Function at 0x18001001c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
sub rsp, 0x400
mov qword [rsp + 0x1f8], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
mov rsi, rcx
lea r9, str.lastHardwareSummary
lea r8, str.SoftwareWOW6432Nodeprojonepodlp_smpcache_
mov rdx, 0xffffffff80000002
lea rcx, [r11 - 0x50]
call fcn.180039fd0
nop
xor ebp, ebp
cmp qword [rsp + 0x3e0], rbp
jne 0x1800100a4
cmp qword [rsp + 0x3e8], 8
jb 0x180010bf3
mov rcx, qword [rsp + 0x3d0]
call fcn.180048114
jmp 0x180010bf3
and dword [rsp + 0x160], 0xfffffe00
mov qword [rsp + 0x168], rbp
mov qword [rsp + 0x170], rbp
mov qword [rsp + 0x178], rbp
lea rdx, [rsp + 0x3c8]
lea rcx, [rsp + 0xe0]
call fcn.180001328
mov rbx, rax
lea rcx, [rsp + 0x200]
call fcn.180023a40
nop
mov r9b, 1
lea r8, [rsp + 0x158]
mov rdx, rbx
mov rcx, rax
call fcn.180023b44
nop
lea rcx, [rsp + 0x200]
call fcn.180028204
nop
cmp qword [rsp + 0x100], 0x10
jb 0x18001012a
mov rcx, qword [rsp + 0xe8]
call fcn.180048114
mov r12d, 7
cmp byte [rsp + 0x160], r12b
je 0x180010169
lea rcx, [rsp + 0x158]
call fcn.1800292a4
nop
cmp qword [rsp + 0x3e8], 8
jb 0x180010bf3
mov rcx, qword [rsp + 0x3d0]
call fcn.180048114
jmp 0x180010bf3
mov qword [rsp + 0x320], r12
mov qword [rsp + 0x318], rbp
mov word [rsp + 0x308], bp
mov r13d, sendto
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x98], rbp
mov byte [rsp + 0x88], bpl
lea ebx, [r13 - 3]
mov r8, rbx
lea rdx, str.hs_cpu_model
lea rcx, [rsp + 0x80]
call fcn.180002ed4
nop
mov qword [rsp + 0x128], r13
mov qword [rsp + 0x120], rbp
mov byte [rsp + 0x110], bpl
xor r8d, r8d
lea rdx, [0x18006c857]
lea rcx, [rsp + 0x108]
call fcn.180002ed4
lea r9, [rsp + 0x108]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x130]
call fcn.1800014a0
nop
mov rdx, rax
lea rcx, [rsp + 0x3a0]
call fcn.1800012a0
nop
cmp qword [rsp + 0x150], 0x10
jb 0x180010239
mov rcx, qword [rsp + 0x138]
call fcn.180048114
mov qword [rsp + 0x150], r13
mov qword [rsp + 0x148], rbp
mov byte [rsp + 0x138], bpl
cmp qword [rsp + 0xa0], 0x10
jb 0x180010269
mov rcx, qword [rsp + 0x88]
call fcn.180048114
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x98], rbp
mov byte [rsp + 0x88], bpl
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xc8], rbp
mov byte [rsp + 0xb8], bpl
mov r8, rbx
lea rdx, str.hs_cpu_model
lea rcx, [rsp + 0xb0]
call fcn.180002ed4
nop
mov qword [rsp + 0x1f0], r13
mov qword [rsp + 0x1e8], rbp
mov byte [rsp + 0x1d8], bpl
xor r8d, r8d
lea rdx, [0x18006c857]
lea rcx, [rsp + 0x1d0]
call fcn.180002ed4
lea r9, [rsp + 0x1d0]
lea r8, [rsp + 0xb0]
mov rdx, rsi
lea rcx, [rsp + 0x180]
call fcn.1800014a0
nop
mov rdx, rax
lea rcx, [rsp + 0x350]
call fcn.1800012a0
nop
cmp qword [rsp + 0x1a0], 0x10
jb 0x18001032a
mov rcx, qword [rsp + 0x188]
call fcn.180048114
mov qword [rsp + 0x1a0], r13
mov qword [rsp + 0x198], rbp
mov byte [rsp + 0x188], bpl
cmp qword [rsp + 0xd0], 0x10
jb 0x18001035a
mov rcx, qword [rsp + 0xb8]
call fcn.180048114
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xc8], rbp
mov byte [rsp + 0xb8], bpl
mov qword [rsp + 0x1c8], r13
mov qword [rsp + 0x1c0], rbp
mov byte [rsp + 0x1b0], bpl
mov ebx, reloc.WS2_32.dll_ntohl
mov r8, rbx
lea rdx, str.hs_memory_size
lea rcx, [rsp + 0x1a8]
call fcn.180002ed4
nop
cmp byte [rsp + 0x160], r12b
jne 0x1800103f4
lea rdx, [rsp + 0x1a8]
lea rcx, [rsp + 0x158]
call fcn.18002a5d0
mov rcx, rax
call fcn.18002a90c
cmp al, bpl
je 0x1800103f4
lea rdx, [rsp + 0x1a8]
lea rcx, [rsp + 0x158]
call fcn.18002a5d0
mov rcx, rax
call fcn.180029604
mov edi, eax
jmp 0x1800103f6
mov edi, ebp
cmp qword [rsp + 0x1c8], 0x10
jb 0x18001040e
mov rcx, qword [rsp + 0x1b0]
call fcn.180048114
mov qword [rsp + 0x1c8], r13
mov qword [rsp + 0x1c0], rbp
mov byte [rsp + 0x1b0], bpl
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x98], rbp
mov byte [rsp + 0x88], bpl
mov r8, rbx
lea rdx, str.hs_memory_size
lea rcx, [rsp + 0x80]
call fcn.180002ed4
nop
cmp byte [rsi + 8], r12b
jne 0x180010495
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.18002a5d0
mov rcx, rax
call fcn.18002a90c
cmp al, bpl
je 0x180010495
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.18002a5d0
mov rcx, rax
call fcn.180029604
mov ebx, eax
jmp 0x180010497
mov ebx, ebp
cmp qword [rsp + 0xa0], 0x10
jb 0x1800104af
mov rcx, qword [rsp + 0x88]
call fcn.180048114
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x98], rbp
mov byte [rsp + 0x88], bpl
mov qword [rsp + 0x150], r13
mov qword [rsp + 0x148], rbp
mov byte [rsp + 0x138], bpl
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.hs_motherboard_model
lea rcx, [rsp + 0x130]
call fcn.180002ed4
nop
mov qword [rsp + 0x100], r13
mov qword [rsp + 0xf8], rbp
mov byte [rsp + 0xe8], bpl
xor r8d, r8d
lea rdx, [0x18006c857]
lea rcx, [rsp + 0xe0]
call fcn.180002ed4
lea r9, [rsp + 0xe0]
lea r8, [rsp + 0x130]
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x108]
call fcn.1800014a0
nop
mov rdx, rax
lea rcx, [rsp + 0x328]
call fcn.1800012a0
nop
cmp qword [rsp + 0x128], 0x10
jb 0x180010578
mov rcx, qword [rsp + 0x110]
call fcn.180048114
mov qword [rsp + 0x128], r13
mov qword [rsp + 0x120], rbp
mov byte [rsp + 0x110], bpl
cmp qword [rsp + 0x150], 0x10
jb 0x1800105a8
mov rcx, qword [rsp + 0x138]
call fcn.180048114
mov qword [rsp + 0x150], r13
mov qword [rsp + 0x148], rbp
mov byte [rsp + 0x138], bpl
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xc8], rbp
mov byte [rsp + 0xb8], bpl
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.hs_motherboard_model
lea rcx, [rsp + 0xb0]
call fcn.180002ed4
nop
mov qword [rsp + 0x1f0], r13
mov qword [rsp + 0x1e8], rbp
mov byte [rsp + 0x1d8], bpl
xor r8d, r8d
lea rdx, [0x18006c857]
lea rcx, [rsp + 0x1d0]
call fcn.180002ed4
lea r9, [rsp + 0x1d0]
lea r8, [rsp + 0xb0]
mov rdx, rsi
lea rcx, [rsp + 0x180]
call fcn.1800014a0
nop
mov rdx, rax
lea rcx, [rsp + 0x378]
call fcn.1800012a0
nop
cmp qword [rsp + 0x1a0], 0x10
jb 0x18001066c
mov rcx, qword [rsp + 0x188]
call fcn.180048114
mov qword [rsp + 0x1a0], r13
mov qword [rsp + 0x198], rbp
mov byte [rsp + 0x188], bpl
cmp qword [rsp + 0xd0], 0x10
jb 0x18001069c
mov rcx, qword [rsp + 0xb8]
call fcn.180048114
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xc8], rbp
mov byte [rsp + 0xb8], bpl
cmp qword [rsp + 0x3b8], rbp
je 0x180010add
cmp qword [rsp + 0x368], rbp
je 0x180010add
cmp edi, ebp
je 0x180010add
cmp ebx, ebp
je 0x180010add
cmp qword [rsp + 0x340], rbp
je 0x180010add
cmp qword [rsp + 0x390], rbp
je 0x180010add
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x3a0]
call fcn.18001500c
or rsi, 0xffffffffffffffff
cmp al, bpl
je 0x180010792
lea r9, [rsp + 0x358]
cmp qword [rsp + 0x370], 8
cmovae r9, qword [rsp + 0x358]
lea r8, [rsp + 0x3a8]
cmp qword [rsp + 0x3c0], 8
cmovae r8, qword [rsp + 0x3a8]
lea rdx, [0x18006ecc0]
lea rcx, [rsp + 0xe0]
call fcn.180039d40
nop
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x300]
call fcn.180008e20
nop
cmp qword [rsp + 0x100], 8
jb 0x180010792
mov rcx, qword [rsp + 0xe8]
call fcn.180048114
cmp edi, ebx
je 0x1800107e0
mov r9d, ebx
mov r8d, edi
lea rdx, [0x18006ecf8]
lea rcx, [rsp + 0xe0]
call fcn.180039d40
nop
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x300]
call fcn.180008e20
nop
cmp qword [rsp + 0x100], 8
jb 0x1800107e0
mov rcx, qword [rsp + 0xe8]
call fcn.180048114
lea rdx, [rsp + 0x378]
lea rcx, [rsp + 0x328]
call fcn.18001500c
cmp al, bpl
je 0x180010872
lea r9, [rsp + 0x380]
cmp qword [rsp + 0x398], 8
cmovae r9, qword [rsp + 0x380]
lea r8, [rsp + 0x330]
cmp qword [rsp + 0x348], 8
cmovae r8, qword [rsp + 0x330]
lea rdx, [0x18006ed38]
lea rcx, [rsp + 0xe0]
call fcn.180039d40
nop
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x300]
call fcn.180008e20
nop
cmp qword [rsp + 0x100], 8
jb 0x180010872
mov rcx, qword [rsp + 0xe8]
call fcn.180048114
cmp qword [rsp + 0x318], rbp
je 0x1800109be
lea r8, [rsp + 0x308]
cmp qword [rsp + 0x320], 8
cmovae r8, qword [rsp + 0x308]
xor r9d, r9d
lea rdx, [0x18006ed70]
lea rcx, str.hardware_changed
call fcn.180042bec
mov dword [rsp + 0xa8], 4
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xac]
lea r8, [0x18006ea50]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp eax, ebp
jne 0x18001090f
cmp dword [rsp + 0xac], 4
jne 0x18001090f
mov eax, dword [rsp + 0xd8]
jmp 0x180010911
mov eax, ebp
cmp eax, ebp
je 0x1800109be
mov qword [rsp + 0x128], r12
mov qword [rsp + 0x120], rbp
mov word [rsp + 0x110], bp
lea rdx, [rsp + 0x308]
cmp qword [rsp + 0x320], 8
cmovae rdx, qword [rsp + 0x308]
or dword [rsp + 0x78], 0xffffffff
lea rax, [rsp + 0x108]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], ebp
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x58], ebp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [0x18006cb70]
xor r8d, r8d
lea rcx, [0x18006ed70]
call fcn.1800044d8
nop
cmp qword [rsp + 0x128], 8
jb 0x1800109be
mov rcx, qword [rsp + 0x110]
call fcn.180048114
nop
cmp qword [rsp + 0x398], 8
jb 0x1800109d6
mov rcx, qword [rsp + 0x380]
call fcn.180048114
mov qword [rsp + 0x398], r12
mov qword [rsp + 0x390], rbp
mov word [rsp + 0x380], bp
cmp qword [rsp + 0x348], 8
jb 0x180010a06
mov rcx, qword [rsp + 0x330]
call fcn.180048114
mov qword [rsp + 0x348], r12
mov qword [rsp + 0x340], rbp
mov word [rsp + 0x330], bp
cmp qword [rsp + 0x370], 8
jb 0x180010a36
mov rcx, qword [rsp + 0x358]
call fcn.180048114
mov qword [rsp + 0x370], r12
mov qword [rsp + 0x368], rbp
mov word [rsp + 0x358], bp
cmp qword [rsp + 0x3c0], 8
jb 0x180010a66
mov rcx, qword [rsp + 0x3a8]
call fcn.180048114
mov qword [rsp + 0x3c0], r12
mov qword [rsp + 0x3b8], rbp
mov word [rsp + 0x3a8], bp
cmp qword [rsp + 0x320], 8
jb 0x180010a96
mov rcx, qword [rsp + 0x308]
call fcn.180048114
mov qword [rsp + 0x320], r12
mov qword [rsp + 0x318], rbp
mov word [rsp + 0x308], bp
lea rcx, [rsp + 0x158]
call fcn.1800292a4
nop
cmp qword [rsp + 0x3e8], 8
jb 0x180010bf3
mov rcx, qword [rsp + 0x3d0]
call fcn.180048114
jmp 0x180010bf3
cmp qword [rsp + 0x398], 8
jb 0x180010af5
mov rcx, qword [rsp + 0x380]
call fcn.180048114
mov qword [rsp + 0x398], r12
mov qword [rsp + 0x390], rbp
mov word [rsp + 0x380], bp
cmp qword [rsp + 0x348], 8
jb 0x180010b25
mov rcx, qword [rsp + 0x330]
call fcn.180048114
mov qword [rsp + 0x348], r12
mov qword [rsp + 0x340], rbp
mov word [rsp + 0x330], bp
cmp qword [rsp + 0x370], 8
jb 0x180010b55
mov rcx, qword [rsp + 0x358]
call fcn.180048114
mov qword [rsp + 0x370], r12
mov qword [rsp + 0x368], rbp
mov word [rsp + 0x358], bp
cmp qword [rsp + 0x3c0], 8
jb 0x180010b85
mov rcx, qword [rsp + 0x3a8]
call fcn.180048114
mov qword [rsp + 0x3c0], r12
mov qword [rsp + 0x3b8], rbp
mov word [rsp + 0x3a8], bp
cmp qword [rsp + 0x320], 8
jb 0x180010bb5
mov rcx, qword [rsp + 0x308]
call fcn.180048114
mov qword [rsp + 0x320], r12
mov qword [rsp + 0x318], rbp
mov word [rsp + 0x308], bp
lea rcx, [rsp + 0x158]
call fcn.1800292a4
nop
cmp qword [rsp + 0x3e8], 8
jb 0x180010bf3
mov rcx, qword [rsp + 0x3d0]
call fcn.180048114
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.180047b20
lea r11, [rsp + 0x400]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret