Function at 0x180028ac0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x78]
sub rsp, 0x140
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
mov rax, qword [0x1800a3d18]
xor rax, rsp
mov qword [rbp], rax
mov r13, qword [rbp - 0x70]
lea r14d, [rdx + 0xe9c]
xor r12d, r12d
mov qword [rbp - 0x78], r8
mov qword [rsp + 0x60], r9
mov r11, r8
mov dword [rsp + 0x48], edx
mov r10, r9
mov qword [rbp - 0x60], r13
mov r8d, edx
mov r15, rcx
mov edi, edx
cmp edx, r14d
jae 0x180028e65
mov rax, qword [rbp - 0x70]
lea ecx, [r12 + 0x65]
mov rsi, qword [rbp - 0x38]
lea edx, [rcx - 1]
mov qword [rsp + 0x50], rax
lea r8d, [r12 + 0x55]
lea r9d, [r12 + 0x6e]
nop dword [rax]
cmp edi, 0x1d4
ja 0x180028d04
je 0x180028cea
cmp edi, 0x114
ja 0x180028c97
je 0x180028c8e
mov eax, edi
sub eax, 0x1e
je 0x180028c86
sub eax, 0x68
je 0x180028c7a
sub eax, 0x34
je 0x180028bf8
sub eax, 0xa
je 0x180028bd4
cmp eax, 0x15
jne 0x180028e39
cmp dword [r11], 0x65
jne 0x180028e39
mov rax, qword [rsi + 0x568]
lea rdx, str._d__.s
mov r9d, dword [rsi + 0x570]
mov r8d, dword [rsi + 0x40]
mov rcx, qword [r10 + 0xa0]
mov qword [rsp + 0x20], rax
call fcn.18008ea20
jmp 0x180028e27
mov eax, 0x1e
nop dword [rax]
cmp eax, 0x1e
je 0x180028e52
add eax, 0x7a
cmp eax, 0x98
jb 0x180028be0
jmp 0x180028e39
mov r8, r11
mov rax, r10
sub r8, r10
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180028c14
inc rax
test ecx, ecx
jne 0x180028c01
test edx, edx
je 0x180028e2d
mov ebx, 0xf9
mov eax, ebx
sub eax, 0xf8
je 0x180028fdc
cmp eax, 1
jne 0x180028c6b
lea rax, [rsp + 0x78]
mov dword [rsp + 0x78], 0xffffffff
mov qword [rsp + 0x28], rax
mov r9d, StrCmpICA
mov r8, r11
mov qword [rsp + 0x20], r12
xor edx, edx
mov rcx, r10
call fcn.1800325a0
mov r10, qword [rsp + 0x60]
mov r11, qword [rbp - 0x78]
mov dword [rsp + 0x70], r12d
dec ebx
cmp ebx, 0xf7
ja 0x180028c21
jmp 0x180028e27
mov r13, r12
mov qword [rbp - 0x60], r12
jmp 0x180028e39
mov rsi, r15
jmp 0x180028e39
mov qword [r10 + 0x10], r12
jmp 0x180028e39
mov eax, edi
sub eax, 0x119
je 0x180028cdb
sub eax, 0x28
je 0x180028ccd
sub eax, 0x34
je 0x180028cc0
cmp eax, 0x5a
jne 0x180028e39
mov qword [r10 + 0x18], r12
mov qword [r10 + 0x20], r12
jmp 0x180028e39
mov dword [rsp + 0x70], 1
jmp 0x180028e39
mov qword [rbp - 0x68], r12
mov qword [rsp + 0x50], r12
jmp 0x180028e39
mov word [rbp - 0x20], r8w
mov word [rbp - 0x1f], r9w
jmp 0x180028e39
movzx eax, word [0x180094a60]
mov word [rbp - 0x1e], ax
movzx eax, byte [0x180094a62]
mov byte [rbp - 0x1c], al
jmp 0x180028e39
cmp edi, 0x34a
ja 0x180028d60
je 0x180028d57
mov eax, edi
sub eax, 0x1fc
je 0x180028e39
sub eax, 0x8e
je 0x180028d4a
sub eax, 5
je 0x180028d41
cmp eax, 0x28
jne 0x180028e39
lea rcx, str.EUserUploadMode
call fcn.18008e9c0
jmp 0x180028e27
mov word [rbp - 0x1c], cx
jmp 0x180028e39
mov dword [r10 + 0x28], r12d
mov qword [r10 + 0x30], r12
jmp 0x180028e39
mov word [rbp - 0x1b], dx
jmp 0x180028e39
mov eax, edi
sub eax, 0x372
je 0x180028dd4
sub eax, 0x93
je 0x180028dcc
sub eax, 0x28
je 0x180028da3
cmp eax, 0x93
jne 0x180028e39
mov r8d, 1
lea rdx, [0x180094a64]
lea rcx, [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov dword [rbp - 0x18], 0x632057
jmp 0x180028e27
mov rax, qword [r11 + 8]
xor r9d, r9d
mov qword [rsp + 0x28], r12
xor r8d, r8d
mov edx, 0xd5
mov qword [rsp + 0x20], rax
xor ecx, ecx
call fcn.18006a570
mov r13, rax
mov qword [rbp - 0x60], rax
jmp 0x180028e27
mov word [rbp - 0x1a], 0x20
jmp 0x180028e39
cmp dword [r10], 4
jge 0x180028e39
mov ebx, 0x5b
nop
mov eax, ebx
sub eax, 0x58
je 0x180028e5d
sub eax, 1
je 0x180028e14
sub eax, 1
je 0x180028dff
cmp eax, 1
jne 0x180028e20
lea rcx, str.get_TypeSymbolCount
jmp 0x180028e1b
lea rcx, str._AdobeCommon_Installersuninstall
call fcn.18008e9c0
lea rcx, str.Check_failed:__rand_int_cb.is_null__.
jmp 0x180028e1b
lea rcx, str._1_:_providerAccountRegistration_is_null
call fcn.18008e9c0
dec ebx
cmp ebx, 0x57
ja 0x180028de0
mov r9d, 0x6e
mov ecx, 0x65
lea edx, [rcx - 1]
lea r8d, [rcx - 0x10]
mov r10, qword [rsp + 0x60]
add edi, 0xbb
cmp edi, r14d
jae 0x180028e70
mov r11, qword [rbp - 0x78]
jmp 0x180028b50
cmp dword [r10], 0xff
setbe r12b
mov eax, r12d
jmp 0x180028fe0
mov rsi, qword [rbp - 0x70]
mov qword [rsp + 0x50], rsi
jmp 0x180028e7a
mov rsi, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x48]
lea eax, [r8 + 0x794]
mov dword [rsp + 0x40], eax
cmp r8d, eax
jae 0x180028fdc
movzx ecx, byte [rsp + 0x58]
mov r15d, 0x61
movzx edx, word [rsp + 0x58]
movsd xmm8, qword [rsp + 0x50]
movsd xmm7, qword [rsp + 0x50]
mov r14d, dword [rbp - 0x80]
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x78], edx
lea r9, [0x180000000]
mov r11d, 0x52
cmp r8d, 0x23c
ja 0x180029554
je 0x180029509
cmp r8d, 0x148
ja 0x18002916c
je 0x180029079
mov eax, r8d
sub eax, 0x86
je 0x180028fc4
sub eax, 0x34
je 0x180028fdc
sub eax, 0x2d
je 0x180028f40
sub eax, 0x2d
je 0x180028f37
cmp eax, 5
jne 0x180029505
lea r8d, [r11 - 0x4f]
lea rdx, [0x180094a68]
lea rcx, [rbp - 0x15]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov ecx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
jmp 0x180029500
mov qword [r10 + 0x38], r12
jmp 0x180029505
test r14d, r14d
jne 0x180029505
mov ebx, 0xec
nop
cmp ebx, 0xec
je 0x180028f67
cmp ebx, 0x2a68
jne 0x180028fa8
mov eax, 0xffffffff
jmp 0x180028fe0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.BuildModuleInfo__MODULELOADEVENT32_
mov rax, qword [rbp - 0x78]
mov r8, qword [rax + 0x10]
call fcn.18008e110
mov r9d, 0x3e
mov qword [rsp + 0x58], r13
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.18008d340
add ebx, 0x297c
cmp ebx, 0x52f8
jbe 0x180028f50
mov ecx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
jmp 0x180029500
test r13, r13
jne 0x180029047
mov ebx, 0x1b
nop
mov eax, ebx
sub eax, 0x1b
je 0x180029016
cmp eax, 1
jne 0x180029040
mov eax, dword [rsp + 0x70]
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.18008f350
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.HillClimbing_MaxSampleErrorPercent
mov rax, qword [rbp - 0x78]
mov r8, qword [rax + 8]
call fcn.18008e110
mov dword [rsp + 0x70], 0xffffffff
inc ebx
cmp ebx, 0x1d
jb 0x180028fd0
mov rax, qword [rbp - 0x78]
lea r9, [rbp - 0x68]
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x80], r13
mov ecx, 0x8d
mov r8, qword [rax + 0x10]
call fcn.18006fba0
mov ecx, dword [rsp + 0x44]
mov r14d, eax
mov r8d, dword [rsp + 0x48]
mov dword [rbp - 0x80], eax
jmp 0x180029500
mov edi, r12d
cmp dword [r13 + 0x10], r12d
jle 0x1800290cd
mov rbx, r12
nop word [rax + rax]
mov rax, qword [r13 + 0x18]
lea r8, [rbp - 0x28]
mov r9d, 0x5d
xor edx, edx
mov rcx, qword [rbx + rax]
mov qword [rbp - 0x28], rcx
xor ecx, ecx
call fcn.18001b5b0
inc edi
lea rbx, [rbx + 8]
cmp edi, dword [r13 + 0x10]
jl 0x180029090
mov r10, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x44]
mov eax, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x48]
mov esi, 3
cmp dword [r10], esi
jle 0x180029509
mov rdi, qword [rbp - 0x78]
add rdi, 0x18
mov ebx, 0xa0
cmp ebx, 0xa0
jne 0x180029140
mov r8, qword [rdi]
lea rdx, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x58], r13
lea ecx, [rbx - 0x34]
mov qword [rsp + 0x20], r12
call fcn.180031600
test rax, rax
je 0x180029140
mov qword [rsp + 0x38], r12
lea r8d, [rbx - 0xb]
mov qword [rsp + 0x58], rax
xor r9d, r9d
lea rax, [rsp + 0x58]
xor edx, edx
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call fcn.180020530
add ebx, 0x8e
cmp ebx, 0x12e
jb 0x1800290e8
mov r10, qword [rsp + 0x60]
inc esi
add rdi, 8
cmp esi, dword [r10]
jl 0x1800290e3
mov ecx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
jmp 0x180029505
mov eax, r8d
sub eax, 0x17a
je 0x180029525
sub eax, 0x2f
je 0x1800291cf
sub eax, 0x32
je 0x1800291c4
cmp eax, 0x2f
jne 0x180029505
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r9d, 0x3e
mov qword [rsp + 0x58], r13
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.18008d340
mov ecx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
jmp 0x180029500
mov cl, 1
mov dword [rsp + 0x44], ecx
jmp 0x180029505
movsxd rdi, r14d
mov r15, r12
test r14d, r14d
jle 0x1800294bc
nop
mov r14d, 0x12
cmp r14d, 0x12
je 0x18002947b
cmp r14d, 0x762
je 0x180029463
cmp r14d, 0xeb2
je 0x180029224
cmp r14d, 0x1602
jne 0x180029483
lea rcx, [0x180094650]
call fcn.18008e9c0
jmp 0x180029483
lea r9, [rsp + 0x50]
mov dword [rsp + 0x58], r12d
lea r8, [rsp + 0x58]
mov qword [rsp + 0x50], r13
xor edx, edx
mov ecx, 0xe5
call fcn.180068a00
mov edi, r12d
cmp dword [rsi + 0x28], r12d
jle 0x180029483
mov ebx, StrCmpICA
nop word [rax + rax]
cmp ebx, 0x291
ja 0x180029359
je 0x18002931f
cmp ebx, 0x99
je 0x1800292e5
cmp ebx, 0x141
je 0x1800292bd
cmp ebx, 0x1e9
jne 0x180029444
mov r9d, 0xca
mov qword [rsp + 0x50], r13
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.180025ee0
mov qword [rsp + 0x50], rax
movsd xmm7, qword [rsp + 0x50]
jmp 0x180029444
mov qword [rsp + 0x28], r12
lea r8, [rsp + 0x50]
mov r9d, 0xcc
mov qword [rsp + 0x20], r12
xor edx, edx
mov qword [rsp + 0x50], r13
xor ecx, ecx
call fcn.180053dd0
jmp 0x180029444
lea rax, [rsp + 0x58]
mov byte [rsp + 0x58], 1
mov r9d, 0x15
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x40]
mov qword [rbp - 0x40], r13
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], edi
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x68], rsi
call fcn.1800555c0
jmp 0x180029444
lea rax, [rsp + 0x58]
mov byte [rsp + 0x58], 2
mov r9d, 0x15
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x68]
mov qword [rsp + 0x68], r13
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], edi
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x40], rsi
call fcn.1800555c0
jmp 0x180029444
cmp ebx, 0x339
je 0x1800293f6
cmp ebx, 0x3e1
je 0x1800293b7
cmp ebx, 0x489
jne 0x180029444
lea r8, [rsp + 0x68]
mov qword [rsp + 0x68], r13
mov edx, 0x107
xor ecx, ecx
call fcn.18003dc20
lea r9, [rsp + 0x68]
mov dword [rsp + 0x50], 1
lea r8, [rsp + 0x50]
mov qword [rsp + 0x68], r13
xor edx, edx
mov ecx, 0xe5
call fcn.180068a00
jmp 0x180029444
movaps xmm0, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll_log
movaps xmm6, xmm0
movaps xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_log
subsd xmm6, xmm0
movaps xmm2, xmm8
movq r8, xmm2
lea rcx, str._g__g__g_n
movaps xmm1, xmm7
movq rdx, xmm7
movaps xmm3, xmm6
movq r9, xmm6
call fcn.18008e9c0
jmp 0x180029444
mov qword [rsp + 0x28], r12
lea r8, [rsp + 0x68]
mov r9d, 0xcc
mov qword [rsp + 0x20], r12
xor edx, edx
mov qword [rsp + 0x68], r13
xor ecx, ecx
call fcn.180053dd0
mov r9d, 0xca
mov qword [rsp + 0x68], r13
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.180025ee0
mov qword [rsp + 0x50], rax
movsd xmm8, qword [rsp + 0x50]
add ebx, 0xa8
cmp ebx, 0x531
jb 0x180029260
inc edi
cmp edi, dword [rsi + 0x28]
jl 0x180029251
jmp 0x180029483
lea r8, [rsp + 0x68]
mov qword [rsp + 0x68], r13
mov edx, 0x107
xor ecx, ecx
call fcn.18003dc20
jmp 0x180029483
mov rax, qword [rbp - 0x68]
mov rsi, qword [rax + r15*8]
add r14d, 0x750
cmp r14d, 0x1d40
jbe 0x1800291e6
movsxd rax, dword [rbp - 0x80]
inc r15
mov qword [rsp + 0x50], rsi
mov rdi, rax
cmp r15, rax
jl 0x1800291e0
mov r14d, dword [rbp - 0x80]
mov ecx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
mov rbx, r12
test rdi, rdi
jle 0x1800294fa
mov rax, qword [rbp - 0x68]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0xca
xor edx, edx
mov rcx, qword [rax + rbx*8]
mov qword [rbp - 0x38], rcx
lea rcx, [rbp - 0x38]
call fcn.180023eb0
inc rbx
cmp rbx, rdi
jl 0x1800294c4
mov ecx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
mov r15d, 0x61
mov r10, qword [rsp + 0x60]
mov eax, dword [rsp + 0x40]
add r8d, 0x61
mov dword [rsp + 0x48], r8d
cmp r8d, eax
jae 0x180028fdc
mov rsi, qword [rsp + 0x50]
jmp 0x180028eb7
lea rcx, [rbp - 0x20]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], r12b
lea rcx, [rcx + 1]
jne 0x180029530
movzx eax, word [0x180094aa4]
mov word [rcx], ax
movzx eax, byte [0x180094aa6]
mov byte [rcx + 2], al
mov ecx, dword [rsp + 0x44]
jmp 0x180029505
cmp r8d, 0x3c0
ja 0x1800295f2
je 0x1800295c8
mov eax, r8d
sub eax, 0x26b
je 0x1800295a0
sub eax, 0x32
je 0x1800295bc
sub eax, 0x61
je 0x180029505
cmp eax, 0x61
jne 0x180029505
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov r10, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
mov qword [r10 + 0x40], rax
jmp 0x180029505
mov eax, 0xb1
cmp eax, 0xb1
je 0x180028e5d
add eax, 0x601b
cmp eax, 0x601b
jbe 0x1800295a5
mov dword [rbp - 0x58], 0xf003f
jmp 0x180029505
mov edx, dword [rbp - 0x58]
lea r9, [rbp - 0x70]
xor r8d, r8d
mov dword [rsp + 0x20], r12d
lea rcx, [rbp - 0x20]
call qword [sym.imp.SHLWAPI.dll_SHRegOpenUSKeyA]
mov ecx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
mov dword [rbp - 0x48], eax
jmp 0x180029500
mov eax, r8d
sub eax, 0x421
je 0x180029727
sub eax, 0x61
je 0x180029626
sub eax, 0x61
je 0x180029618
cmp eax, 0x61
je 0x180028fdc
jmp 0x180029505
cmp qword [r10 + 0x40], r12
setne byte [rsp + 0x70]
jmp 0x180029505
test cl, cl
je 0x180029505
mov r14d, dword [rbp - 0x4c]
mov ebx, r12d
mov r13d, dword [rsp + 0x78]
mov edi, 7
nop
cmp ebx, 6
ja case.default.0x180029656
mov eax, ebx
mov ecx, dword [r9 + rax*4 + 0x2973c]
add rcx, r9
jmp rcx
mov dword [rbp - 9], 0x64656c
jmp case.default.0x180029656
mov r13d, r12d
jmp case.default.0x180029656
mov dword [rbp - 0x54], r12d
mov r14d, r12d
jmp case.default.0x180029656
mov word [rbp - 0x10], r11w
mov dword [rbp - 0xf], 0x46646165
jmp case.default.0x180029656
mov rcx, qword [rbp - 0x70]
lea rax, [rbp - 0x54]
mov dword [rsp + 0x38], r14d
lea r9, [rbp - 0x50]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x10]
lea rax, [rbp - 0x30]
movzx edx, r13w
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHRegEnumUSValueA]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.SHLWAPI.dll_SHRegCloseUSKey]
lea r9, [0x180000000]
mov r11d, 0x52
jmp case.default.0x180029656
mov eax, 0x69
mov word [rbp - 0xb], r15w
mov word [rbp - 0xa], ax
jmp case.default.0x180029656
lea rcx, [rbp - 0x10]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], r12b
jne 0x1800296f0
mov dword [rbp - 0x50], eax
inc ebx
sub rdi, 1
jne 0x180029640
mov ecx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
mov dword [rsp + 0x78], r13d
mov r13, qword [rbp - 0x60]
mov dword [rbp - 0x4c], r14d
mov r14d, dword [rbp - 0x80]
jmp 0x180029500
cmp dword [rbp - 0x48], r12d
movzx ecx, cl
cmovne ecx, r12d
mov dword [rsp + 0x44], ecx
jmp 0x180029505