r8d, r8d
lea edx, [r8 + 4]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
cmp eax, 0x7a
je 0x180001687
test eax, eax
jle 0x1800016cd
movzx eax, ax
or eax, 0x80070000
jmp 0x1800016cd
mov ecx, dword [rsp + 0x38]
call fcn.180010b00
mov rbp, rax
test rax, rax
je 0x180001959
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov rcx, rax
call fcn.180011580
lea r9, [rsp + 0x38]
mov r8, rbp
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
test eax, eax
jle 0x1800016cd
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x180001931
mov qword [rsp + 0x50], r14
lea r8, [rsp + 0x50]
lea rdx, str.SECURITYSAMDomainsAccount
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jle 0x1800016ff
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x180001931
test rbx, rbx
je 0x180001715
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x34], r14d
lea r9, [rsp + 0x34]
xor r8d, r8d
lea edx, [r8 + 4]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
cmp eax, 0x7a
je 0x18000174c
test eax, eax
jle 0x180001792
movzx eax, ax
or eax, 0x80070000
jmp 0x180001792
mov ecx, dword [rsp + 0x34]
call fcn.180010b00
mov r12, rax
test rax, rax
je 0x180001931
mov r8d, dword [rsp + 0x34]
xor edx, edx
mov rcx, rax
call fcn.180011580
lea r9, [rsp + 0x34]
mov r8, r12
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
test eax, eax
jle 0x180001792
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x180001931
mov r8, rbp
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
jle 0x1800017b7
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x180001931
mov qword [rsp + 0x50], r14
lea r8, [rsp + 0x50]
lea rdx, str.SECURITYSAMDomainsAccount
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, eax
test eax, eax
jle 0x1800017ec
movzx edi, ax
or edi, 0x80070000
test edi, edi
js 0x1800018a8
test rbx, rbx
je 0x180001802
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x40], r14d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x1800289a0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jle 0x180001847
movzx edi, ax
or edi, 0x80070000
test edi, edi
js 0x1800018a8
mov ecx, dword [rsp + 0x30]
call fcn.180010b00
mov rsi, rax
test rax, rax
jne 0x180001863
mov edi, 0x8007000e
jmp 0x1800018a8
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call fcn.180011580
lea r11, [rsp + 0x30]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x1800289a0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jle 0x1800018a8
movzx edi, ax
or edi, 0x80070000
mov r8, r12
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test edi, edi
js 0x180001931
mov eax, dword [rsp + 0x30]
test al, 3
jne 0x180001931
mov byte [rsp + 0x50], 0
mov byte [rsp + 0x51], 0
mov byte [rsp + 0x52], 0
mov byte [rsp + 0x53], 0
mov byte [rsp + 0x54], 0
mov byte [rsp + 0x55], 5
lea rcx, [rax + rsi - 0x14]
cmp rcx, rsi
jb 0x180001931
nop
cmp dword [rcx + 8], 0x15
jne 0x18000191e
lea rdx, [rsp + 0x50]
mov r8d, dword [rcx + 2]
cmp r8d, dword [rdx]
jne 0x180001915
mov r8w, word [rcx + 6]
cmp r8w, word [rdx + 4]
jne 0x180001915
mov eax, r14d
jmp 0x18000191a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x180001929
sub rcx, 4
cmp rcx, rsi
jb 0x180001931
jmp 0x1800018f0
mov rdx, r13
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test rbp, rbp
je 0x18000193e
mov rcx, rbp
call fcn.180011190
test r12, r12
je 0x18000194b
mov rcx, r12
call fcn.180011190
test rsi, rsi
je 0x180001959
mov rcx, rsi
call fcn.180011190
nop
test rbx, rbx
je 0x180001967
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800111b0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret