Function at 0x18f9258
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
xor r15d, r15d
mov r13, rcx
cmp qword [rcx], r15
mov r14, r15
jne 0x18f92b6
mov rcx, qword [0x01965a38]
lea rbp, [0x01965a38]
cmp rcx, rbp
je 0x18f92ac
bt dword [rcx + 0x1c], 8
jae 0x18f92ac
mov rcx, qword [rcx + 0x10]
lea r9, [0x018e6a00]
lea r8, [0x018e4500]
mov dx, 0x11
call fcn.018ec120
mov esi, 0x80004003
jmp 0x18f96b5
lea rdx, [0x018e4510]
lea rcx, [rsp + 0xd8]
call fcn.018f8588
lea rdx, [0x018e6098]
lea rcx, [rsp + 0xd8]
call fcn.018fb0f8
cmp dword [r13 + 8], r15d
lea rax, [0x018e4558]
lea rdx, [0x018e4568]
cmovne rdx, rax
or rbp, 0xffffffffffffffff
cmp rdx, r15
jne 0x18f9302
mov ecx, r15d
jmp 0x18f9314
xor eax, eax
mov rcx, rbp
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
lea rcx, [rsp + 0xd8]
call fcn.018fb2d0
lea rdx, [0x018e6098]
lea rcx, [rsp + 0xd8]
call fcn.018fb0f8
mov rdx, qword [r13 + 0xb8]
lea rax, [0x018e4580]
cmp dword [rdx + 0x340], 2
lea r9, [0x018e4578]
cmove r9, rax
cmp r9, r15
jne 0x18f9362
mov ecx, r15d
jmp 0x18f9374
xor eax, eax
mov rcx, rbp
mov rdi, r9
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
lea rcx, [rsp + 0xd8]
mov rdx, r9
call fcn.018fb2d0
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [r13]
lea rax, [rsp + 0x60]
mov rdx, rbx
mov r9d, 0x20019
xor r8d, r8d
mov rdi, r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r15d
mov r12d, eax
jne 0x18f93c7
mov rdi, qword [rsp + 0x60]
mov r12d, r15d
cmp r12d, 2
jne 0x18f93f2
cmp rdi, r15
lea esi, [r12 - 1]
je 0x18f93e0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, ebp
jmp 0x18f96a7
cmp r12d, r15d
je 0x18f9431
mov rcx, qword [0x01965a38]
lea rbp, [0x01965a38]
cmp rcx, rbp
je 0x18f9677
bt dword [rcx + 0x1c], 0x16
jae 0x18f9677
cmp byte [rcx + 0x19], 2
jb 0x18f9677
mov dword [rsp + 0x20], r12d
mov dx, 0x12
jmp 0x18f9664
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xc8], r15d
mov dword [rsp + 0xc0], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, r15d
mov esi, eax
je 0x18f94e1
mov rcx, qword [0x01965a38]
lea rbp, [0x01965a38]
cmp rcx, rbp
je 0x18f94cc
bt dword [rcx + 0x1c], 0x16
jae 0x18f94cc
cmp byte [rcx + 0x19], 2
jb 0x18f94cc
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4500]
mov r9, rbx
mov dx, 0x13
mov dword [rsp + 0x20], eax
call fcn.018f88c0
movzx eax, si
or eax, 0x80070000
cmp esi, r15d
cmovle eax, esi
mov esi, eax
jmp 0x18f9688
mov ecx, dword [rsp + 0xc0]
mov eax, 2
add ecx, 1
mul rcx
cmovo rax, rbp
mov rcx, rax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
cmp rax, r15
mov r14, rax
jne 0x18f952f
cmp rdi, r15
mov esi, 0x8007000e
je 0x18f951a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbx - 0x18]
mov ecx, ebp
lock xadd dword [rdx + 0x10], ecx
add ecx, ebp
cmp ecx, r15d
jmp 0x18f96aa
cmp dword [rsp + 0xc8], r15d
mov ebp, r15d
jbe 0x18f9688
cmp esi, r15d
jne 0x18f9688
mov eax, dword [rsp + 0xc0]
lea r9, [rsp + 0xd0]
mov r8, r14
add eax, eax
mov edx, ebp
mov rcx, rdi
mov dword [rsp + 0xd0], eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, r15d
mov r12d, eax
jne 0x18f963c
mov r8, r14
mov rdx, rdi
mov rcx, r13
call fcn.018f96d8
cmp eax, r15d
mov esi, eax
jl 0x18f95ba
add ebp, 1
cmp ebp, dword [rsp + 0xc8]
jb 0x18f9540
jmp 0x18f9688
cmp eax, 0x800401f3
lea rbp, [0x01965a38]
jne 0x18f9601
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x18f9688
bt dword [rcx + 0x1c], 0x16
jae 0x18f9608
cmp byte [rcx + 0x19], 2
jb 0x18f9608
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4500]
mov r9, r14
mov dx, 0x15
mov qword [rsp + 0x20], rbx
call fcn.018f895c
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x18f9688
bt dword [rcx + 0x1c], 0x16
jae 0x18f9688
cmp byte [rcx + 0x19], 2
jb 0x18f9688
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4500]
mov r9, rbx
mov dx, 0x16
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
call fcn.018f8a44
jmp 0x18f9688
mov rcx, qword [0x01965a38]
lea rbp, [0x01965a38]
cmp rcx, rbp
je 0x18f9677
bt dword [rcx + 0x1c], 0x16
jae 0x18f9677
cmp byte [rcx + 0x19], 2
jb 0x18f9677
mov dword [rsp + 0x20], eax
mov dx, 0x14
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4500]
mov r9, rbx
call fcn.018f88c0
movzx esi, r12w
or esi, 0x80070000
cmp r12d, r15d
cmovle esi, r12d
cmp rdi, r15
je 0x18f9696
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
or rcx, 0xffffffffffffffff
lea rdx, [rbx - 0x18]
mov eax, ecx
lock xadd dword [rdx + 0x10], eax
add eax, ecx
cmp eax, r15d
jg 0x18f96b5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, r14
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov eax, esi
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret