Function at 0x18000ea10
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
sub rsp, 0x400
mov qword [rsp + 0x1f8], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x180080060]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
mov rsi, rcx
lea r9, str.lastHardwareSummary
lea r8, str.SoftwareWOW6432Nodeprojonepodlp_smpcache_
mov rdx, 0xffffffff80000002
lea rcx, [r11 - 0x50]
call fcn.1800386c8
nop
xor ebp, ebp
cmp qword [rsp + 0x3e0], rbp
jne 0x18000ea98
cmp qword [rsp + 0x3e8], 8
jb 0x18000f5e7
mov rcx, qword [rsp + 0x3d0]
call fcn.180042a14
jmp 0x18000f5e7
and dword [rsp + 0x160], 0xfffffe00
mov qword [rsp + 0x168], rbp
mov qword [rsp + 0x170], rbp
mov qword [rsp + 0x178], rbp
lea rdx, [rsp + 0x3c8]
lea rcx, [rsp + 0xe0]
call fcn.1800012e4
mov rbx, rax
lea rcx, [rsp + 0x200]
call fcn.180022664
nop
mov r9b, 1
lea r8, [rsp + 0x158]
mov rdx, rbx
mov rcx, rax
call fcn.180022768
nop
lea rcx, [rsp + 0x200]
call fcn.180026e68
nop
cmp qword [rsp + 0x100], 0x10
jb 0x18000eb1e
mov rcx, qword [rsp + 0xe8]
call fcn.180042a14
mov r12d, 7
cmp byte [rsp + 0x160], r12b
je 0x18000eb5d
lea rcx, [rsp + 0x158]
call fcn.180027f1c
nop
cmp qword [rsp + 0x3e8], 8
jb 0x18000f5e7
mov rcx, qword [rsp + 0x3d0]
call fcn.180042a14
jmp 0x18000f5e7
mov qword [rsp + 0x320], r12
mov qword [rsp + 0x318], rbp
mov word [rsp + 0x308], bp
mov r13d, sendto
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x98], rbp
mov byte [rsp + 0x88], bpl
lea ebx, [r13 - 3]
mov r8, rbx
lea rdx, str.hs_cpu_model
lea rcx, [rsp + 0x80]
call fcn.180002e60
nop
mov qword [rsp + 0x128], r13
mov qword [rsp + 0x120], rbp
mov byte [rsp + 0x110], bpl
xor r8d, r8d
lea rdx, [0x1800656f7]
lea rcx, [rsp + 0x108]
call fcn.180002e60
lea r9, [rsp + 0x108]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x130]
call fcn.18000145c
nop
mov rdx, rax
lea rcx, [rsp + 0x3a0]
call fcn.18000125c
nop
cmp qword [rsp + 0x150], 0x10
jb 0x18000ec2d
mov rcx, qword [rsp + 0x138]
call fcn.180042a14
mov qword [rsp + 0x150], r13
mov qword [rsp + 0x148], rbp
mov byte [rsp + 0x138], bpl
cmp qword [rsp + 0xa0], 0x10
jb 0x18000ec5d
mov rcx, qword [rsp + 0x88]
call fcn.180042a14
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x98], rbp
mov byte [rsp + 0x88], bpl
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xc8], rbp
mov byte [rsp + 0xb8], bpl
mov r8, rbx
lea rdx, str.hs_cpu_model
lea rcx, [rsp + 0xb0]
call fcn.180002e60
nop
mov qword [rsp + 0x1f0], r13
mov qword [rsp + 0x1e8], rbp
mov byte [rsp + 0x1d8], bpl
xor r8d, r8d
lea rdx, [0x1800656f7]
lea rcx, [rsp + 0x1d0]
call fcn.180002e60
lea r9, [rsp + 0x1d0]
lea r8, [rsp + 0xb0]
mov rdx, rsi
lea rcx, [rsp + 0x180]
call fcn.18000145c
nop
mov rdx, rax
lea rcx, [rsp + 0x350]
call fcn.18000125c
nop
cmp qword [rsp + 0x1a0], 0x10
jb 0x18000ed1e
mov rcx, qword [rsp + 0x188]
call fcn.180042a14
mov qword [rsp + 0x1a0], r13
mov qword [rsp + 0x198], rbp
mov byte [rsp + 0x188], bpl
cmp qword [rsp + 0xd0], 0x10
jb 0x18000ed4e
mov rcx, qword [rsp + 0xb8]
call fcn.180042a14
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xc8], rbp
mov byte [rsp + 0xb8], bpl
mov qword [rsp + 0x1c8], r13
mov qword [rsp + 0x1c0], rbp
mov byte [rsp + 0x1b0], bpl
mov ebx, reloc.WS2_32.dll_ntohl
mov r8, rbx
lea rdx, str.hs_memory_size
lea rcx, [rsp + 0x1a8]
call fcn.180002e60
nop
cmp byte [rsp + 0x160], r12b
jne 0x18000ede8
lea rdx, [rsp + 0x1a8]
lea rcx, [rsp + 0x158]
call fcn.180029248
mov rcx, rax
call fcn.18002953c
cmp al, bpl
je 0x18000ede8
lea rdx, [rsp + 0x1a8]
lea rcx, [rsp + 0x158]
call fcn.180029248
mov rcx, rax
call fcn.18002827c
mov edi, eax
jmp 0x18000edea
mov edi, ebp
cmp qword [rsp + 0x1c8], 0x10
jb 0x18000ee02
mov rcx, qword [rsp + 0x1b0]
call fcn.180042a14
mov qword [rsp + 0x1c8], r13
mov qword [rsp + 0x1c0], rbp
mov byte [rsp + 0x1b0], bpl
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x98], rbp
mov byte [rsp + 0x88], bpl
mov r8, rbx
lea rdx, str.hs_memory_size
lea rcx, [rsp + 0x80]
call fcn.180002e60
nop
cmp byte [rsi + 8], r12b
jne 0x18000ee89
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.180029248
mov rcx, rax
call fcn.18002953c
cmp al, bpl
je 0x18000ee89
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.180029248
mov rcx, rax
call fcn.18002827c
mov ebx, eax
jmp 0x18000ee8b
mov ebx, ebp
cmp qword [rsp + 0xa0], 0x10
jb 0x18000eea3
mov rcx, qword [rsp + 0x88]
call fcn.180042a14
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x98], rbp
mov byte [rsp + 0x88], bpl
mov qword [rsp + 0x150], r13
mov qword [rsp + 0x148], rbp
mov byte [rsp + 0x138], bpl
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.hs_motherboard_model
lea rcx, [rsp + 0x130]
call fcn.180002e60
nop
mov qword [rsp + 0x100], r13
mov qword [rsp + 0xf8], rbp
mov byte [rsp + 0xe8], bpl
xor r8d, r8d
lea rdx, [0x1800656f7]
lea rcx, [rsp + 0xe0]
call fcn.180002e60
lea r9, [rsp + 0xe0]
lea r8, [rsp + 0x130]
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x108]
call fcn.18000145c
nop
mov rdx, rax
lea rcx, [rsp + 0x328]
call fcn.18000125c
nop
cmp qword [rsp + 0x128], 0x10
jb 0x18000ef6c
mov rcx, qword [rsp + 0x110]
call fcn.180042a14
mov qword [rsp + 0x128], r13
mov qword [rsp + 0x120], rbp
mov byte [rsp + 0x110], bpl
cmp qword [rsp + 0x150], 0x10
jb 0x18000ef9c
mov rcx, qword [rsp + 0x138]
call fcn.180042a14
mov qword [rsp + 0x150], r13
mov qword [rsp + 0x148], rbp
mov byte [rsp + 0x138], bpl
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xc8], rbp
mov byte [rsp + 0xb8], bpl
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.hs_motherboard_model
lea rcx, [rsp + 0xb0]
call fcn.180002e60
nop
mov qword [rsp + 0x1f0], r13
mov qword [rsp + 0x1e8], rbp
mov byte [rsp + 0x1d8], bpl
xor r8d, r8d
lea rdx, [0x1800656f7]
lea rcx, [rsp + 0x1d0]
call fcn.180002e60
lea r9, [rsp + 0x1d0]
lea r8, [rsp + 0xb0]
mov rdx, rsi
lea rcx, [rsp + 0x180]
call fcn.18000145c
nop
mov rdx, rax
lea rcx, [rsp + 0x378]
call fcn.18000125c
nop
cmp qword [rsp + 0x1a0], 0x10
jb 0x18000f060
mov rcx, qword [rsp + 0x188]
call fcn.180042a14
mov qword [rsp + 0x1a0], r13
mov qword [rsp + 0x198], rbp
mov byte [rsp + 0x188], bpl
cmp qword [rsp + 0xd0], 0x10
jb 0x18000f090
mov rcx, qword [rsp + 0xb8]
call fcn.180042a14
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xc8], rbp
mov byte [rsp + 0xb8], bpl
cmp qword [rsp + 0x3b8], rbp
je 0x18000f4d1
cmp qword [rsp + 0x368], rbp
je 0x18000f4d1
cmp edi, ebp
je 0x18000f4d1
cmp ebx, ebp
je 0x18000f4d1
cmp qword [rsp + 0x340], rbp
je 0x18000f4d1
cmp qword [rsp + 0x390], rbp
je 0x18000f4d1
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x3a0]
call fcn.180013a2c
or rsi, 0xffffffffffffffff
cmp al, bpl
je 0x18000f186
lea r9, [rsp + 0x358]
cmp qword [rsp + 0x370], 8
cmovae r9, qword [rsp + 0x358]
lea r8, [rsp + 0x3a8]
cmp qword [rsp + 0x3c0], 8
cmovae r8, qword [rsp + 0x3a8]
lea rdx, [0x1800673a0]
lea rcx, [rsp + 0xe0]
call fcn.180038438
nop
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x300]
call fcn.180008d80
nop
cmp qword [rsp + 0x100], 8
jb 0x18000f186
mov rcx, qword [rsp + 0xe8]
call fcn.180042a14
cmp edi, ebx
je 0x18000f1d4
mov r9d, ebx
mov r8d, edi
lea rdx, [0x1800673d8]
lea rcx, [rsp + 0xe0]
call fcn.180038438
nop
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x300]
call fcn.180008d80
nop
cmp qword [rsp + 0x100], 8
jb 0x18000f1d4
mov rcx, qword [rsp + 0xe8]
call fcn.180042a14
lea rdx, [rsp + 0x378]
lea rcx, [rsp + 0x328]
call fcn.180013a2c
cmp al, bpl
je 0x18000f266
lea r9, [rsp + 0x380]
cmp qword [rsp + 0x398], 8
cmovae r9, qword [rsp + 0x380]
lea r8, [rsp + 0x330]
cmp qword [rsp + 0x348], 8
cmovae r8, qword [rsp + 0x330]
lea rdx, [0x180067418]
lea rcx, [rsp + 0xe0]
call fcn.180038438
nop
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x300]
call fcn.180008d80
nop
cmp qword [rsp + 0x100], 8
jb 0x18000f266
mov rcx, qword [rsp + 0xe8]
call fcn.180042a14
cmp qword [rsp + 0x318], rbp
je 0x18000f3b2
lea r8, [rsp + 0x308]
cmp qword [rsp + 0x320], 8
cmovae r8, qword [rsp + 0x308]
xor r9d, r9d
lea rdx, [0x180067450]
lea rcx, str.hardware_changed
call fcn.18003e08c
mov dword [rsp + 0xa8], 4
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xac]
lea r8, [0x180067130]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp eax, ebp
jne 0x18000f303
cmp dword [rsp + 0xac], 4
jne 0x18000f303
mov eax, dword [rsp + 0xd8]
jmp 0x18000f305
mov eax, ebp
cmp eax, ebp
je 0x18000f3b2
mov qword [rsp + 0x128], r12
mov qword [rsp + 0x120], rbp
mov word [rsp + 0x110], bp
lea rdx, [rsp + 0x308]
cmp qword [rsp + 0x320], 8
cmovae rdx, qword [rsp + 0x308]
or dword [rsp + 0x78], 0xffffffff
lea rax, [rsp + 0x108]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], ebp
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x58], ebp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [0x180065a10]
xor r8d, r8d
lea rcx, [0x180067450]
call fcn.1800043f0
nop
cmp qword [rsp + 0x128], 8
jb 0x18000f3b2
mov rcx, qword [rsp + 0x110]
call fcn.180042a14
nop
cmp qword [rsp + 0x398], 8
jb 0x18000f3ca
mov rcx, qword [rsp + 0x380]
call fcn.180042a14
mov qword [rsp + 0x398], r12
mov qword [rsp + 0x390], rbp
mov word [rsp + 0x380], bp
cmp qword [rsp + 0x348], 8
jb 0x18000f3fa
mov rcx, qword [rsp + 0x330]
call fcn.180042a14
mov qword [rsp + 0x348], r12
mov qword [rsp + 0x340], rbp
mov word [rsp + 0x330], bp
cmp qword [rsp + 0x370], 8
jb 0x18000f42a
mov rcx, qword [rsp + 0x358]
call fcn.180042a14
mov qword [rsp + 0x370], r12
mov qword [rsp + 0x368], rbp
mov word [rsp + 0x358], bp
cmp qword [rsp + 0x3c0], 8
jb 0x18000f45a
mov rcx, qword [rsp + 0x3a8]
call fcn.180042a14
mov qword [rsp + 0x3c0], r12
mov qword [rsp + 0x3b8], rbp
mov word [rsp + 0x3a8], bp
cmp qword [rsp + 0x320], 8
jb 0x18000f48a
mov rcx, qword [rsp + 0x308]
call fcn.180042a14
mov qword [rsp + 0x320], r12
mov qword [rsp + 0x318], rbp
mov word [rsp + 0x308], bp
lea rcx, [rsp + 0x158]
call fcn.180027f1c
nop
cmp qword [rsp + 0x3e8], 8
jb 0x18000f5e7
mov rcx, qword [rsp + 0x3d0]
call fcn.180042a14
jmp 0x18000f5e7
cmp qword [rsp + 0x398], 8
jb 0x18000f4e9
mov rcx, qword [rsp + 0x380]
call fcn.180042a14
mov qword [rsp + 0x398], r12
mov qword [rsp + 0x390], rbp
mov word [rsp + 0x380], bp
cmp qword [rsp + 0x348], 8
jb 0x18000f519
mov rcx, qword [rsp + 0x330]
call fcn.180042a14
mov qword [rsp + 0x348], r12
mov qword [rsp + 0x340], rbp
mov word [rsp + 0x330], bp
cmp qword [rsp + 0x370], 8
jb 0x18000f549
mov rcx, qword [rsp + 0x358]
call fcn.180042a14
mov qword [rsp + 0x370], r12
mov qword [rsp + 0x368], rbp
mov word [rsp + 0x358], bp
cmp qword [rsp + 0x3c0], 8
jb 0x18000f579
mov rcx, qword [rsp + 0x3a8]
call fcn.180042a14
mov qword [rsp + 0x3c0], r12
mov qword [rsp + 0x3b8], rbp
mov word [rsp + 0x3a8], bp
cmp qword [rsp + 0x320], 8
jb 0x18000f5a9
mov rcx, qword [rsp + 0x308]
call fcn.180042a14
mov qword [rsp + 0x320], r12
mov qword [rsp + 0x318], rbp
mov word [rsp + 0x308], bp
lea rcx, [rsp + 0x158]
call fcn.180027f1c
nop
cmp qword [rsp + 0x3e8], 8
jb 0x18000f5e7
mov rcx, qword [rsp + 0x3d0]
call fcn.180042a14
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.1800423f0
lea r11, [rsp + 0x400]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret